Questions tagged [password-cracking]
for questions relating to the cracking of passwords and the practices to mitigate against passwords being cracked.
15
votes
3answers
1k views
Store Credit Card Information in Password Manager?
For convenience purposes I manage my passwords with the password manager Bitwarden on my personal computer and smartphone with autofill function (but with asking for the master password or fingerprint ...
0
votes
0answers
20 views
John the Ripper: OpenMP mode vs using the “--fork=N” option?
Clang on OSX doesn't support OpenMP by default, so I could not compile JtR with OpenMP support without another Clang installation.
However, after looking at the below option, I wonder what the ...
-3
votes
0answers
52 views
What are the most uncommon/weird wifi hacking methods that are possible? [closed]
the common methods are
1- WPA cracking
2- WPS cracking
3- evil twin
0
votes
1answer
91 views
Can't detect hash type even if I have the password?
I can't found the hash type used in a database hosted in a VM.
My hash is c39e02416d974229752c28d7fcefe6e1, and my password is "azerty123456". I noticed that the user table has a column called ...
-1
votes
1answer
109 views
hashcat - cracking a salted sha256
Given a SHA512 hash, a salt, and username I am trying to crack the hash using hashcat. Every example I've found used a hashfile as input, is there way to provide salt and hash via commandline without ...
3
votes
1answer
149 views
Could a cracked password run as a command on the attacker's system?
I recently was made aware of 6 passwords that I use becoming compromised in data leaks, and they are now exposed in plain text.
I don't know how attackers go about cracking passwords or how they ...
3
votes
2answers
164 views
Is password dependent iteration count a good practice?
I consider the possibility of improving password security by increasing the hashing iteration count for short passwords.
The security benefits I see of this practice are:
Short passwords are better ...
0
votes
1answer
198 views
Crack password protected zip file with pkcrack
I have allfiles.zip contains only file allfiles.exe and is password protected. I heard about pkcrack, it is possible to get the file from a zip file which is encrypted if we have some part of ...
-1
votes
1answer
72 views
Best tool for cracking SHA-1s with unique pre and post salts? [closed]
I can't find a tool that supports cracking SHA-1s with different pre and post salts. Any suggestions?
0
votes
1answer
92 views
Question about birthday attack on password
Based on birthday attack, you need to generate at least 2^n/2 of possible combination to have 50% chance of finding a password. I have a list of 3000 random password make from 16 characters of upper, ...
1
vote
1answer
91 views
AES, RSA, ECC Key size [closed]
It is generally said that 2048-bit RSA keys are roughly equivalent to 112-bit symmetric keys and 2048-bit RSA keys are "sufficient for commercial use until around the year 2030" (https://security....
-3
votes
1answer
52 views
Finding encryption type of hash [closed]
Is it possible to find encryption type of a hash with a salt?
I have my other password in same encryption type, with the hash from that and the password, if that helps.
$2y$10$...
1
vote
1answer
68 views
Multicore hacker tools?
Have a school project coming up in multicore programming. I'm interested in/have used hacking tools alot before, and was wondering if there were any good tools out there that could benefit from being ...
1
vote
1answer
127 views
Do I understand SHA-1 brute-forcing speeds correctly? (Firefox Password Manager)
I read that the Firefox Password Manager has a "bug" (or rather poor design) in that it uses only a single sha-1 hash iteration for the password (which makes it extremely easy to brute-force ...
3
votes
1answer
140 views
KeePass Key File - Does it provide any meaningful security?
KeePass has the option for a master password and key file (and windows login). But I am not sure how it really helps security that much.
I can see a couple of scenario's:
The database and key are on ...
0
votes
1answer
49 views
How to create combinations of a password [duplicate]
I don't remember my password, I can't remember exactly the variation.
How can I brute force all the permutations of a word knowing the following conditions:
Idea of the word (in my mind).
Lower and/...
0
votes
1answer
73 views
BitLocker Recovery Key and Microsoft Account Password
I have a Windows 10 Pro machine; the administrator (and only) account is a Microsoft account. I am trying to set up BitLocker to ensure maximum security and safety, even from Microsoft.
I understand ...
0
votes
0answers
43 views
How to define rules for Jack the Ripper
I'm verry new to jack the ripper and I'm wondering how to use special rules for cracking a txt file. The password of my txt file is 123 and with the single crack mode it takes a lot of time to crack ...
0
votes
1answer
127 views
Recommended length of password [duplicate]
Why are we recommended to have at least 8 characters, and not 6 or 7 etc.? and the different set of character?. I only know that the longer the password is, the harder it is for brute force attack to ...
1
vote
1answer
49 views
Hashcat Mask Help
I'm wondering on how to run hashcat against wpa2 passwords that are in the following format:
common dictionary word . three digits . common dictionary word
Password Example:
falcon.824.watchman
Is ...
0
votes
0answers
58 views
Can a smartphone's PIN or password be brute-forced in an offline attack?
I know of exhaustive offline dictionary and brute-force attacks against any given online account, but can the same method be applied against phones, either Android/iPhones? Or would any such attack be ...
0
votes
0answers
123 views
John the ripper 0 password hashes cracked, 38 left
I'm stuck and new to this and would greatly appreciate any assistance!
Kali linux latest build trying to use Jack the Ripper
I have the hashes in a file called userhash.txt
So I try this: (just ...
0
votes
1answer
117 views
hashcat specify number of characters
I am trying to figure out a macOS hash 10.8+ and I happen to know that it uses A-Z, a-z, 0-9, is 6-8 characters, and almost certainly random. Currently, it spits out an error regarding hash length ...
1
vote
3answers
142 views
What should a secure passphrase look like?
We all know that passwords should not only be randomly generated, but also look random. The reason is that attackers can use patterns or existing words to be able to bruteforce the passwords faster, ...
3
votes
3answers
210 views
How ethical is it to publish an (anonymous) password list from real sources
I'm currently doing security research on the dangers of using default or well known 'secrets' for applications.
To test how big of an issue this actually is, I decided to download local copies of ...
0
votes
0answers
52 views
Breaking a tough password using john
I'm trying to crack a pretty advanced password on my computer and I've had it running for about a day on john's default settings.
Its gotten through roughly (a day times 23000kp/s) passwords.
I have ...
2
votes
2answers
100 views
Can a rogue client bypass the Wi-Fi Access Point?
Let's assume that one client contains malware, and that it belongs to a Wi-Fi network protected with WPA2/Personal (hence, via a password known to the piece of malware), where some other vulnerable ...
1
vote
1answer
571 views
Using hashcat in order to crack the JWT signature in WebGoat
I've recently started to practice my penetration testing skills and I got started with WebGoat.
I got to the "Authentication Bypass" chapter, to the JWT Token cracking. WebGoat presents this JWT ...
2
votes
0answers
127 views
Where is the Administrator password for McAfee Endpoint Security stored on the local machine?
Where is the Administrator password for McAfee Endpoint Security stored on the local machine?
I've tried to locate the Administrator password for McAfee Endpoint Security in the registry on the local ...
3
votes
1answer
73 views
How much less secure is a password with a repetitive pattern of characters?
I want to make sure my password is very difficult to bruteforce but also easy to remember and convenient.
So my idea is to just use a short password and repeat it a few times like this:
...
4
votes
0answers
79 views
Kerberos Attacks Questions
It's amazing how many "Attacks on Kerberos" articles exist out there and almost none really explains the small details.
My guess is that usually they assume it's basic knowledge and sometimes, they ...
1
vote
1answer
162 views
How to crack a list of hashed passwords given their possibilities
I am trying to crack a number of passwords that have been hashed using SHA-256 using some java code.
I have the hashes available and I also have the possibilities in which the password can be. Some ...
3
votes
1answer
217 views
How secure is a 100-bit password in 2018 and onwards?
Long story short, I share a server with a few other people and store my backups there. All these backups are archived to a .7z file using AES-256 encryption, using a randomly-generated password of ...
4
votes
2answers
320 views
How does a zip file detect a correct password?
When extracting files from an encrypted zip archive, the user is asked to give a password in order to read the original file.
How does an encrypted ZIP detect when the user has given the correct ...
1
vote
2answers
124 views
How to crack a password given its hash and its possibilities
I am trying to crack a number of passwords that have been hashed using SHA-256.
I have the hashes available and I also have the possibilities in which the password can be. Some of these possibilities ...
1
vote
2answers
169 views
How bad is using date to generate a “random” password?
I came across a post about generating random passwords.
Apparently the preferred way is
date | md5sum
I am aware that using the date for this is bad, but how bad is it?
How does it fare when ...
0
votes
1answer
71 views
Choose a sentence, a number, and the name as password [duplicate]
I would like to have your point of view about something I found on internet.
The goal here is to help people to use stronger passwords, it's not perfect, but I believe that asking people to use ...
1
vote
1answer
140 views
Define Patterns in Crunch
I am trying to achieve a very specific pattern with crunch. The Wireless Router I use has a very specific Pattern used for the default Password generated by my Provider. I want to create a wordlist or ...
3
votes
2answers
146 views
Is using a phrase from a book as a password such a bad idea
I've been told/seen online that choosing a sentence or a phrase from a book and using it as a password is a bad idea. How is this true? Unless the potential attacker knew which book you used I don't ...
3
votes
2answers
216 views
How to choose between password derivation or encryption?
Suppose you use a password manager having all possible features of modern password managers: encryption with a key derived from your master password, auto-filling, cloud or local storage, browser ...
1
vote
1answer
249 views
Can a password cracker reverse engineer my generation method?
Lets say I generated a password with really awful entropy seed (5 bits~), but then used another selection process (with a low entropy seed as well) to select at random a method to generate a password (...
0
votes
3answers
125 views
Would it be more secure to enforce “at least one upper case” or to enforce “at least one letter (any case)”
I am devising a set of password requirements. I am requiring users to use the following:
Minimum 8 characters
Minimum 1 number
Minimum 1 special character
Minimum 1 letter (any case)
I would like ...
1
vote
0answers
39 views
Increase password iterations?
Is it possible to strengthen the macOS login password by increasing the number of sha-512 iterations?
1
vote
1answer
61 views
How do Field Programmable Gate Arrays (FPGAs) compare to Graphics Processing Units (GPUs); for cracking hashes?
As a general rule, GPUs are more effective than CPUs when it comes to performing acutely repetitive tasks, like iterating over lists and generating permutations of a set (i.e. exhausting dictionaries &...
1
vote
0answers
74 views
How to create a keygen [closed]
I have a list with approx 500 serial numbers (each one with 10 digits) and all the 500 passcodes generated for those serials (also with 10 digits, but alphanumeric).
Is possible to discover the ...
1
vote
1answer
281 views
Hashcat: How to discard words of length less than N after rules have been applied?
Hashcat: How to discard words of length less than N after rules have been applied?
I know of the rules <N and >N that discards the word if its length is less than and greater than N, ...
0
votes
1answer
190 views
Both Ophcrack and ONTP&RE incorrectly show Windows 10 passwords as blank
I'm trying to crack a Windows 10 laptop that I myself set a password on a day or so ago. So far I've tried booting into Ophcrack 3.6 and ONTP&RE (Offline NT Password & Registry Editor) from ...
1
vote
1answer
80 views
Do hacks of mainstream web applications tend to happen more from random attackers brute forcing or from targeted heuristic attacks?
I'm writing up advice for selecting a master password for a password manager, and I'm wondering if there is available data about the likelihood of different attacks that result in a cracked password. ...
0
votes
1answer
688 views
Brute-Forcing DVWA login page with hydra
I'm learning how to brute force web login pages with a popular brute force tool called "Hydra". I'm using Kali Linux (VirtualBox) to do this. I've installed DVWA (Damn Vulnerable Web Application) and ...
1
vote
1answer
122 views
If someone has a hashed password, how long till they decrypt it?
Earlier my friend suggested that we have a race to see who could decrypt a hashed password first. I want to do it but I don't want it to be an all month thing. I know when passwords are hashed they ...
