14:I[5228,["3385","static/chunks/3385-b76bb0d389ecb847.js","5753","static/chunks/5753-3df3dcd374d56bde.js","4462","static/chunks/4462-2f1547025558c923.js","1766","static/chunks/1766-e0a00c1dbb04d867.js","2122","static/chunks/2122-0aa89565809d0f14.js","8198","static/chunks/8198-02259efa89977c06.js","8058","static/chunks/8058-250b9e00e45a105b.js","2476","static/chunks/2476-39b31f73cd0731dd.js","4317","static/chunks/4317-05b07ec5dd2dfc17.js","8279","static/chunks/8279-51bfd849e487548c.js","9420","static/chunks/9420-af651d52266219df.js","1050","static/chunks/1050-c17118e9648df02f.js","9259","static/chunks/9259-b80e9833ae7b100c.js","7670","static/chunks/7670-77670847a8e0a1cb.js","1768","static/chunks/app/knowledgebases/%5BattackType%5D/%5Bid%5D/page-884b6d4b6fea536c.js"],"default"] 15:T489, A system does not enforce a strong password policy and the user picks a five letter password consisting of lower case English letters only. The system does not implement any password throttling mechanism. Assuming the adversary does not know the length of the users' password, an adversary can brute force this password in maximum 1+26+26^2+26^3+26^4+26^5 = 1 + 26 + 676 + 17576 + 456976 + 11,881,376 = 12,356,631 attempts, and half these tries (6,178,316) on average. Using modern hardware this attack is trivial. If the adversary were to assume that the user password could also contain upper case letters (and it was case sensitive) and/or numbers, than the number of trials would have been larger. An adversary's job would have most likely been even easier because many users who choose easy to brute force passwords like this are also likely to use a word that can be found in the dictionary. Since there are far fewer valid English words containing up to five letters than 12,356,631, an attack that tries each of the entries in the English dictionary would go even faster. 16:T512,

Execution Flow

Explore

Determine application's/system's password policy: Determine the password policies of the target application/system.

Techniques
Determine minimum and maximum allowed password lengths.
Determine format of allowed passwords (whether they are required or allowed to contain numbers, special characters, etc.).
Determine account lockout policy (a strict account lockout policy will prevent brute force attacks).

Exploit

Brute force password: Given the finite space of possible passwords dictated by the password policy determined in the previous step, try all possible passwords for a known user ID until application/system grants access.

Techniques
Manually or automatically enter all possible passwords through the application/system's interface. In most systems, start with the shortest and simplest possible passwords, because most users tend to select such passwords if allowed to do so.
Perform an offline dictionary attack or a rainbow table attack against a known password hash.

Password Brute Forcing