1

I recently wrote a website for my company and have been asked to Pen test it as well as the server. Have run SQL map and no vulnerabilities there, however I want to check if my hash and things are good enough as well as any vulnerabilities to the server its self. When I trained we had a working copy of L0phtcrack. Downloaded the trial to see if it was still as good.

I set it to the following:

>  · Retrieve passwords by sniffing the local network   · Perform
> 'Strong' password audit   · Display domain password belongs to   ·
> Display passwords when audited   · Display password hashes   · Display
> time spent auditing each password   · Give visible notification when
> done auditing   · Show method used to crack password

However this gets me:

No encrypted passwords were imported. The l0phtcrack 6 wizard cannot continue. Please try another password retrieval.

So I run the wizard again to check my local PC just to see if there is a problem, And I get the same response I cannot do anything.

So I have two questions:

1: What am I doing wrong? It has been a fair few years since I properly pen tested and am very rusty.

2: Anything better out there currently to detected and crack packets? I know about wireshark for sniffing.

---update---

I do now realize that it has stopped being supported and developed, in that case good alternatives for packet sniffing and cracking

Improve this question
1
  • Why is your company doing this in the first place? An outside pentester should have been hired!
    – Deer Hunter
    Feb 19, 2014 at 7:43

1 Answer 1

Reset to default
2

I haven't used l0phtcrack in a long time, but I would suggest trying out John the Ripper.

I would also recommend grabbing one of the community enhanced version, for windows, here is a direct link http://www.openwall.com/john/g/john179j5w.zip.

I should also mention that you will want to grab a decent wordlist as the built in one may not be enough. There are a few good wordlists to start with at https://wiki.skullsecurity.org/Passwords.

The JTR syntax can be a bit confusing, but it is really powerful if you want to really get into password cracking.

Improve this answer
6
  • Keep getting "no password hashes loaded see FAQ" have tired --worldlist==password.lst and keep getting password file required
    – Marriott81
    Feb 18, 2014 at 16:35
  • do you have a file containing your hashes?
    – Casey
    Feb 18, 2014 at 16:43
  • It came with password.lst, I made a simple txt called crack me with user:hashhere in it to test it out and its just not doign anything.
    – Marriott81
    Feb 18, 2014 at 16:51
  • What kind of hashes are you trying to crack?
    – Casey
    Feb 18, 2014 at 17:27
  • You can use the --force option, described openwall.com/john/doc/OPTIONS.shtml to force it to use a particular hash type.
    – Casey
    Feb 18, 2014 at 17:28

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .