for questions relating to the cracking of passwords and the practices to mitigate against passwords being cracked.

learn more… | top users | synonyms (1)

0
votes
0answers
31 views

Generate Custom Brute Force Dictionary from Partial Knowledge of Password [closed]

I'm trying to create a wordlist to brute force an old TrueCrypt volume I found. I have a hazy memory of what the password is, and I'm confident I can brute force it if I can get together a password ...
1
vote
1answer
56 views

John The Ripper Unknown ciphertext format name requested

I wanted to crack my windows xp passwords contained in the SAM file with john the ripper, this file contains hashed passwords with NTLM algorithm, but when i use this command to specify the hashing ...
0
votes
1answer
43 views

show previously hacked passwords with John The Ripper

I tried to crack my windows passwords on the SAM file with john the ripper, it worked just fine, and it shows me the password. But when i try to hack the same file again, john just tells me : Loaded ...
0
votes
1answer
31 views

samdump2 Error reading ControlSet: _RegOpenKey

I copied both SAM and SYSTEM files from my Windows7 OS, and then used this command to read the content of the SAM file samdump2 SAM SYSTEM > mdp_chiffres.txt, but i'm getting this error Error ...
1
vote
1answer
276 views

Law enforcement cracked my phone?

Police took my android phone a few months ago. It was encrypted and had the 10 max tries destruction thing set on. I noticed that yesterday the device disappeared from my android device manager. ...
41
votes
7answers
5k views

Are partially typed passwords a potential security risk?

I just sat down at my work computer and began to unlock it by typing in my password, I got 6 of the 8 characters in and decided I wanted coffee and walked away to get it. I came back, realized I left ...
5
votes
1answer
99 views

Can posting “howsecureismypassword” results be a security risk?

Say that someone asked how secure my password is, if I give them the https://howsecureismypassword.net/ results of it, (especially if I disable the named numbers mode,) can that person brute force ...
0
votes
3answers
63 views

How to use password salt the right way [duplicate]

I understand the basic idea of password salts. You generate a 'random' string of data prepend this data to a user password store password and salt (salt maybe even in 'clear' form) Like in the ...
0
votes
1answer
19 views

Alternative to retrieve zip crypted content to brute force [closed]

I ended up a few years ago ( maybe 3) to crypt some video on my usb( in order if I loose the device) the material not to be accesible. Hoewer it is not possible for me now to ...
2
votes
0answers
117 views

Has password strength been an *actual* problem in a professional context? [closed]

Among the more security savvy community (very much including security.stackexchange) there is an ongoing discussion about the strength of different password policies. Examples include the ...
5
votes
1answer
144 views

Blocking Chinese IP addresses

I recently checked one of my servers' auth.log file and noticed some very suspicious activity. I recently shut down my server's ssh daemon, so the logs end on Jan 22, but what I noticed after ...
0
votes
1answer
55 views

John The Ripper 'No password hashes loaded'

Please forgive the newbiew question, but we all have to start somewhere, right? Following reading this excellent book, I am trying to learn John. I've been through the FAQ and this tutorial, but am ...
0
votes
1answer
68 views

Can anyone help me build a combo file suitable for my problem? [closed]

I have a router model C1000A company: CenturyLink Actiontec I bought it through eBay, my problem is that I can not connect to the Settings page because I do not have the admin password (the password ...
130
votes
16answers
17k views

Is the BBC’s advice on choosing a password sensible?

In this article on the BBC’s website they offer advice on how to develop a password. The steps are as follows. Step 1: Choose an artist (a recording artist I presume) Lets choose as an example ...
2
votes
0answers
57 views

Can I see the contents of SAM file with a plain text-editor? [migrated]

I have exported the SAM and SYSTEM as Registry Hive Files and I was wondering if it is possible to look inside those files to see what they contain? I opened them with Notepad but I didn't ...
27
votes
2answers
3k views

Is it possible for my password to have more than one password combination?

Can my password have more than one password combination? I read up on physical combination locks (the lock you open with numbers) and I learned that a combination lock can have about 40 or more ...
-2
votes
1answer
52 views

How can you set a wireless router password that nobody (including yourself) knows? [closed]

Consider the following hypothetical situation: On a Macbook, A hacker can view the screen of your machine (and may have a keylogger installed). It is impossible to remove them even by reinstalling ...
2
votes
0answers
27 views

hashcat with pepper

During password auditing, I found the pepper key used along the salt during password hashing. I want to know how can I crack it using hashcat/oclhashcat? As far as I can tell, this are the following ...
0
votes
0answers
24 views

john the ripper - what does the T[z0], T[*0] rule mean?

I'm trying to understand John the Ripper wordlist mangling rules. I believe the official documentation doesn't explain what the preprocessor does for the the NT rule where you just want to iterate ...
2
votes
0answers
34 views

Customize John The Ripper BF technique

Is it possible for me to customize the way John the Ripper brute forces a .cap file? I, knowing my WiFi password, want to crack it fast as possible (no hit with word list). Can I customize John to ...
3
votes
1answer
78 views

John the ripper is not identifying hashes

I'm attempting to use JTR against a password protected zip. I have created the hash file using:zip2john filename.zip > filename.hash and i get a successful output:file.txt is using AES encryption, ...
4
votes
1answer
62 views

Unable to get correct base for cracking Crypt3 SHA-512 on Linux with Python

I am reading a book and it gives me a simple Python script to crack /etc/shadow passwords that were encrypted with the crypt() function. It then challenges you to amend the Python program to work with ...
1
vote
1answer
20 views

Incremental charset with no duplicate adjacent letter

I'm using John the Ripper and the following charset in the creation of a word list: [Incremental:Upper8] File = $JOHN/upper.chr MinLen = 8 MaxLen = 8 CharCount = 36 The command: john –stdout ...
0
votes
0answers
71 views

Generate password list with specific keywords and length

I need to generate a list of passwords to try penetrating into a wi-fi network. I have a pretty big list of keywords and I want to use them to generate as many possible passwords as possible, which ...
0
votes
1answer
64 views

hashcat hash type, convert sha256 binary to hex

I am attempting to use hashcat to crack a hash that is 32 characters in length. I know the hash is sha256. When i run the following command hashcat -m 1400 binary-hashfound.txt ...
-9
votes
1answer
137 views

Can you decrypt this encrypted password? [duplicate]

I'm coding a social network so I need to get serious about security as people will be sharing personal information on my site. Can you decrypt this encrypted password? ...
36
votes
6answers
7k views

Somebody hacked my router and changed my wifi SSID

One of my neighbours hacked the password of my router and he uses my limited internet package. I change the wifi SSID almost daily, but he can hack it easily. Today, he changed the SSID to a hate ...
2
votes
1answer
59 views

Strength of variable-length generated password

I am contributing to the Word Sequencer plugin for KeePass password manager, which can generate diceware-style passwords using a high-quality PRNG. Something in particular I'm working on is estimating ...
4
votes
2answers
689 views

I tried to break my WiFi: is 8 uppercase letter strong enough?

My Wi-Fi WPA-PSK password looked pretty weak: 8 uppercase letter. I have checked with another router from the same provider and the pattern is the same. To see how weak this is I tried to hack it ...
7
votes
2answers
301 views

If WPA2-PSK is insecure, what other options do home users have?

from what I'm reading online it seems that one can land attacks and successfully crack a WPA2-PSK wifi network, is that true and if it is, how home users can secure their networks? I seen an ...
0
votes
0answers
70 views

Hydra command for cracking a webpage which uses <span> tag for failed login attempts

I'm trying to for crack a simple webform for testing hydra in Kali. When the webpage encounters a wrong username and password combination it pops up a message using the following html code:: ...
6
votes
1answer
203 views

Is mega.co.nz using my Browser for cracking passwords?

recently i found on my Firefox Profil, under .../storage/.../idb/ a File named "https+++mega.co.nz", i looked inside those files, some are encrypted (couldnt read it in Notepad++), but i found 27 ...
2
votes
0answers
32 views

cracking krb5 passwords (des3-hmac-sha1 and des-cbc-crc )

I'm trying to audit kerberos passwords. The available formats are des3-hmac-sha1 and des-cbc-crc but I cannot find a possibility/a tool to crack them. For other hash-types I used John the Ripper, but ...
1
vote
1answer
42 views

Hydra Performance [closed]

I was wondering if anyone had an idea of hardware specs which improve the performance of programs like Hydra. My initial thought is that it shouldn't make too much of a difference but I wanted to know ...
0
votes
0answers
1k views

reaver - [!] WARNING: Failed to associate with xx:xx:xx:xx:xx:xx (ESSID: (null))

I am familiar with dict-password cracking but I recently moved on to reaver. When I run reaver, it pops up with an error [!] WARNING: Failed to associate with xx:xx:xx:xx:xx:xx (ESSID: (null)). I ...
2
votes
1answer
59 views

How easily will the vBulleting data from vBulletin and Foxit be cracked? What data is at risk? How was it encryted?

vBulletin Solutions and Foxit Software were breached. The culprit (ColdZer0 or Coldroot) claims to have data from 479,895 vBulletin Service and Foxit Software accounts that include identifiers, ...
5
votes
1answer
968 views

Should I be worried about brute-forcing passwords that encrypts AES?

I am building an application that needs to locally store sensitive data, that is encrypted using the sha256 of a password provided by the user. It uses AES for encryption. I am worried that some ...
1
vote
1answer
115 views

Is it possible to recover a Diskcryptor volume password?

Must admit to being dumb: I have encrypted one partition from my external hard drive with the AES-Twofish-Serpent algorithm and used a key file with a password. My PC ran into a problem and now the ...
1
vote
2answers
119 views

Does using NATO's phonetic alphabet increase password strength?

Given an alphanumeric password intended to be strong yet easy to remember, we change each alphabetic character by its NATO alphabet counterpart (e.g. 'cat' becomes 'charliealphatango'). I understand ...
4
votes
3answers
266 views

Can using emojis make someone's password safer?

I was just thinking about this the other day, after reading about making safe passwords, you have a few options: The first would be, adding numbers, or something other than just a word ...
1
vote
1answer
84 views

why don't we measure the strength of crypto against the cost it would take to crack it? [closed]

I hear all the time how many hours it would take to break a certain type of encryption. I think this may be the wrong metric to look at ever since scaling became an easy to implement solution. Sure ...
5
votes
1answer
158 views

Is there an equivalent of an Apple cryptochip in Android devices?

Apple has a cryptochip which, beside managing the encryption keys, tunnels authentication and provides throttling of failed attempts, as well as the ability to trigger a device wipe after several ...
2
votes
1answer
70 views

Password cracking using a wordlist

I came across a test question that said "Given a random password, which type of mode typically produces fastest results?" and the two likely answers were "brute force" and "incremental". The ...
1
vote
1answer
128 views

custom input format for hashcat

I am doing a password strength audit (I have permission). I'm using Hashcat. It supports formats like sha-256(password.salt) and sha-256(salt.password) but my hashes are generated by ...
3
votes
4answers
160 views

Password Policy: Issue random generated passwords / Let the user choose a password

I'm currently thinking about a new password policy. Originally I wanted the users to choose a password that is X digits long, contains numbers, special chars, lower and upper case,... but then I did ...
2
votes
0answers
64 views

Password cracking based on properties of target

Many people base their passwords on some characteristics or properties of their persona, which might not even be included in wordlists used for a dictionary attack. If one would put research into ...
2
votes
1answer
106 views

Bruteforcing an iOS PIN

The iOS Security document describes several security mechanisms implemented in iOS 9. I am specifically interested in the actual security of a 4 digits PIN on iOS. I am looking for tangible ...
1
vote
1answer
80 views

What was the purpose of this attack if one took place?

Background Windows 7 Home Edition HP desktop (no av/no firewall/ remote assistance enabled) two external drives attached/no documents on internal drive connected to fios wifi (wep ...
0
votes
2answers
70 views

password strength audits and mitigations

Reading this article about detecting bad passwords in the enterprise, made me want to ask if anyone here has attempted any audit like this. It would be an effective attack: There may be a good ...
3
votes
1answer
147 views

what order does the incremental mode of john the ripper, brute force passwords in?

I am practicing reversing md5 hashed passwords using John the Riper and was curious about some behaviour. I added the md5 hash of zaa to the top of the file with the hashes and when I ran john ...