BRUTE FORCE

A brute force attack systematically tries every possible combination of characters until the correct password or key is found. A dictionary attack uses a precompiled list of potential passwords (a "dictionary") to guess the correct one

Passwords are the first line of defense in protecting sensitive information and systems. The longer and more complex a password is, the more combinations an attacker has to try, exponentially increasing the time and resources required for a successful attack. Characteristics of a strong password: length, complexity, uniqueness, randomness

• Password Combination Formula:

  • 26 lowercase characters + 26 uppercase characters + 10 numbers + x symbols = character combination

    • e.g., 26 + 26 + 10 = 62^x combination

  • 6 Character all lowercase

    • character set size: 26

    • possible combination: 26^6 = 308,915,776 combinations

  • 8 Character all lowercase

    • character set size: 26

    • possible combination: 26^8 = 208,827,064,576 combinations

• Default Credentials

DICTIONARY ATTACKS

the effectiveness of a dictionary attack lies in its ability to exploit the human tendency to prioritize memorable passwords. this predictability makes them vulnerable to dictionary attacks, where attackers systematically test a pre-defined list of potential passwords against the target system. A well-crafted wordlist should be tailored to the target audience or system to significantly increase the probability of a successful breach. e.g., a wordlist enriched with gaming-related terminology and jargon would prove more effective against gamers than a generic dictionary. by understanding human psychology and common password practices attackers may efficiently crack passwords in less time.

WORDLIST

• Pre-made

  • commonly used passwords

  • leaked credentials from data breaches

• Custom

  • information gleaned during the reconnaissance phase

    • include details about the target's interests, hobbies, personal information, or any other data for password creation.

• Specialized

  • refine to target specific industries, applications, or even individual companies

HYBRID ATTACKS

this method combines the strengths of dictionary and brute-force attacks to drastically increase the likelihood of successful password breaches. this type of attack is initiated by launching a dictionary attack with a wordlist curated with common passwords to quickly identify any low-hanging fruit - accounts protected by weak or easily guessable passwords. if the dictionary attack proves unsuccessful, the attacker then transitions to a modified brute force attack to drastically reduce the search space. this specific hybrid attack is launched when the attacker has observed or suspected password patterns witin an organization. e.g., password policy

Password Policy Example

• Minimum length: 8 characters

• Must include:

  • At least one uppercase letter

  • At least one lowercase letter

  • At least one number

MITIGATIONS

• Rate Limiting

  • this is employed in software development and network management to control the rate of incoming requests to a system or API. Its primary purpose is to prevent servers from being overwhelmed by too many requests at once, prevent system downtime, and prevent brute-force attacks. By limiting the number of requests allowed within a specified time frame, rate limiting helps maintain stability and ensures fair usage of resources. It safeguards against abuse, such as denial-of-service (DoS) attacks or excessive usage by individual clients, by enforcing a maximum threshold on the frequency of requests. in a real-world scenario, rate limiting is applied on HTTP headers such as X-Forwarded-For to obtain the actual source IP address NOT a suspected attacker IP address as it can be spoofed or could be behind middleboxes such as reverse proxies, load balancers, or web caches. However, keep in mind that an attacker can set arbitrary HTTP headers in request, bypassing the rate limit entirely. This enables an attacker to conduct a brute-force attack by randomizing the X-Forwarded-For header in each HTTP request to avoid the rate limit.

• CAPCHA

  • Completely Automated Public Turing Test To Tell Computers and Humans Apart (CAPTCHA) is a security measure used to prevent bots from submitting requests. CAPTCHAs help prevent automated scripts from performing actions that could be harmful, such as spamming forums, creating fake accounts, or launching brute-force attacks on login pages. A flawed CAPTCHA implementation is when the CAPTCHA's solution is revealed in the response as this can be viewed and manipulated through proxys which can then be used by attackers.

    • as an attacker, there are tools and browser extensions that can be used to solve CAPTCHAs automatically. Many open-source CAPTCHA solvers can also be found. In particular, the rise of AI-driven tools provides CAPTCHA-solving capabilities by utilizing powerful image recognition or voice recognition machine learning models.