I have been messing around with Cain and Able and used APR on another computer (also mine) to get a hashed version of my username and password for my yahoo e-mail account, but I seem to be lost as to what to do next. I know that I need to crack the encryption on the password, but when I right-click on the hash and click on "Send to Cracker," it is not there when I go to the cracker part of the program. Therefore, I would like to know:

  1. Is there a particular name for the type of encryption employed by SSL (I think it may be AES, but I am not sure)
  2. Is Cain malfunctioning, or am I doing something wrong?
  3. Are there any other programs I can access that can crack SSL? (With a dictionary attack)

I am not super picky, but I would prefer something with a GUI.

*I know it is simpler to use SSLStrip in conjunction with wireshark, but I am challenging myself to keep everything on Windows.

closed as unclear what you're asking by Adi, Scott Pack, TildalWave, NULLZ, Mark Davidson Jul 22 '13 at 8:50

Please clarify your specific problem or add additional details to highlight exactly what you need. As it's currently written, it’s hard to tell exactly what you're asking. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.


Cain&Abel is a tool for cracking passwords. There is no password in SSL, so there is no password to crack. That is what you are doing wrong.

When a password is used "in SSL" it is actually transmitted inside a SSL tunnel, but the cryptography in SSL does not depend upon it in any way.

Note: there are some rare usages of SSL which include passwords processing but that's not what you observe, and SRP has been designed to be immune to offline password crackers anyway.

Not the answer you're looking for? Browse other questions tagged or ask your own question.