Questions tagged [password-cracking]
for questions relating to the cracking of passwords and the practices to mitigate against passwords being cracked.
700
questions
0
votes
1answer
45 views
Avoiding password cracking by using custom hashing procedure?
In summary: the idea behind password cracking is just to replicate the password validation procedure of a web server locally with lots and lots of attempts and check whether the output of that ...
0
votes
0answers
77 views
Someone transferred funds from my bank to my ETrade account [closed]
I got "hacked", my various accounts have been broken into. I have now changed all my passwords, random 16 character strings, on a secure machine, disconnected the compromised computer and ...
0
votes
0answers
89 views
Can someone prove my theory wrong about passwords (but not by theoritical answers)? [closed]
Can someone prove my theory wrong (but not by theoritical answers)? My theory is - even if passwords are simple and easy to remember but if they are atleast 15 characters long (like - "...
1
vote
0answers
41 views
Hashcat first wordlist then brute force if nothing found
I'm trying to run my hashcat as automated and efficient as possible.
I have a file with NTLM hashes:
607C4CDCDA0EFBF023C4DEA52DF90641
D25ECD13FDDBB542D2E16DA4F9E0333D
AAD063F78DA1183CBD8BD7812FADF9C6
...
1
vote
1answer
102 views
How best to crack password for MacOS encrypted .dmg, given I know the majority of the password content? [closed]
Encrypted .dmg on MacOS High Sierra, tested password before sending for repair. Upon return from repair, password does not work. The possibilities I see are the .dmg file is corrupted, or I'm wrong ...
1
vote
0answers
45 views
How much time will Fugaku supercomputer take to generate a wordlist? [closed]
How much time will the Fugaku supercomputer take to generate a wordlist?
Length: 50
Combination: Alphabet(upper/lower) + numbers (0~9)
also, would wordlist generators make a significant time/...
1
vote
0answers
44 views
Dynamic format used in John the Ripper jumbo way slower than MDXFind
I'm currently doing some research on a pretty huge list of hashes (approx. 2 millions) and thus I'd like to improve my cracking speed. The hash format is 12 rounds of SHA512(password + salt), which ...
1
vote
0answers
95 views
Hardware for password cracking
I'm planning to extend my pentest services to Password Cracking, to be more precise: Cracking Active Directory Passwords, extracted from the customers Active Directory in order to check users ...
1
vote
1answer
55 views
Does knowing part of a passphrase for sure really mean that you can “disregard” that entire part when trying to crack it?
Alice bought 1 Bitcoin and encrypted her wallet.dat in Bitcoin Core.
Samantha, Alice's friend, notices the Bitcoin price skyrocketing and, while Alice is in the bathroom, steals Alice's wallet.dat as ...
2
votes
1answer
98 views
Password generation
I'm trying to generate all possible variation of a password.
The base word is like "PleaseSub!" and I need all possible version of it with uppercase, lowercase, etc.. I know there is ...
1
vote
1answer
100 views
zip password cracking with permutation
I have a zip file (.zip created by 7zip v15.10) that I remember the password to (~12 characters long), but it seems I've typed the password wrong while zipping it and now it doesn't open.
What are the ...
6
votes
2answers
2k views
How are website passwords cracked? [closed]
What approaches are there for cracking user passwords for website/e-mail accounts? can only think of three strategies, but what else?
Algorithmically: Combinatorially attempting different sequences ...
1
vote
1answer
120 views
Can you bruteforce a SSH password without alerting the server owner?
What happened?
This is a live event that a friend of mine is working on, a company's systems were breached by a Threat Actor (TA), when the Cyber Sec company was called in and tried to regain access ...
2
votes
1answer
70 views
How can the passphrase matter besides the very most obvious patterns? [duplicate]
Let's say that my passphrase is:
aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaapassword9
Yes, it looks ridiculous. But only because we already know it. An attacker, trying to brute-force their way into this ...
0
votes
0answers
18 views
TikTok's Password Character Limit [duplicate]
I've been making websites now for a while and when I've created websites or apps I've always put a minimum password size but usually a relatively large password size that isn't ever an issue for my ...
0
votes
1answer
103 views
Is using SHA256 to create 256bit secret key from bcrypt good ok?
I am trying to Use AES to store passwords for a password manager. For authentication I am already using bcrypt. As AES uses 256 bit Key can I use SHA256 to generate 256 bit key from hashed value of ...
0
votes
1answer
89 views
Knowing when a hacked password is correct
I was recently a victim of the any van data breach and so I started read up on password encryption and security - it is pretty amazing stuff. One thing that confuses me though is, since GPUs can now ...
6
votes
1answer
255 views
For bcrypt why is JTR so much faster than hashcat?
To keep it short I've recently been learning about hashing and password hash cracking on TryHackMe.
I was tasked to crack the following hash: $2y$10$0veO/JSFh4389Lluc4Xya.dfy2MF.bZhz0jVMw.V....
0
votes
0answers
69 views
Isn't this kind of password ultimately secure and insanely easy to remember? [duplicate]
Pick any dictionary word.
Think of a number over 10 and below 20.
Repeat the word as many times as the number, and end off with the same number (for example, "12").
Example:
...
1
vote
1answer
142 views
Password cracking using Quantum Computers
Suppose that I have a password that is n-digits long. Each digit can take m values. So the number of permutations will be m^n. I wanted to know how much time it would take a quantum computer to crack ...
1
vote
0answers
25 views
How to assess security of Argon2 parameters [duplicate]
I would like to hash user password with Argon2id, then use this hash as ECDSA private key. I made some tests with Python and passlib.hash and found following parameters:
memory: 32 MB
iterations: 100
...
-1
votes
1answer
34 views
Wordlist generate: uppercase and each character appears only one [closed]
I want to generate a wordlist that contains only uppercase characters on length 8 and each character appears only once.
Is there any way to do that?
1
vote
2answers
219 views
Hacking WPA/WPA2 passwords
Is there another method apart from using a wordlist to crack WPA/WPA2 passwords? because it's not going to work for all cases. Even using the biggest wordlist ever, there are cases where there won't ...
0
votes
0answers
21 views
Time it will take to crack a password file? [duplicate]
I'm trying to answer a multiple-choice question which is the following:
"Consider the security of a password file, which includes a 10 bit
salt and all passwords are hashed, but known to consist ...
28
votes
4answers
8k views
When passwords of a website leak, are all leaked passwords equally easy to read?
As far as I know, when passwords from a website leak, they leak in an encrypted form. Are all those passwords equally easy to decrypt? My hunch is that a 10-character-long password maybe gets ...
2
votes
2answers
289 views
Recommended length for WPA-2 password in 2020
I'm auditing my network setup and trying to determine an appropriate password length with a random set of digits and numbers. I found a Security Stack exchange answer but it was written in 2012 and ...
0
votes
1answer
89 views
Smaller password lists [closed]
I hack wifi passwords with kali linux on airmon-ng and I make always password lists with crunch but the lists are always too long (I'm talking about <100 PT) and I want to know if is there a ...
1
vote
1answer
106 views
What is the minimum secure length for gpg -c file.txt?
I want to use gpg -c with a user-generated password that I can easily remember. Are 16 characters enough? for example would a password similar to "I own 32 houses." be bruteforcable?
0
votes
0answers
32 views
Are there intrinsically weaknesses in accessing a same payload encrypted with different keys?
Assume we use AES256 to encrypt the same payload 100 times, each with a different key.
An attacker gains access to the 100 encrypted payloads, and nothing else.
Is there some way the attacker can gain ...
0
votes
1answer
158 views
How does john the ripper crack hashes using wordlists?
How does John The Ripper work when trying to crack passphrase of a private ssh key? As in what steps are involved when it tries to do so? What's the role of ssh2john in the whole process?
0
votes
2answers
80 views
Is there a utility you would use to create wordlists from directories and files? [closed]
I have a home directory and a gpg file I am attempting to brute force. Is there a utility that you know that will recursively create wordlist from directives and file contents?
1
vote
0answers
26 views
Making custom wordlists for languages besides English
I'm testing a site whose audience doesn't usually have English as their main language. When it comes to non-English, I consider there to be 3 groups
The target language's alphabet is a subset of the ...
3
votes
4answers
1k views
Are files encrypted with 7ZIP vulnerable to password crackers?
A client says they can't accept password-protected PDFs to put in their payroll system, so I have to send them without security. I don't want to send unsecured PDFs via e-mail because e-mail is ...
0
votes
0answers
57 views
Javascript PDF Brute Forcing
I am trying to learn PDF Brute forcing with javascript.
I've read about encryption algorithm of PDF 1.4 documentation here https://www.adobe.com/content/dam/acom/en/devnet/pdf/pdf_reference_archive/...
7
votes
4answers
4k views
Storing Username and salt in separate table
You have a User table:
UserID (auto-incrementing Integer)
Password hash
LastLogin
All related tables are linked by the UserID.
You also have a Username table:
Username
Salt
IncorrectLoginCount
...
0
votes
1answer
733 views
What is the plaintext password of 'hash part 1' in the shadow file?
on immersivelabs lab Password Hashes II
https://dca.immersivelabs.online/labs/password-hashes-ii/
there is a question:
What is the plaintext password of 'hash part 1' in the shadow file?
shadow.txt ...
0
votes
1answer
484 views
Brute-Forcing a Chrome Login Data file
Say I have a "Login Data" Chrome file that is encrypted with the user's Windows password. Is there a way I can brute-force the file and try to decrypt it using every password possible?
0
votes
1answer
111 views
routersploit bruteforce cred attcack using http
while i'm trying to do a brutforce attack on my router using routersploit.
Im getting the error
rsf (HTTP Basic/Digest Bruteforce) > run
[*] Running module creds/generic/...
1
vote
2answers
243 views
Cracking a truncated hash of type sha256(salt+pw+salt) [duplicate]
I'm trying to crack a password, whose hash was formed by first concatenating a known salt, the password and and another known salt, then applying sha256 and then truncating that to 32 characters. So:
...
1
vote
1answer
52 views
Does the random presence of a common password sequence within a larger password weaken the password?
I have a somewhat basic understanding of how entropy relates to password strength - generating a password with a truly random selection from some set (whether that's characters, or a set of dictionary ...
0
votes
1answer
63 views
Doesn't Hashing Negate Quantum Computer Cracking?
I've read/watched a lot about Quantum Computers, trying to really get into the physics of it. Seems like the topic is poorly explained. I do understand that it takes a lot of qbits to beat modern ...
0
votes
2answers
111 views
How do I make a word list for cracking password? [duplicate]
I already know the password format: 1 Upper Case Letters + 5 digits + bf (bf is the known letters, they must included in the password and at the end)
For example: A12345bf, C12301bf, D10282bf.
I want ...
1
vote
1answer
1k views
Unable to get John the Ripper to crack PDF password
I am new to Kali Linux and JTR but am playing around trying to crack a PDF file. I set the PDF Password to test so it's a known password on my own file. For whatever reason JTR appears to finish ...
1
vote
2answers
299 views
What's the difference between these MD5 hashes?
What's the difference between this format:
Hash found: admin:$1$$oLN1UCc1Y3T30QkMcKMSx0
and the following:
5f4dcc3b5aa765d61d8327deb882cf99
And also,
How to turn the first hash format into the ...
1
vote
2answers
127 views
Security of master password in a derived password manager
I am aware of other questions asking similar things as this one, but I believe this design addresses many of the issues raised in those questions. I'm also not concerned with making sure there's no ...
2
votes
0answers
493 views
Recovered a 7z password with hashcat, but it's not the right one
I am trying to recover a 7z file, but have forgotten the password. It's completely AES-256 encrypted (i.e. not even the filenames are available).
Steps:
Generated hash file with 7z2hashcat.pl
Ran a ...
1
vote
1answer
354 views
How to apply custom filters for John The Ripper when cracking RAR3 archive password?
My problem is that I'm trying to crack RAR file with is encrypted with RAR3 encryption.
Decided to try with John The Ripper.
Here are clues I have from my friend.
Max password length is 8
Only ...
0
votes
0answers
2k views
Decrypting a password-protected 7z file with Delta filter fails
I have made a 7z archive using Delta filter containing a wav file and I have protected it with a password. I am running a terminal in Kali Linux. My problem is that I cannot get the password cracked ...
0
votes
1answer
209 views
Which would be the best “keyfile” for KeepassXC and/or Veracrypt?
I am a Mac user. I opened a keyfile generated by Veracrypt and one generated by KeepassXC. The texts in both of them were quite short. Which keyfile is best (i.e., most random and harder to break ...
14
votes
13answers
9k views
Couldn't we create a string that produces the same hash as another string in SHA-256?
Let's say we have a separate hashing algorithm called s2 and it would convert Hello into dug84nd8.
If we could take the algorithm and just reverse engineer it to generate a string like 8GN492MD that ...
