(untitled)

How easy would it be to brute force a login page directly through the site given there is infinite password attempts?

>>20282 https://www.scientificamerican.com/article/the-mathematics-of-hacking-passwords/ Consider using the Simple Security Questions next time.

>>20282 I tried doing exactly that. It depends on how long their password is (and what characters it includes). It's also limited by the speed you can submit the POST requests. You can't go too fast, because internet doesn't really like that. I found out that if the password is only 4 chars long then it's pretty easy. If it's 5 chars long, then it's still doable, but harder. If 6, then it's pretty hard, but not impossible. Anything more than 6 chars - I would not even try.

>>20282 You can actually callculate it quite easily. var numberOfCharacters = 62; var passwordLength = 6; var postRequestsPerSecond = 4; var hours = Math.pow(numberOfCharacters, passwordLength) / postRequestsPerSecond / 3600 / 24; var years = hours / 365; console.log("Hours needed: " + hours + " \nYears needed: " + years); I guess my previous estimate has been too generous. 6 chars is way too much if you send only 4 post requests per second.

>>20284 What exactly defines the limit of post requests?

>>20286 Not sure. Everything along the way I guess (from your wi-fi, through all the switches to the server itself). I guess the main problem is the server which simply can't handle too many requests at the same time. It might even try to ban your IP if you send requests too fast.

>>20287 What if I were to send multiple requests from different devices with different ips?

>>20289 Well, that could work I guess. Still, the question remains: How many incoming requests can the server handle, before it crashes or starts to skip some.

>>20285 Whops, I just noticed that I wrote hours, but it was obviously supposed to be days.

>>20292 Id imagine a couple hundred requests is doable for a server for things like forums where several thousands users are there at once. Could you post the equation you used to calculate?

>>20294 1. Even if several thousand users are there at once, they usually download a webpage and read it, therefore the number of requests to the server at a given time is not necessarily reflected by the number of users online. 2. There is no equation to calculate this - that's dumb. It depends on factors such as the hardware of the server, whether there's load balancing involved, and so on. You might find some highly dubious figures online, but without knowing the environment you can't even begin to estimate that. 3. I hope you are not planning to inconvenience somebody for possibly very petty reasons, just so you can feel like a cool haxx0r, because that would make you the worst kind of a skid.

>>20295 I have zero knowledge on cyber security whatsoever evident by my posts which would make me below a skid, I just wanted to pentest some soykafty sites to learn a thing or two

>>20295 was referring to >>20285 estimate

>>20295 > 1. Even if several thousand users are there at once, they usually download a webpage and read it, therefore the number of requests to the server at a given time is not necessarily reflected by the number of users online. > 2. There is no equation to calculate this - that's dumb. It depends on factors such as the hardware of the server, whether there's load balancing involved, and so on. You might find some highly dubious figures online, but without knowing the environment you can't even begin to estimate that. You are right. I guess the server can handle it usually. But from my expereience, if you send post requsts too fast, it starts to skip. But that might be because I've done that from just a single IP. I don't know. I'm just saying what happened to me. But of course I might have done something wrong. > 3. I hope you are not planning to inconvenience somebody for possibly very petty reasons, just so you can feel like a cool haxx0r, because that would make you the worst kind of a skid. Ugh, I might very well be the "worst kind of a skid"... I don't know. You didn't specify what do you mean by "very petty reasons", so hard to tell if my reasons belong into that category.

>>20285 I am not sure it counts as "brute force", but obvious thing would be to download some database of leaked passwords, and try those first.

>>20297 There's no point in breaking the law if you just want to learn. You will learn far more by hosting pentest labs locally or doing CTFs since you will always find a vulnerability. Look at various API requests on sites you frequently visit.