0

So I'm interested in Brute Force attacks and I have made them with Python 3 and C++. However, those only reached a max of about 20 million passwords per second.

I know for a fact that 1 billion passwords per second has been reached. How is this possible and what methods are used?

  • 2
    Are you talking about offline hashing, trying to brute force a password? – Matthew Apr 10 '18 at 10:52
  • 1) Heavy manual optimization, 2) OpenCL/CUDA – forest Apr 10 '18 at 11:03
  • 3
    What kind of hashing is used in the cases you mention? MD5, SHA1, PBKDF2... ? The speed you can achieve depends a lot on the hashing method used to protect the passwords. I'm pretty sure that 1 billion with properly used PBKDF2 is currently impossible. – Steffen Ullrich Apr 10 '18 at 11:13
  • 2
    Please include some more detail in your question to get a good answer. Details include but aren't limited to: Hashing algorithms (if present), type of attack (local/remote, if remote, what proto?), ... – Nomad Apr 10 '18 at 11:38
  • Can you provide a source for your claim? – Tom K. Apr 10 '18 at 16:16
5

With that kind of speed, I can only assume you're talking about offline attacks (e.g. John the Ripper). Also, the metrics for speed are heavily dependent on the type of password you're attempting to crack.

They key to getting speed is to 1) use software capable of maxing out hardware, and 2) throwing hardware resources at the problem.

For #1, it depends on the type of password. For example, Hashcat is great for computing hashes using GPUs. I'd also recommend John the Ripper. You'll need to be sure that you're compiling it to work with your hardware. Here are a couple of resources to dive deeper into doing so, for JTR:

For #2, here's a link to someone's cracking rig:

Note the use of multiple GPUs with heavy cooling. Also, note his results using both JTR and Hashcat.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.