Questions tagged [password-cracking]

for questions relating to the cracking of passwords and the practices to mitigate against passwords being cracked.

Filter by
Sorted by
Tagged with
0
votes
0answers
25 views

Hydra showing successful log in but the credentials do not work [closed]

hydra -t 4 -V -L login.txt -P pass.txt rdp://ip Hydra is reporting a successful RDP login, but when I try to login to RDP using the credentials, they do not work. Why? [3389][rdp] host: 50.63.165.222 ...
0
votes
1answer
51 views

Cracking hashes of trivially modified passwords

If I started with “password”, then change it to “password2”, “password3” etc, is that easier to crack the hashes of the set of passwords than if I used only the original password? Does having the ...
0
votes
1answer
60 views

pwdump8-8.2 correct hash for Microsoft Account Win10

I am having a real issue cracking one NT hash i've pulled from my system for a Microsoft Account. I used - PwDump8.2 I have an admin account unlocked on the system and can access most files. I know ...
0
votes
1answer
64 views

Creating Wordlist from specific characters and numbers using Mentalist or similar program

I have locked myself out of my Win 10 Microsoft account by forgetting my password and need to get back into it. I have extracted the hash for the account. I've been researching wordlists and hash ...
0
votes
0answers
35 views

crackmapexec continue after finding first match

I am currently trying to solve the RazorBlack room on tryhackme. After enumerating the machine, I created a list of valid usernames and was also able to crack the password of one of the users. Now I ...
0
votes
0answers
62 views

Windows 10 user autologin password lost

A while ago I have set up the autologin for my Windows 10 user. I do not know the password anymore. I can login to the system (as has autologin now). But I cannot change the password. Is it possible ...
1
vote
1answer
107 views

THC Hydra sends GET request without parameter before actual request with parameter which causes authentication problems

I am using THC Hydra (v9.0) on GNU/Linux to pentest my private API. The GET route in question requires a key as GET parameter which returns an auth token if the correct key was submitted else "...
0
votes
1answer
954 views

John the ripper not able to crack the password

I generated two hashes from this site: Plaintext 1 (p1): world Salt 1 (s1): hello Hash 1 (h1): 936a185caaa266bb9cbe981e9e05cb78cd732b0b3280eb944412bb6f8f8f07af Plaintext 2 (p2): world2 Salt 2 (s2)...
1
vote
3answers
221 views

To lighten server load, is hashing a client-side Argon2-hashed password with SHA-256 on the server-side at least as safe as server-side only Argon2?

I am trying to achieve better security in my authentication system implementation with both server-side hashing and client-side hashing. (See the first reference below for more prerequisite knowledge.)...
1
vote
3answers
160 views

Does hashing syslog (or similar) make for good passwords?

I thought of an approach to password generation that I haven't heard of anyone else using. It almost seems too good to be true so I wonder what the downsides are. I'm well aware that you shouldn't &...
0
votes
0answers
263 views

Speed up cracking a wpa2.hccapx file in hashcat

I'm trying to do a brute force with Hashcat on windows with a GPU cracking a wpa2.hccapx handshake. Based on my research I know the password is 10 characters, a mix of random lowercase + numbers only ...
1
vote
1answer
92 views

Backup + AES-128 encrypted file in Cloud sync

I've some data that I want to backup to the cloud. I also have a file containing personal data, that I need to sync across multiple devices. At the moment, for this file, locally in my computer, I've ...
1
vote
1answer
137 views

Cracking Lost Password for encrypted 7z file with most characters known

I forgot password to 7z archive encrypted with AES 256. I am fairly certain of most characters however. I know password length is either 8 or 12 characters and if it is 12 I know the last 4 characters....
0
votes
1answer
61 views

If a platform/system has brute force protection should I care for a very strong password

If a platform has brute force protection should I worry about creating a very strong password since any attacker would not get a chance to reach enough attempts to crack even the weakest password? Not ...
0
votes
2answers
1k views

Does john the ripper not support yescrypt?

I'm learning about password attacks using john and am trying to use it for bruteforcing my shaddow file. I created a user called newuser with password stuff and then used sudo unshadow /etc/passwd /...
-1
votes
1answer
126 views

What are the security implications of the password policy for this bank? [duplicate]

I am aware of a bank (redacted for obvious reasons) that has the following password policy. Only English alphanumeric characters Min of 8, max of 14 characters No special characters (ex. !@#$%^&* ...
0
votes
1answer
359 views

I have been hacked on Facebook multiple times today alone. What do I do?

My Facebook account has had its password changed four times today, and I'm wondering what to do. The first time, was at 5:02pm. I received an email saying that my password had been changed. I recently ...
1
vote
1answer
138 views

What's the point of connecting to another machine with SSH to crack a password?

If anyone has heard of Ippsec and watched his videos, you'll see that when he extracts a password hash from a machine, he doesn't crack it in his own computer, rather, he uses SSH to connect to his ...
1
vote
1answer
2k views

John the Ripper is unable to crack my SHA1 hashed password

John the Ripper is unable to crack my SHA1 hashed password: john --wordlist=rockyou.txt testing.txt Whenever I do this in Kali Linux, I get this response: Loaded 1 password hash (Raw-SHA1 [SHA1 256/...
0
votes
2answers
447 views

Does John the Ripper automatically account for salt and hash?

I have an embedded device running Armbian which I was able to get the drive image from. The entry in /etc/shadow combined with /etc/passwd after unshadowing is this: root:$6$TV6ML2bG$TncnN/adtU9xaQs/...
0
votes
2answers
280 views

How does having a password hash speed up cracking vs not having a hash (on-site)?

On Windows, user password hashes are not salted and, on Linux, user password hashes are stored in the same root-owned file as the salt. Given this, in what ways might a bruteforce attack to find the ...
1
vote
1answer
141 views

Opening password file with John The Ripper

I have an old Windows domain SMB sniffer file circa 1998 and just out of interest I want to see if I can crack it now with John The Ripper. I believe the file was generated using the L0phtCrack SMB ...
1
vote
1answer
104 views

PAKE - What to do when a weakness is found?

In the case of a password hashing function like Argon2, I know that when a weakness is found, you use another password hashing function, wrap it around the existing hashes and calculate the hash of ...
17
votes
1answer
7k views

John the ripper password cracked or not?

I have the shadow file from an embedded device running linux. Trying to use John to crack it. There is only the 'root' hash in the shadow file. 12 seconds in, John finds the password for 'root', but ...
0
votes
0answers
86 views

How much entropy is needed for encrypting data locally?

I understand that, when storing data on the cloud or something else that might get leaked to the public, the security margin should be at least 128 bit, 256 bit should be used for data that should ...
22
votes
4answers
8k views

Does password length / complexity make any difference if hashes are leaked?

Password length/complexity only mitigates a brute force attack, correct? In the event of a hash leak, since any algorithm is a fixed length, there could potentially be a pre-image* with a very short / ...
1
vote
0answers
163 views

Using John the Ripper for Blockchain.info second password

Is there a way to use JtR for Blockchain.info's (v2) secondary password? I already tried the blockchain2john.py file, and it does not ask for primary password (which I know already) so it is going to ...
0
votes
2answers
184 views

Is it possible to reverse a hashed password? [duplicate]

Is it possible to reverse a password hashed with bcrypt?
0
votes
1answer
334 views

Hydra hangs after TASKS number of tries

I have dvwa set up and i am using the command: hydra -IV -t 1 -l admin -P rockyou.txt localhost http-get-form "/vulnerabilities/brute/index.php:username=^USER^&password=^PASS^&Login=Login:...
0
votes
0answers
87 views

Cain and Abel Dictionary Attack - How many words?

How many dictionary words in each attempt (e.g. "word1 word2") will Cain and Abel attempt to use before giving up? I've done some testing and my results seem spotty. For example I've seen it ...
1
vote
0answers
180 views

JTR finishing very quickly with rockyou.txt and not cracking the hash

I've been fumbling through the world of Information Security by going through the HTB challenges, and I've come across an issue I just can't seem to find an answer for. During one of the challenges I'...
0
votes
1answer
50 views

WEP keystream extraction

After having captured multiple packets with repeated IVs you can perform cipher1 XOR cipher2 which is the same as having cleartext1 XOR cleartext2, and performing cipher1 XOR cleartext1 gives you the ...
0
votes
0answers
268 views

Crack Windows 10 password with Cain and Able

A few months ago I reset my Windows password but my keyboard must have had a sticky key or two, effectively changing my password to an unknown password. Out of desperation and a little research I used ...
0
votes
2answers
148 views

Avoiding password cracking by using custom hashing procedure?

In summary: the idea behind password cracking is just to replicate the password validation procedure of a web server locally with lots and lots of attempts and check whether the output of that ...
2
votes
0answers
451 views

Hashcat first wordlist then brute force if nothing found

I'm trying to run my hashcat as automated and efficient as possible. I have a file with NTLM hashes: 607C4CDCDA0EFBF023C4DEA52DF90641 D25ECD13FDDBB542D2E16DA4F9E0333D AAD063F78DA1183CBD8BD7812FADF9C6 ...
1
vote
1answer
2k views

How best to crack password for MacOS encrypted .dmg, given I know the majority of the password content? [closed]

Encrypted .dmg on MacOS High Sierra, tested password before sending for repair. Upon return from repair, password does not work. The possibilities I see are the .dmg file is corrupted, or I'm wrong ...
1
vote
0answers
65 views

How much time will Fugaku supercomputer take to generate a wordlist? [closed]

How much time will the Fugaku supercomputer take to generate a wordlist? Length: 50 Combination: Alphabet(upper/lower) + numbers (0~9) also, would wordlist generators make a significant time/...
1
vote
0answers
384 views

Dynamic format used in John the Ripper jumbo way slower than MDXFind

I'm currently doing some research on a pretty huge list of hashes (approx. 2 millions) and thus I'd like to improve my cracking speed. The hash format is 12 rounds of SHA512(password + salt), which ...
1
vote
0answers
164 views

Hardware for password cracking

I'm planning to extend my pentest services to Password Cracking, to be more precise: Cracking Active Directory Passwords, extracted from the customers Active Directory in order to check users ...
1
vote
1answer
77 views

Does knowing part of a passphrase for sure really mean that you can "disregard" that entire part when trying to crack it?

Alice bought 1 Bitcoin and encrypted her wallet.dat in Bitcoin Core. Samantha, Alice's friend, notices the Bitcoin price skyrocketing and, while Alice is in the bathroom, steals Alice's wallet.dat as ...
2
votes
1answer
133 views

Password generation

I'm trying to generate all possible variation of a password. The base word is like "PleaseSub!" and I need all possible version of it with uppercase, lowercase, etc.. I know there is ...
1
vote
1answer
226 views

zip password cracking with permutation

I have a zip file (.zip created by 7zip v15.10) that I remember the password to (~12 characters long), but it seems I've typed the password wrong while zipping it and now it doesn't open. What are the ...
6
votes
2answers
2k views

How are website passwords cracked? [closed]

What approaches are there for cracking user passwords for website/e-mail accounts? can only think of three strategies, but what else? Algorithmically: Combinatorially attempting different sequences ...
1
vote
1answer
271 views

Can you bruteforce a SSH password without alerting the server owner?

What happened? This is a live event that a friend of mine is working on, a company's systems were breached by a Threat Actor (TA), when the Cyber Sec company was called in and tried to regain access ...
2
votes
1answer
95 views

How can the passphrase matter besides the very most obvious patterns? [duplicate]

Let's say that my passphrase is: aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaapassword9 Yes, it looks ridiculous. But only because we already know it. An attacker, trying to brute-force their way into this ...
0
votes
0answers
33 views

TikTok's Password Character Limit [duplicate]

I've been making websites now for a while and when I've created websites or apps I've always put a minimum password size but usually a relatively large password size that isn't ever an issue for my ...
0
votes
1answer
279 views

Is using SHA256 to create 256bit secret key from bcrypt good ok?

I am trying to Use AES to store passwords for a password manager. For authentication I am already using bcrypt. As AES uses 256 bit Key can I use SHA256 to generate 256 bit key from hashed value of ...
0
votes
1answer
109 views

Knowing when a hacked password is correct

I was recently a victim of the any van data breach and so I started read up on password encryption and security - it is pretty amazing stuff. One thing that confuses me though is, since GPUs can now ...
6
votes
1answer
1k views

For bcrypt why is JTR so much faster than hashcat?

To keep it short I've recently been learning about hashing and password hash cracking on TryHackMe. I was tasked to crack the following hash: $2y$10$0veO/JSFh4389Lluc4Xya.dfy2MF.bZhz0jVMw.V....
0
votes
0answers
87 views

Isn't this kind of password ultimately secure and insanely easy to remember? [duplicate]

Pick any dictionary word. Think of a number over 10 and below 20. Repeat the word as many times as the number, and end off with the same number (for example, "12"). Example: ...

1
2 3 4 5
15