1

I recently wrote a website for my company and have been asked to Pen test it as well as the server. Have run SQL map and no vulnerabilities there, however I want to check if my hash and things are good enough as well as any vulnerabilities to the server its self. When I trained we had a working copy of L0phtcrack. Downloaded the trial to see if it was still as good.

I set it to the following:

>  · Retrieve passwords by sniffing the local network   · Perform
> 'Strong' password audit   · Display domain password belongs to   ·
> Display passwords when audited   · Display password hashes   · Display
> time spent auditing each password   · Give visible notification when
> done auditing   · Show method used to crack password

However this gets me:

No encrypted passwords were imported. The l0phtcrack 6 wizard cannot continue. Please try another password retrieval.

So I run the wizard again to check my local PC just to see if there is a problem, And I get the same response I cannot do anything.

So I have two questions:

1: What am I doing wrong? It has been a fair few years since I properly pen tested and am very rusty.

2: Anything better out there currently to detected and crack packets? I know about wireshark for sniffing.

---update---

I do now realize that it has stopped being supported and developed, in that case good alternatives for packet sniffing and cracking

  • Why is your company doing this in the first place? An outside pentester should have been hired! – Deer Hunter Feb 19 '14 at 7:43
2

I haven't used l0phtcrack in a long time, but I would suggest trying out John the Ripper.

I would also recommend grabbing one of the community enhanced version, for windows, here is a direct link http://www.openwall.com/john/g/john179j5w.zip.

I should also mention that you will want to grab a decent wordlist as the built in one may not be enough. There are a few good wordlists to start with at https://wiki.skullsecurity.org/Passwords.

The JTR syntax can be a bit confusing, but it is really powerful if you want to really get into password cracking.

  • Keep getting "no password hashes loaded see FAQ" have tired --worldlist==password.lst and keep getting password file required – Marriott81 Feb 18 '14 at 16:35
  • do you have a file containing your hashes? – Casey Feb 18 '14 at 16:43
  • It came with password.lst, I made a simple txt called crack me with user:hashhere in it to test it out and its just not doign anything. – Marriott81 Feb 18 '14 at 16:51
  • What kind of hashes are you trying to crack? – Casey Feb 18 '14 at 17:27
  • You can use the --force option, described openwall.com/john/doc/OPTIONS.shtml to force it to use a particular hash type. – Casey Feb 18 '14 at 17:28

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.