The purpose of this blog is to demonstrate how to brute force a login page using Burp Suite. There are other brute force tools such as Hydra and Ncrack. Although both are great tools, Burp Suite is more suitable for brute forcing a web application login page, whereas Hydra and Ncrack are more suitable for other protocols such as SSH and RDP.
Offline Password Cracking is an attempt to recover one or more passwords from a password storage file that has been recovered from a target system. Typically, this would be the Security Account Manager (SAM) file on Windows, or the /etc/shadow file on Linux. In most cases, Offline Password Cracking will require that an attacker has already attained administrator / root level privileges on the system to get to the storage mechanism.
As cybersecurity professionals we know a “strong” password is, supposedly, one that is at least 8 characters long with a combination of upper case, lower case, numbers, and special characters. But, as Bob Dylan said, the times they are a-changing. There is new movement in the industry to move away from this traditional password guidance to something more secure, user-centric, and friendly.
The most common two-factor authentication method is a password and a time-based one-time password (TOTP), which can be sent to your phone via SMS. So even if your password is compromised, the cybercriminals will need the second factor, a code sent to your phone, to log into your account. However, using SMS for two-factor authentication is not considered safe anymore. Why is it not safe anymore? What should we use then?
Online password cracking has advantages and disadvantages. It is effective if executed properly. There are numerous defenses to prevent attackers from cracking your passwords.
Black Box Penetration Testing tests a target with little to no prior knowledge about the target environment. Despite the best efforts of vulnerability scanning tools, they often miss critical vulnerabilities and major issues. These missed vulnerabilities can be exploited by attackers to gain full control of your environment. A Black Box Penetration Test identifies additional vulnerabilities and security issues. If minimizing cybersecurity risk is a goal, both a vulnerability scan and a Black Box Penetration Test are recommended.