Questions tagged [password-cracking]
for questions relating to the cracking of passwords and the practices to mitigate against passwords being cracked.
0
votes
0answers
58 views
Cracking Zip File Password Encryption [duplicate]
Hey all I am currently taking a computer security course and while doing some research in cryptography I found that it was possible to crack the encryption of a password protected file in an encrypted ...
1
vote
1answer
52 views
Will SIM‐like PIN on website as second password increase security
On SIM cards, which are used in mobile telephony, PIN (and PUK) is used. Unlike a password, they are locked after some incorrect attempts to prevent brute force attack. If wrong PIN is entered 3 times,...
0
votes
0answers
17 views
Security risks in confirming the username instead of confirming the username and password combination [duplicate]
Most of the login pages like Google, Outlook and Yahoo! confirm the username first and then ask for a password instead of confirming the username and password combination altogether. Isn't it less ...
2
votes
2answers
115 views
Is haveibeenpwned (HIBP) free and reliable? [on hold]
I have just started to explore HIBP to check whether we can use HIBP in our public facing interfaces.
AS per my read I have 3 options to check out.
Download the password dictionary and implement my ...
5
votes
1answer
133 views
Do ciphers and encoding schemes make passwords more secure?
I recently came across a tech professional advising a user to take some plaintext of their choice, run it through one of these ciphers, convert it to Base64, and then use the result as their master ...
0
votes
0answers
36 views
Specify Amount of type of character Crunch
I'm sure these questions pop up a lot, but I can't find one that does what I'm looking for.
So, I'm trying to use crunch to generate a wordlist with specific amounts of each type of character, i.e. 2 ...
0
votes
0answers
73 views
Convincing client to drop password validation rules
My client wants to include some rules to validate the passwords his clients can choose when creating a new account. Since his company handles sensitive client data, I think I want to convince him to ...
0
votes
1answer
75 views
Benchmark Password Cracking Tools
I want to perform a benchmark for the most popular offline password cracking tools (john the ripper and hashcat)?
What metrics or approach should i take about benchmarking in order to determine what ...
19
votes
2answers
2k views
Store Credit Card Information in Password Manager?
For convenience purposes I manage my passwords with the password manager Bitwarden on my personal computer and smartphone with autofill function (but with asking for the master password or fingerprint ...
0
votes
0answers
26 views
John the Ripper: OpenMP mode vs using the “--fork=N” option?
Clang on OSX doesn't support OpenMP by default, so I could not compile JtR with OpenMP support without another Clang installation.
However, after looking at the below option, I wonder what the ...
0
votes
1answer
95 views
Can't detect hash type even if I have the password?
I can't found the hash type used in a database hosted in a VM.
My hash is c39e02416d974229752c28d7fcefe6e1, and my password is "azerty123456". I noticed that the user table has a column called ...
-1
votes
1answer
181 views
hashcat - cracking a salted sha256
Given a SHA512 hash, a salt, and username I am trying to crack the hash using hashcat. Every example I've found used a hashfile as input, is there way to provide salt and hash via commandline without ...
3
votes
1answer
161 views
Could a cracked password run as a command on the attacker's system?
I recently was made aware of 6 passwords that I use becoming compromised in data leaks, and they are now exposed in plain text.
I don't know how attackers go about cracking passwords or how they ...
3
votes
2answers
175 views
Is password dependent iteration count a good practice?
I consider the possibility of improving password security by increasing the hashing iteration count for short passwords.
The security benefits I see of this practice are:
Short passwords are better ...
0
votes
1answer
569 views
Crack password protected zip file with pkcrack
I have allfiles.zip contains only file allfiles.exe and is password protected. I heard about pkcrack, it is possible to get the file from a zip file which is encrypted if we have some part of ...
-1
votes
1answer
76 views
Best tool for cracking SHA-1s with unique pre and post salts? [closed]
I can't find a tool that supports cracking SHA-1s with different pre and post salts. Any suggestions?
0
votes
1answer
97 views
Question about birthday attack on password
Based on birthday attack, you need to generate at least 2^n/2 of possible combination to have 50% chance of finding a password. I have a list of 3000 random password make from 16 characters of upper, ...
1
vote
1answer
100 views
AES, RSA, ECC Key size [closed]
It is generally said that 2048-bit RSA keys are roughly equivalent to 112-bit symmetric keys and 2048-bit RSA keys are "sufficient for commercial use until around the year 2030" (https://security....
-3
votes
1answer
55 views
Finding encryption type of hash [closed]
Is it possible to find encryption type of a hash with a salt?
I have my other password in same encryption type, with the hash from that and the password, if that helps.
$2y$10$...
1
vote
1answer
69 views
Multicore hacker tools?
Have a school project coming up in multicore programming. I'm interested in/have used hacking tools alot before, and was wondering if there were any good tools out there that could benefit from being ...
1
vote
1answer
131 views
Do I understand SHA-1 brute-forcing speeds correctly? (Firefox Password Manager)
I read that the Firefox Password Manager has a "bug" (or rather poor design) in that it uses only a single sha-1 hash iteration for the password (which makes it extremely easy to brute-force ...
3
votes
1answer
179 views
KeePass Key File - Does it provide any meaningful security?
KeePass has the option for a master password and key file (and windows login). But I am not sure how it really helps security that much.
I can see a couple of scenario's:
The database and key are on ...
0
votes
1answer
56 views
How to create combinations of a password [duplicate]
I don't remember my password, I can't remember exactly the variation.
How can I brute force all the permutations of a word knowing the following conditions:
Idea of the word (in my mind).
Lower and/...
0
votes
1answer
104 views
BitLocker Recovery Key and Microsoft Account Password
I have a Windows 10 Pro machine; the administrator (and only) account is a Microsoft account. I am trying to set up BitLocker to ensure maximum security and safety, even from Microsoft.
I understand ...
0
votes
0answers
66 views
How to define rules for Jack the Ripper
I'm verry new to jack the ripper and I'm wondering how to use special rules for cracking a txt file. The password of my txt file is 123 and with the single crack mode it takes a lot of time to crack ...
0
votes
1answer
155 views
Recommended length of password [duplicate]
Why are we recommended to have at least 8 characters, and not 6 or 7 etc.? and the different set of character?. I only know that the longer the password is, the harder it is for brute force attack to ...
1
vote
1answer
69 views
Hashcat Mask Help
I'm wondering on how to run hashcat against wpa2 passwords that are in the following format:
common dictionary word . three digits . common dictionary word
Password Example:
falcon.824.watchman
Is ...
0
votes
0answers
61 views
Can a smartphone's PIN or password be brute-forced in an offline attack?
I know of exhaustive offline dictionary and brute-force attacks against any given online account, but can the same method be applied against phones, either Android/iPhones? Or would any such attack be ...
0
votes
0answers
223 views
John the ripper 0 password hashes cracked, 38 left
I'm stuck and new to this and would greatly appreciate any assistance!
Kali linux latest build trying to use Jack the Ripper
I have the hashes in a file called userhash.txt
So I try this: (just ...
0
votes
1answer
200 views
hashcat specify number of characters
I am trying to figure out a macOS hash 10.8+ and I happen to know that it uses A-Z, a-z, 0-9, is 6-8 characters, and almost certainly random. Currently, it spits out an error regarding hash length ...
1
vote
3answers
162 views
What should a secure passphrase look like?
We all know that passwords should not only be randomly generated, but also look random. The reason is that attackers can use patterns or existing words to be able to bruteforce the passwords faster, ...
3
votes
3answers
211 views
How ethical is it to publish an (anonymous) password list from real sources
I'm currently doing security research on the dangers of using default or well known 'secrets' for applications.
To test how big of an issue this actually is, I decided to download local copies of ...
0
votes
0answers
55 views
Breaking a tough password using john
I'm trying to crack a pretty advanced password on my computer and I've had it running for about a day on john's default settings.
Its gotten through roughly (a day times 23000kp/s) passwords.
I have ...
2
votes
2answers
103 views
Can a rogue client bypass the Wi-Fi Access Point?
Let's assume that one client contains malware, and that it belongs to a Wi-Fi network protected with WPA2/Personal (hence, via a password known to the piece of malware), where some other vulnerable ...
1
vote
1answer
874 views
Using hashcat in order to crack the JWT signature in WebGoat
I've recently started to practice my penetration testing skills and I got started with WebGoat.
I got to the "Authentication Bypass" chapter, to the JWT Token cracking. WebGoat presents this JWT ...
2
votes
0answers
230 views
Where is the Administrator password for McAfee Endpoint Security stored on the local machine?
Where is the Administrator password for McAfee Endpoint Security stored on the local machine?
I've tried to locate the Administrator password for McAfee Endpoint Security in the registry on the local ...
3
votes
1answer
75 views
How much less secure is a password with a repetitive pattern of characters?
I want to make sure my password is very difficult to bruteforce but also easy to remember and convenient.
So my idea is to just use a short password and repeat it a few times like this:
...
4
votes
0answers
96 views
Kerberos Attacks Questions
It's amazing how many "Attacks on Kerberos" articles exist out there and almost none really explains the small details.
My guess is that usually they assume it's basic knowledge and sometimes, they ...
1
vote
1answer
215 views
How to crack a list of hashed passwords given their possibilities
I am trying to crack a number of passwords that have been hashed using SHA-256 using some java code.
I have the hashes available and I also have the possibilities in which the password can be. Some ...
3
votes
1answer
234 views
How secure is a 100-bit password in 2018 and onwards?
Long story short, I share a server with a few other people and store my backups there. All these backups are archived to a .7z file using AES-256 encryption, using a randomly-generated password of ...
4
votes
2answers
336 views
How does a zip file detect a correct password?
When extracting files from an encrypted zip archive, the user is asked to give a password in order to read the original file.
How does an encrypted ZIP detect when the user has given the correct ...
1
vote
2answers
139 views
How to crack a password given its hash and its possibilities
I am trying to crack a number of passwords that have been hashed using SHA-256.
I have the hashes available and I also have the possibilities in which the password can be. Some of these possibilities ...
1
vote
2answers
170 views
How bad is using date to generate a “random” password?
I came across a post about generating random passwords.
Apparently the preferred way is
date | md5sum
I am aware that using the date for this is bad, but how bad is it?
How does it fare when ...
0
votes
1answer
78 views
Choose a sentence, a number, and the name as password [duplicate]
I would like to have your point of view about something I found on internet.
The goal here is to help people to use stronger passwords, it's not perfect, but I believe that asking people to use ...
1
vote
1answer
179 views
Define Patterns in Crunch
I am trying to achieve a very specific pattern with crunch. The Wireless Router I use has a very specific Pattern used for the default Password generated by my Provider. I want to create a wordlist or ...
3
votes
2answers
147 views
Is using a phrase from a book as a password such a bad idea
I've been told/seen online that choosing a sentence or a phrase from a book and using it as a password is a bad idea. How is this true? Unless the potential attacker knew which book you used I don't ...
3
votes
2answers
220 views
How to choose between password derivation or encryption?
Suppose you use a password manager having all possible features of modern password managers: encryption with a key derived from your master password, auto-filling, cloud or local storage, browser ...
1
vote
1answer
250 views
Can a password cracker reverse engineer my generation method?
Lets say I generated a password with really awful entropy seed (5 bits~), but then used another selection process (with a low entropy seed as well) to select at random a method to generate a password (...
0
votes
3answers
125 views
Would it be more secure to enforce “at least one upper case” or to enforce “at least one letter (any case)”
I am devising a set of password requirements. I am requiring users to use the following:
Minimum 8 characters
Minimum 1 number
Minimum 1 special character
Minimum 1 letter (any case)
I would like ...
1
vote
0answers
39 views
Increase password iterations?
Is it possible to strengthen the macOS login password by increasing the number of sha-512 iterations?
