Questions tagged [password-cracking]
for questions relating to the cracking of passwords and the practices to mitigate against passwords being cracked.
0
votes
1answer
64 views
Estimating Password Cracking Speed Based on GPU?
I was wondering if there was a calculator or formula I could use to find a rough estimation of the time it takes to crack hashes based on GPU. I am trying to assess how much performance I would lose/...
44
votes
1answer
9k views
I found a password with hashcat, but it doesn't work
My assignment required me to find the password for a PowerPoint file (97 - 2003, v. 8.0 - v. 11.0).
I used office2john.py to retrieve the hash, and I removed the file name.
The hash is:
$...
0
votes
0answers
60 views
RAR password (knowing some parts from pass) [on hold]
I need your advice in my case:
I have a RAR file protected with this password is: ( THE****AHMAD** )
The first word from the password is: THE
The second word is contains 4 characters and its maybe ...
0
votes
0answers
47 views
Where are NTLM and LM hashes stored in a password protected microsoft presentation file
I have a password protected presentation file (MS office 2003).
My assignment required me to either remove the password or find it.
In my research i found out that presentation use ntlm and/or nt ...
26
votes
4answers
5k views
Does putting salt first make it easier for attacker to bruteforce the hash?
Many recommendations for storing passwords recommend hash(salt + password) rather than hash(password + salt).
Doesn't putting the salt first make it much faster for the attacker to bruteforce the ...
26
votes
3answers
6k views
How bad would a partial hash leak be, realistically?
Even though the current recommendation for storing passwords is the usage of a slow key derivation function such as Argon2, scrypt, PBKDF2 or bcrypt1, many websites still use the traditional hash(...
0
votes
1answer
43 views
How to make John the Ripper output example hashes for a given hash type?
Is it possible to make John the Ripper output example hashes for a given hash type given by the --format= option?
This is possible using Hashcat, but currently I look in John the Ripper's source code ...
9
votes
1answer
3k views
What local resources are used when bruteforcing a remote service?
What pc resources are used when bruteforcing ?
I mean bruteforcing something online, not hashes.
Do you need a good amount a RAM and a good CPU or it's just about the internet speed ?
3
votes
1answer
167 views
Crack 8-char password with known number of set bits
At University, I got some CTFs to do for my security lectures.
Basically, I need to crack an 8-character password (96 possible characters). I know that 42 of the 64 bits are set to 1 and I know the ...
0
votes
1answer
74 views
Limiting the number of duplicate character types in crunch
I'm trying to generate a password list of 10 character passwords containing only a combination of 3 - 6 numbers and 3 - 6 uppercase letters.
I see option -d which allows a set limit of duplicates of ...
0
votes
1answer
110 views
Generating passwords with rule: the contents within a 10 characters string must maintain a certain ratio of numbers and letters in no particular order
I'm playing around with Kali and am looking to crack my WPA2 default password.
I started generating 10 character passwords with a charset of solely digits and upper alpha lastnight and after 10 mins, ...
1
vote
1answer
72 views
Is there any methods available other than brute force and dictionary attacks?
I am curious to know about the wifi attacks. And I have known a little bit about brute force attack and dictionary attack. Is there any other methods available other than these two...?
1
vote
1answer
102 views
Using BITMAIN AntMiner L3+ for cracking password [closed]
I want to use a BITMAIN AntMiner L3+ miner to crack passwords. How can I do that?
Can I install hashcat agent to L3+ ?
0
votes
0answers
61 views
Cracking Zip File Password Encryption [duplicate]
Hey all I am currently taking a computer security course and while doing some research in cryptography I found that it was possible to crack the encryption of a password protected file in an encrypted ...
1
vote
1answer
83 views
Will SIM‐like PIN on website as second password increase security
On SIM cards, which are used in mobile telephony, PIN (and PUK) is used. Unlike a password, they are locked after some incorrect attempts to prevent brute force attack. If wrong PIN is entered 3 times,...
0
votes
0answers
17 views
Security risks in confirming the username instead of confirming the username and password combination [duplicate]
Most of the login pages like Google, Outlook and Yahoo! confirm the username first and then ask for a password instead of confirming the username and password combination altogether. Isn't it less ...
2
votes
2answers
196 views
Is haveibeenpwned (HIBP) free and reliable? [closed]
I have just started to explore HIBP to check whether we can use HIBP in our public facing interfaces.
AS per my read I have 3 options to check out.
Download the password dictionary and implement my ...
5
votes
1answer
142 views
Do ciphers and encoding schemes make passwords more secure?
I recently came across a tech professional advising a user to take some plaintext of their choice, run it through one of these ciphers, convert it to Base64, and then use the result as their master ...
0
votes
0answers
40 views
Specify Amount of type of character Crunch
I'm sure these questions pop up a lot, but I can't find one that does what I'm looking for.
So, I'm trying to use crunch to generate a wordlist with specific amounts of each type of character, i.e. 2 ...
0
votes
0answers
78 views
Convincing client to drop password validation rules
My client wants to include some rules to validate the passwords his clients can choose when creating a new account. Since his company handles sensitive client data, I think I want to convince him to ...
0
votes
1answer
131 views
Benchmark Password Cracking Tools
I want to perform a benchmark for the most popular offline password cracking tools (john the ripper and hashcat)?
What metrics or approach should i take about benchmarking in order to determine what ...
19
votes
2answers
2k views
Store Credit Card Information in Password Manager?
For convenience purposes I manage my passwords with the password manager Bitwarden on my personal computer and smartphone with autofill function (but with asking for the master password or fingerprint ...
0
votes
0answers
36 views
John the Ripper: OpenMP mode vs using the “--fork=N” option?
Clang on OSX doesn't support OpenMP by default, so I could not compile JtR with OpenMP support without another Clang installation.
However, after looking at the below option, I wonder what the ...
0
votes
1answer
100 views
Can't detect hash type even if I have the password?
I can't found the hash type used in a database hosted in a VM.
My hash is c39e02416d974229752c28d7fcefe6e1, and my password is "azerty123456". I noticed that the user table has a column called ...
-1
votes
1answer
486 views
hashcat - cracking a salted sha256
Given a SHA512 hash, a salt, and username I am trying to crack the hash using hashcat. Every example I've found used a hashfile as input, is there way to provide salt and hash via commandline without ...
3
votes
1answer
163 views
Could a cracked password run as a command on the attacker's system?
I recently was made aware of 6 passwords that I use becoming compromised in data leaks, and they are now exposed in plain text.
I don't know how attackers go about cracking passwords or how they ...
3
votes
2answers
190 views
Is password dependent iteration count a good practice?
I consider the possibility of improving password security by increasing the hashing iteration count for short passwords.
The security benefits I see of this practice are:
Short passwords are better ...
0
votes
1answer
2k views
Crack password protected zip file with pkcrack
I have allfiles.zip contains only file allfiles.exe and is password protected. I heard about pkcrack, it is possible to get the file from a zip file which is encrypted if we have some part of ...
-1
votes
1answer
85 views
Best tool for cracking SHA-1s with unique pre and post salts? [closed]
I can't find a tool that supports cracking SHA-1s with different pre and post salts. Any suggestions?
0
votes
1answer
103 views
Question about birthday attack on password
Based on birthday attack, you need to generate at least 2^n/2 of possible combination to have 50% chance of finding a password. I have a list of 3000 random password make from 16 characters of upper, ...
1
vote
1answer
130 views
AES, RSA, ECC Key size [closed]
It is generally said that 2048-bit RSA keys are roughly equivalent to 112-bit symmetric keys and 2048-bit RSA keys are "sufficient for commercial use until around the year 2030" (https://security....
-3
votes
1answer
63 views
Finding encryption type of hash [closed]
Is it possible to find encryption type of a hash with a salt?
I have my other password in same encryption type, with the hash from that and the password, if that helps.
$2y$10$...
1
vote
1answer
73 views
Multicore hacker tools?
Have a school project coming up in multicore programming. I'm interested in/have used hacking tools alot before, and was wondering if there were any good tools out there that could benefit from being ...
1
vote
1answer
143 views
Do I understand SHA-1 brute-forcing speeds correctly? (Firefox Password Manager)
I read that the Firefox Password Manager has a "bug" (or rather poor design) in that it uses only a single sha-1 hash iteration for the password (which makes it extremely easy to brute-force ...
3
votes
1answer
295 views
KeePass Key File - Does it provide any meaningful security?
KeePass has the option for a master password and key file (and windows login). But I am not sure how it really helps security that much.
I can see a couple of scenario's:
The database and key are on ...
0
votes
1answer
63 views
How to create combinations of a password [duplicate]
I don't remember my password, I can't remember exactly the variation.
How can I brute force all the permutations of a word knowing the following conditions:
Idea of the word (in my mind).
Lower and/...
0
votes
1answer
188 views
BitLocker Recovery Key and Microsoft Account Password
I have a Windows 10 Pro machine; the administrator (and only) account is a Microsoft account. I am trying to set up BitLocker to ensure maximum security and safety, even from Microsoft.
I understand ...
0
votes
0answers
98 views
How to define rules for Jack the Ripper
I'm verry new to jack the ripper and I'm wondering how to use special rules for cracking a txt file. The password of my txt file is 123 and with the single crack mode it takes a lot of time to crack ...
0
votes
1answer
284 views
Recommended length of password [duplicate]
Why are we recommended to have at least 8 characters, and not 6 or 7 etc.? and the different set of character?. I only know that the longer the password is, the harder it is for brute force attack to ...
1
vote
1answer
104 views
Hashcat Mask Help
I'm wondering on how to run hashcat against wpa2 passwords that are in the following format:
common dictionary word . three digits . common dictionary word
Password Example:
falcon.824.watchman
Is ...
0
votes
0answers
109 views
Can a smartphone's PIN or password be brute-forced in an offline attack?
I know of exhaustive offline dictionary and brute-force attacks against any given online account, but can the same method be applied against phones, either Android/iPhones? Or would any such attack be ...
0
votes
0answers
439 views
John the ripper 0 password hashes cracked, 38 left
I'm stuck and new to this and would greatly appreciate any assistance!
Kali linux latest build trying to use Jack the Ripper
I have the hashes in a file called userhash.txt
So I try this: (just ...
0
votes
1answer
420 views
hashcat specify number of characters
I am trying to figure out a macOS hash 10.8+ and I happen to know that it uses A-Z, a-z, 0-9, is 6-8 characters, and almost certainly random. Currently, it spits out an error regarding hash length ...
1
vote
3answers
219 views
What should a secure passphrase look like?
We all know that passwords should not only be randomly generated, but also look random. The reason is that attackers can use patterns or existing words to be able to bruteforce the passwords faster, ...
3
votes
3answers
215 views
How ethical is it to publish an (anonymous) password list from real sources
I'm currently doing security research on the dangers of using default or well known 'secrets' for applications.
To test how big of an issue this actually is, I decided to download local copies of ...
0
votes
0answers
56 views
Breaking a tough password using john
I'm trying to crack a pretty advanced password on my computer and I've had it running for about a day on john's default settings.
Its gotten through roughly (a day times 23000kp/s) passwords.
I have ...
2
votes
2answers
115 views
Can a rogue client bypass the Wi-Fi Access Point?
Let's assume that one client contains malware, and that it belongs to a Wi-Fi network protected with WPA2/Personal (hence, via a password known to the piece of malware), where some other vulnerable ...
1
vote
1answer
2k views
Using hashcat in order to crack the JWT signature in WebGoat
I've recently started to practice my penetration testing skills and I got started with WebGoat.
I got to the "Authentication Bypass" chapter, to the JWT Token cracking. WebGoat presents this JWT ...
2
votes
0answers
474 views
Where is the Administrator password for McAfee Endpoint Security stored on the local machine?
Where is the Administrator password for McAfee Endpoint Security stored on the local machine?
I've tried to locate the Administrator password for McAfee Endpoint Security in the registry on the local ...
3
votes
1answer
77 views
How much less secure is a password with a repetitive pattern of characters?
I want to make sure my password is very difficult to bruteforce but also easy to remember and convenient.
So my idea is to just use a short password and repeat it a few times like this:
...
