What approaches are there for cracking user passwords for website/e-mail accounts? can only think of three strategies, but what else?

  • Algorithmically: Combinatorially attempting different sequences of alpha-numeric-special characters
  • Internally: Client database information is leaked, but actually, companies rarely store passwords for any to be leaked
  • Heuristically: Phishing information from the victim beforehand to somehow infer their password, or confidence trick them to enter it on a dummy website
  • Virally: Using a key-logger or other backdoor method that captures user's password as it is being entered or viewed on-screen
  • 7
    Companies do store passwords, and yes, they leak. Sometimes a misconfiguration even send passwords in clear to log files.
    – ThoriumBR
    Feb 14 at 13:47
  • 1
    Here's a good site with lots of resources: haveibeenpwned.com Feb 15 at 7:05
  • 1
    We have closed this question as it needs focus. With this wording, the question is too broad and needs excessively open answers. We encourage the OP to edit the question Feb 15 at 10:16

If you're talking about cracking passwords and not stealing them by other means, then there are only two techniques: online (query API over and over to try to get the password right) and offline (run the hashes through a hash cracking program). Both of the techniques can be subdivided into brute force, dictionary attack (customized for the target or not), and a hybrid of the two (e.g. HashCat rulesets).

  • can you elaborate on what hash cracking programs and HashCat rulesets are by editing the answer so that i understand the distinction and differences better
    – user610620
    Feb 14 at 13:08
  • 2
    @user610620 You're not understanding the answer. Online (querying) vs Offline (hash cracking), then each of those can be brute force, dictionary attack, or hybrid (brute force with dictionary, e.g.: HashCat).
    – Nelson
    Feb 14 at 17:17

I will add another bullet point:

  • Stupidly: when people use the same password everywhere, especially on that not so secure website

A while ago someone asked me to check their website's security, so I did the usual lazy thing and entered quotes in every form field. It turned out it was possible to inject SQL into the WHERE clause of a query whose results were not displayed. It was a bit cumbersome since all it could return to me was basically a single bit, if I hacked the WHERE to return more than one row it would throw an ERROR 500, otherwise not.

Fortunately you can access information_schema with that, so python script asked questions like "is there a table with name LIKE 'a%'"... and with a bit of dichotomy I soon had the whole database schema. Unfortunately the passwords were hashed and salted, but there was a table named "users_backup_old" which was soon dumped also, again through the single-bit-at-a-time hack. That took a while.

It contained all the cleartext passwords, presumably from an older, less secure version of the software. So the first instance of stupid is, your password in on a backup somewhere, or maybe on a USB key that fell off from someone's pocket somewhere. Or maybe it is in a GET request in a webserver log somewhere. Or in the proxy logs. Or in the NSA logs. Of course GET should never be used for that, but... Maybe spyware looked at it, logged it, then immediately leaked it without caring. This stuff leaks all the time, on the floor, everywhere.

Then, well, the table was named backup_old which means most of the passwords had been changed since then, but I still got to read his boss' emails on his company's Office 365. This guy had a very secure password with lower case, upper case, numbers, and even an exclamation point. When you went to the trouble to make such a strong hard to remember password, it really makes sense to use it everywhere.

Obviously his paypal password was also the same.

So basically it's pretty rare that a big name website gets hacked and passwords sucked out of it directly. But since people use the same password and email everywhere, all it takes is one insecure obscure website that gets hacked, and there are tons of those.

  • There are blackmail scams where the hacker threatens the victim in e-mail that they possess your password, showing it right up front, even if it has been changed since then. Meaning it is not a scam but a legitimate threat. The fact that they even obtained a password you once used without over-the-shoulder means says alot about insecurity
    – user610620
    Feb 15 at 3:17

Not the answer you're looking for? Browse other questions tagged or ask your own question.