1

I need to brute force Last Pass since I forgot my master password. Anyone know how is the format of the local storage of the extension?

I was logged into it so it must have local data. I see words.dic and LPMPMU in local storage.

closed as off-topic by Eric G, David, Steffen Ullrich, DKNUCKLES, Xiong Chiamiov Jan 29 '18 at 17:30

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "Questions asking us to break the security of a specific system for you are off-topic unless they demonstrate an understanding of the concepts involved and clearly identify a specific problem." – Eric G, David, Steffen Ullrich, DKNUCKLES, Xiong Chiamiov
If this question can be reworded to fit the rules in the help center, please edit the question.

1

Lastpass uses PBKDF2 for password hashing with 5000 iterations and SHA-256 (reference).

So if you have actually forgotten your password I doubt that you will be successful using brute force.

If you want to estimate your success probability get hashcat and run it in benchmarking mode. It will figure out how many hashes/second it can try and if you tell it what you are looking for (maybe you still have a vague idea what the password was) even how many possibilities there are and how long it will take.

  • Can you tell me what the local storage data means? imgur.com/evX9N3h – cswl Jan 27 '18 at 10:18
  • I'm 99% sure I know what keywords are used in my pw but I must've made some weird iteration of it (or lastpass has a bug?). Is it possible to do a dictionary attack using my keywords? – Joe Phillips Aug 28 '18 at 14:17

Not the answer you're looking for? Browse other questions tagged or ask your own question.