for questions relating to the cracking of passwords and the practices to mitigate against passwords being cracked.

learn more… | top users | synonyms (1)

4
votes
1answer
71 views

Spoofing an NTP server to allow bruteforce on any smartphone

We all know that smartphones (i'll take iPhone as an example) rely on SNTP/NTP servers to update a device's time and date. So, by creating an SNTP server that mimics Apple's server, we can actually ...
2
votes
0answers
36 views

Is it possible to remove the password on new generations of Lenovo X1?

I have lost the password for my setup. I set it up a few years ago and now I cannot recall it. The supervisor password is not stored in an EEPROM so the usual tricks do not work. I think it is in a ...
0
votes
2answers
2k views

How hard is it to hack into a webmail account with a strong 8 character password?

Assume the hacker starts with only your email address and he has high incentive to gain access. UPDATE: Also assume the password is unique (never used elsewhere) and it is NOT a guessable word like ...
-1
votes
0answers
12 views

Would the fact an attacker knows you are using common words affect difficulty? [duplicate]

So I think we've probably all seen the famous "correct horse battery staple" XKCD comic: https://xkcd.com/936/ Now let's say that this becomes common practice for a lot of users, so an attacker has a ...
3
votes
2answers
85 views

What scenario are 'extra' strong passwords and hashing algorithms actually protecting against?

Note: I completely understand the need for strong passwords & I understand that there is an issue of speed with hashing. I am just interested in better understanding the actual negative impact of ...
2
votes
0answers
21 views

The optimal settings of Winrtgen GIU

I'm working with Winrtgen GIU on windows, but I can't fix the right settings to create a rainbow table for a: password length=1-7 Charset=alpha numeric all space What are the ideal values to put in ...
3
votes
5answers
588 views

Why can passwords be used to encrypt data, but are less strong for authentication?

Encryption software is often password based. Even if the adversary gets your computer they can't get the data without knowing the password, and bruteforcing is infeasible. Websites use passwords to ...
2
votes
1answer
94 views

Recover password from .pfx file

I have an old Windows SmartClient application that is published with a signed certificate (a .pfx file). We want to extend the expiration date to more than one year. I've used a program called ...
24
votes
5answers
989 views

Would turning a Diceware phrase into a sentence decrease its security?

Diceware passphrase lengths are on the rise - up to six or seven words now. The old adage that passphrases are easier to remember may be true for shorter phrases, but six truly random words can be ...
0
votes
1answer
154 views

How long will it take to break a salted password?

Let's say that I have a system where all passwords must be 8 characters long and each character can be any 32 different values. All my passwords are hashed with a salt. I can test 64 passwords per ...
80
votes
10answers
9k views

Is there a threshold for a password so long it doesn't get any more secure or even becomes insecure?

I always hear "A long password is good, a longer password is better". But is there such a thing as a "Password is so long it is becoming unsafe" or "Password is long enough, making it longer won't ...
5
votes
1answer
2k views

What is “NAND mirroring”, the alleged technique that the FBI will use to crack the San Bernardino shooter's iPhone?

According to Ars Technica, Jonathan Zdziarski, a leading independent Apple iOS security researcher and forensics expert, has a theory about the FBI's newly discovered potential route into the ...
3
votes
0answers
56 views

Is it possible to use parallelism when computing a key derivation function for a single password/key?

Suppose I have an AES-256 encrypted file, and I want to derive the key using PBKDF2 and a given salt with a large number of rounds (say 1 million), but I'm limited by user tolerance for UI lag when ...
46
votes
7answers
9k views

How are GPUs used in brute force attacks?

I have read that GPUs can be used in brute force attacks? But how can this be done and is there a need for any other hardware devices (hard disks for instance)? Note: I'm more interested in web ...
3
votes
3answers
109 views

password cracking: time vs cost

I often see people refer to arguments like: A (hashed) password will be cracked in 1.000 years if you use a normal desktop computer, but if you use 100.000 computers (botnet) it will be cracked in ...
3
votes
3answers
143 views

Prevent password reusing across different sites

I'm generally against too strict or complex rules to accept passwords (rules like "It must contain at least one upper-case character, one number and one symbol" and things like that, see also XKCD ...
0
votes
2answers
131 views

Cracking a password Protected pdf file using John the ripper

What exactly happens after I provide the hash from the pdf file to John for cracking the password? Does John extract just the password hash from the file and work on it, or is there something else?
1
vote
2answers
63 views

Custom word list generation for a specific web domain

I am looking for a tool that generates a set of word lists based on the words it finds on the pages of a particular web domain. This question has an answer that generates permuted word lists starting ...
0
votes
1answer
83 views

Is Entropy all that matters in a Password? [duplicate]

My question is, is it more reliable having a password that is composed by words like FootballPractice more secure than using a password that has only 2 or 3 bits less, for example FootbalPractic , my ...
0
votes
1answer
39 views

How to speed-up data collecting of WEP AP for aircrack?

I'm using aireplay to collect some data from AP alongside with aircrack. Unfortunetlly, the proccess seems quite slow to me as I've reached 2000 in more than 20mins so far. What most affects the speed ...
3
votes
6answers
211 views

How secure is this process for creating passwords?

I've been research into how to be as secure as possible when it comes to password security for online services and websites. Obviously there are some big no no's like using dictionary words, using the ...
1
vote
2answers
47 views

JTR is not cracking XP SAM password(s), why?

I was trying the following commands john --format=LM xpPassword.txt john xpPassword.txt to crack the following hash: xpPassword.txt ...
6
votes
3answers
597 views

Encrypted password inside compressed archive

File compression utilities like Winrar or ZIP or 7zip encrypt the password and store it inside the archive. How safe is that? I mean you are giving away the archive with the password inside,it's not ...
1
vote
1answer
98 views

How to optimize cracking speed with Reaver

When testing network security with Reaver in order to find out WPS, what parameters do you usually use with respect to cracking speed? I've chosen for TP-LINK Archer C20i AC750 Dual Band a delay of ...
1
vote
1answer
80 views

How much more difficult does it become to crack a password when appending a 5-digit pin?

I have a quick question regarding password cracking. Lets say you append a 5 digit pin on the end of your password. An example would be instead of a password of "password" it would be ...
1
vote
1answer
65 views

Generate John the Ripper rule

This question asks for pointers about generating JtR rulesets, but the OP states I understand how to use it to make various permutations from a given wordlist Could someone please explain that? ...
1
vote
2answers
100 views

Is it a good idea to combine words from different languages to increase a password's strength? [duplicate]

I was thinking of a way to generate a password that is easy to remember, but hard to crack, like the famous "correct horse battery staple" suggested by XKCD, also discussed here, and I've realized ...
1
vote
1answer
514 views

John The Ripper Unknown ciphertext format name requested

I wanted to crack my windows xp passwords contained in the SAM file with john the ripper, this file contains hashed passwords with NTLM algorithm, but when i use this command to specify the hashing ...
0
votes
1answer
51 views

show previously hacked passwords with John The Ripper

I tried to crack my windows passwords on the SAM file with john the ripper, it worked just fine, and it shows me the password. But when i try to hack the same file again, john just tells me : Loaded ...
0
votes
1answer
207 views

samdump2 Error reading ControlSet: _RegOpenKey

I copied both SAM and SYSTEM files from my Windows7 OS, and then used this command to read the content of the SAM file samdump2 SAM SYSTEM > mdp_chiffres.txt, but i'm getting this error Error ...
1
vote
1answer
297 views

Law enforcement cracked my phone?

Police took my android phone a few months ago. It was encrypted and had the 10 max tries destruction thing set on. I noticed that yesterday the device disappeared from my android device manager. ...
41
votes
7answers
5k views

Are partially typed passwords a potential security risk?

I just sat down at my work computer and began to unlock it by typing in my password, I got 6 of the 8 characters in and decided I wanted coffee and walked away to get it. I came back, realized I left ...
5
votes
1answer
125 views

Can posting “howsecureismypassword” results be a security risk?

Say that someone asked how secure my password is, if I give them the https://howsecureismypassword.net/ results of it, (especially if I disable the named numbers mode,) can that person brute force ...
0
votes
3answers
75 views

How to use password salt the right way [duplicate]

I understand the basic idea of password salts. You generate a 'random' string of data prepend this data to a user password store password and salt (salt maybe even in 'clear' form) Like in the ...
0
votes
1answer
26 views

Alternative to retrieve zip crypted content to brute force [closed]

I ended up a few years ago ( maybe 3) to crypt some video on my usb( in order if I loose the device) the material not to be accesible. Hoewer it is not possible for me now to ...
2
votes
0answers
122 views

Has password strength been an *actual* problem in a professional context? [closed]

Among the more security savvy community (very much including security.stackexchange) there is an ongoing discussion about the strength of different password policies. Examples include the ...
5
votes
1answer
217 views

Blocking Chinese IP addresses

I recently checked one of my servers' auth.log file and noticed some very suspicious activity. I recently shut down my server's ssh daemon, so the logs end on Jan 22, but what I noticed after ...
0
votes
1answer
130 views

John The Ripper 'No password hashes loaded'

Please forgive the newbiew question, but we all have to start somewhere, right? Following reading this excellent book, I am trying to learn John. I've been through the FAQ and this tutorial, but am ...
0
votes
1answer
75 views

Can anyone help me build a combo file suitable for my problem? [closed]

I have a router model C1000A company: CenturyLink Actiontec I bought it through eBay, my problem is that I can not connect to the Settings page because I do not have the admin password (the password ...
136
votes
16answers
18k views

Is the BBC’s advice on choosing a password sensible?

In this article on the BBC’s website they offer advice on how to develop a password. The steps are as follows. Step 1: Choose an artist (a recording artist I presume) Lets choose as an example ...
28
votes
2answers
3k views

Is it possible for my password to have more than one password combination?

Can my password have more than one password combination? I read up on physical combination locks (the lock you open with numbers) and I learned that a combination lock can have about 40 or more ...
-2
votes
1answer
61 views

How can you set a wireless router password that nobody (including yourself) knows? [closed]

Consider the following hypothetical situation: On a Macbook, A hacker can view the screen of your machine (and may have a keylogger installed). It is impossible to remove them even by reinstalling ...
2
votes
0answers
32 views

hashcat with pepper

During password auditing, I found the pepper key used along the salt during password hashing. I want to know how can I crack it using hashcat/oclhashcat? As far as I can tell, this are the following ...
0
votes
0answers
27 views

john the ripper - what does the T[z0], T[*0] rule mean?

I'm trying to understand John the Ripper wordlist mangling rules. I believe the official documentation doesn't explain what the preprocessor does for the the NT rule where you just want to iterate ...
2
votes
0answers
41 views

Customize John The Ripper BF technique

Is it possible for me to customize the way John the Ripper brute forces a .cap file? I, knowing my WiFi password, want to crack it fast as possible (no hit with word list). Can I customize John to ...
3
votes
1answer
245 views

John the ripper is not identifying hashes

I'm attempting to use JTR against a password protected zip. I have created the hash file using:zip2john filename.zip > filename.hash and i get a successful output:file.txt is using AES encryption, ...
4
votes
1answer
77 views

Unable to get correct base for cracking Crypt3 SHA-512 on Linux with Python

I am reading a book and it gives me a simple Python script to crack /etc/shadow passwords that were encrypted with the crypt() function. It then challenges you to amend the Python program to work with ...
1
vote
1answer
29 views

Incremental charset with no duplicate adjacent letter

I'm using John the Ripper and the following charset in the creation of a word list: [Incremental:Upper8] File = $JOHN/upper.chr MinLen = 8 MaxLen = 8 CharCount = 36 The command: john –stdout ...
0
votes
0answers
111 views

Generate password list with specific keywords and length

I need to generate a list of passwords to try penetrating into a wi-fi network. I have a pretty big list of keywords and I want to use them to generate as many possible passwords as possible, which ...
0
votes
1answer
180 views

hashcat hash type, convert sha256 binary to hex

I am attempting to use hashcat to crack a hash that is 32 characters in length. I know the hash is sha256. When i run the following command hashcat -m 1400 binary-hashfound.txt ...