Questions tagged [password-cracking]
for questions relating to the cracking of passwords and the practices to mitigate against passwords being cracked.
731
questions
0
votes
2answers
54 views
Construct a strong, (almost) unique password? [duplicate]
After reading Why use random characters in passwords? it seems to me that one can solve the problem of how to remember a zillion passwords while each one remains secure by constructing each password ...
-1
votes
0answers
25 views
Brute force Blowfish Advanced CS password
In my perhaps somewhat excessive need for security, I have saved a password so securely that I can no longer access it myself.
My files have been encrypted with Blowfish Advanced CS. Fortunately, this ...
1
vote
1answer
55 views
In hashcat, is there a simple way to set the amount of symbols in the password?
For example, I know a password has to have at least 3 symbols, but I don't know where those symbols are. What is the simplest way to specify this when cracking the password with hashcat? The only ...
0
votes
1answer
67 views
Cracking hashes of trivially modified passwords
If I started with “password”, then change it to “password2”, “password3” etc, is that easier to crack the hashes of the set of passwords than if I used only the original password?
Does having the ...
0
votes
1answer
117 views
pwdump8-8.2 correct hash for Microsoft Account Win10
I am having a real issue cracking one NT hash i've pulled from my system for a Microsoft Account.
I used - PwDump8.2
I have an admin account unlocked on the system and can access most files.
I know ...
0
votes
1answer
84 views
Creating Wordlist from specific characters and numbers using Mentalist or similar program
I have locked myself out of my Win 10 Microsoft account by forgetting my password and need to get back into it. I have extracted the hash for the account.
I've been researching wordlists and hash ...
0
votes
1answer
77 views
crackmapexec continue after finding first match
I am currently trying to solve the RazorBlack room on tryhackme. After enumerating the machine, I created a list of valid usernames and was also able to crack the password of one of the users. Now I ...
0
votes
0answers
85 views
Windows 10 user autologin password lost
A while ago I have set up the autologin for my Windows 10 user.
I do not know the password anymore.
I can login to the system (as has autologin now). But I cannot change the password.
Is it possible ...
1
vote
1answer
165 views
THC Hydra sends GET request without parameter before actual request with parameter which causes authentication problems
I am using THC Hydra (v9.0) on GNU/Linux to pentest my private API.
The GET route in question requires a key as GET parameter which returns an auth token if the correct key was submitted else "...
0
votes
1answer
1k views
John the ripper not able to crack the password
I generated two hashes from this site:
Plaintext 1 (p1): world
Salt 1 (s1): hello
Hash 1 (h1): 936a185caaa266bb9cbe981e9e05cb78cd732b0b3280eb944412bb6f8f8f07af
Plaintext 2 (p2): world2
Salt 2 (s2)...
2
votes
3answers
275 views
To lighten server load, is hashing a client-side Argon2-hashed password with SHA-256 on the server-side at least as safe as server-side only Argon2?
I am trying to achieve better security in my authentication system implementation with both server-side hashing and client-side hashing. (See the first reference below for more prerequisite knowledge.)...
1
vote
3answers
178 views
Does hashing syslog (or similar) make for good passwords?
I thought of an approach to password generation that I haven't heard of anyone else using. It almost seems too good to be true so I wonder what the downsides are. I'm well aware that you shouldn't &...
0
votes
0answers
343 views
Speed up cracking a wpa2.hccapx file in hashcat
I'm trying to do a brute force with Hashcat on windows with a GPU cracking a wpa2.hccapx handshake. Based on my research I know the password is 10 characters, a mix of random lowercase + numbers only
...
1
vote
1answer
114 views
Backup + AES-128 encrypted file in Cloud sync
I've some data that I want to backup to the cloud. I also have a file containing personal data, that I need to sync across multiple devices.
At the moment, for this file, locally in my computer, I've ...
1
vote
1answer
246 views
Cracking Lost Password for encrypted 7z file with most characters known
I forgot password to 7z archive encrypted with AES 256. I am fairly certain of most characters however. I know password length is either 8 or 12 characters and if it is 12 I know the last 4 characters....
0
votes
1answer
79 views
If a platform/system has brute force protection should I care for a very strong password
If a platform has brute force protection should I worry about creating a very strong password since any attacker would not get a chance to reach enough attempts to crack even the weakest password?
Not ...
2
votes
2answers
2k views
Does john the ripper not support yescrypt?
I'm learning about password attacks using john and am trying to use it for bruteforcing my shaddow file. I created a user called newuser with password stuff and then used
sudo unshadow /etc/passwd /...
-1
votes
1answer
144 views
What are the security implications of the password policy for this bank? [duplicate]
I am aware of a bank (redacted for obvious reasons) that has the following password policy.
Only English alphanumeric characters
Min of 8, max of 14 characters
No special characters (ex. !@#$%^&* ...
0
votes
1answer
409 views
I have been hacked on Facebook multiple times today alone. What do I do?
My Facebook account has had its password changed four times today, and I'm wondering what to do.
The first time, was at 5:02pm. I received an email saying that my password had been changed. I recently ...
1
vote
1answer
172 views
What's the point of connecting to another machine with SSH to crack a password?
If anyone has heard of Ippsec and watched his videos, you'll see that when he extracts a password hash from a machine, he doesn't crack it in his own computer, rather, he uses SSH to connect to his ...
1
vote
1answer
3k views
John the Ripper is unable to crack my SHA1 hashed password
John the Ripper is unable to crack my SHA1 hashed password:
john --wordlist=rockyou.txt testing.txt
Whenever I do this in Kali Linux, I get this response:
Loaded 1 password hash (Raw-SHA1 [SHA1 256/...
0
votes
2answers
588 views
Does John the Ripper automatically account for salt and hash?
I have an embedded device running Armbian which I was able to get the drive image from. The entry in /etc/shadow combined with /etc/passwd after unshadowing is this:
root:$6$TV6ML2bG$TncnN/adtU9xaQs/...
0
votes
2answers
321 views
How does having a password hash speed up cracking vs not having a hash (on-site)?
On Windows, user password hashes are not salted and, on Linux, user password hashes are stored in the same root-owned file as the salt. Given this, in what ways might a bruteforce attack to find the ...
1
vote
1answer
176 views
Opening password file with John The Ripper
I have an old Windows domain SMB sniffer file circa 1998 and just out of interest I want to see if I can crack it now with John The Ripper. I believe the file was generated using the L0phtCrack SMB ...
1
vote
1answer
120 views
PAKE - What to do when a weakness is found?
In the case of a password hashing function like Argon2, I know that when a weakness is found, you use another password hashing function, wrap it around the existing hashes and calculate the hash of ...
17
votes
1answer
7k views
John the ripper password cracked or not?
I have the shadow file from an embedded device running linux. Trying to use John to crack it. There is only the 'root' hash in the shadow file.
12 seconds in, John finds the password for 'root', but ...
0
votes
0answers
100 views
How much entropy is needed for encrypting data locally?
I understand that, when storing data on the cloud or something else that might get leaked to the public, the security margin should be at least 128 bit, 256 bit should be used for data that should ...
22
votes
4answers
8k views
Does password length / complexity make any difference if hashes are leaked?
Password length/complexity only mitigates a brute force attack, correct? In the event of a hash leak, since any algorithm is a fixed length, there could potentially be a pre-image* with a very short / ...
1
vote
0answers
193 views
Using John the Ripper for Blockchain.info second password
Is there a way to use JtR for Blockchain.info's (v2) secondary password?
I already tried the blockchain2john.py file, and it does not ask for primary password (which I know already) so it is going to ...
0
votes
2answers
221 views
Is it possible to reverse a hashed password? [duplicate]
Is it possible to reverse a password hashed with bcrypt?
0
votes
1answer
423 views
Hydra hangs after TASKS number of tries
I have dvwa set up and i am using the command:
hydra -IV -t 1 -l admin -P rockyou.txt localhost http-get-form "/vulnerabilities/brute/index.php:username=^USER^&password=^PASS^&Login=Login:...
0
votes
0answers
108 views
Cain and Abel Dictionary Attack - How many words?
How many dictionary words in each attempt (e.g. "word1 word2") will Cain and Abel attempt to use before giving up?
I've done some testing and my results seem spotty. For example I've seen it ...
1
vote
0answers
213 views
JTR finishing very quickly with rockyou.txt and not cracking the hash
I've been fumbling through the world of Information Security by going through the HTB challenges, and I've come across an issue I just can't seem to find an answer for. During one of the challenges I'...
0
votes
1answer
67 views
WEP keystream extraction
After having captured multiple packets with repeated IVs you can perform cipher1 XOR cipher2 which is the same as having cleartext1 XOR cleartext2, and performing cipher1 XOR cleartext1 gives you the ...
0
votes
0answers
332 views
Crack Windows 10 password with Cain and Able
A few months ago I reset my Windows password but my keyboard must have had a sticky key or two, effectively changing my password to an unknown password. Out of desperation and a little research I used ...
0
votes
2answers
165 views
Avoiding password cracking by using custom hashing procedure?
In summary: the idea behind password cracking is just to replicate the password validation procedure of a web server locally with lots and lots of attempts and check whether the output of that ...
2
votes
0answers
546 views
Hashcat first wordlist then brute force if nothing found
I'm trying to run my hashcat as automated and efficient as possible.
I have a file with NTLM hashes:
607C4CDCDA0EFBF023C4DEA52DF90641
D25ECD13FDDBB542D2E16DA4F9E0333D
AAD063F78DA1183CBD8BD7812FADF9C6
...
1
vote
1answer
2k views
How best to crack password for MacOS encrypted .dmg, given I know the majority of the password content? [closed]
Encrypted .dmg on MacOS High Sierra, tested password before sending for repair. Upon return from repair, password does not work. The possibilities I see are the .dmg file is corrupted, or I'm wrong ...
1
vote
0answers
79 views
How much time will Fugaku supercomputer take to generate a wordlist? [closed]
How much time will the Fugaku supercomputer take to generate a wordlist?
Length: 50
Combination: Alphabet(upper/lower) + numbers (0~9)
also, would wordlist generators make a significant time/...
1
vote
0answers
445 views
Dynamic format used in John the Ripper jumbo way slower than MDXFind
I'm currently doing some research on a pretty huge list of hashes (approx. 2 millions) and thus I'd like to improve my cracking speed. The hash format is 12 rounds of SHA512(password + salt), which ...
1
vote
0answers
193 views
Hardware for password cracking
I'm planning to extend my pentest services to Password Cracking, to be more precise: Cracking Active Directory Passwords, extracted from the customers Active Directory in order to check users ...
1
vote
1answer
93 views
Does knowing part of a passphrase for sure really mean that you can "disregard" that entire part when trying to crack it?
Alice bought 1 Bitcoin and encrypted her wallet.dat in Bitcoin Core.
Samantha, Alice's friend, notices the Bitcoin price skyrocketing and, while Alice is in the bathroom, steals Alice's wallet.dat as ...
2
votes
1answer
152 views
Password generation
I'm trying to generate all possible variation of a password.
The base word is like "PleaseSub!" and I need all possible version of it with uppercase, lowercase, etc.. I know there is ...
1
vote
1answer
258 views
zip password cracking with permutation
I have a zip file (.zip created by 7zip v15.10) that I remember the password to (~12 characters long), but it seems I've typed the password wrong while zipping it and now it doesn't open.
What are the ...
6
votes
2answers
2k views
How are website passwords cracked? [closed]
What approaches are there for cracking user passwords for website/e-mail accounts? can only think of three strategies, but what else?
Algorithmically: Combinatorially attempting different sequences ...
1
vote
1answer
330 views
Can you bruteforce a SSH password without alerting the server owner?
What happened?
This is a live event that a friend of mine is working on, a company's systems were breached by a Threat Actor (TA), when the Cyber Sec company was called in and tried to regain access ...
2
votes
1answer
112 views
How can the passphrase matter besides the very most obvious patterns? [duplicate]
Let's say that my passphrase is:
aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaapassword9
Yes, it looks ridiculous. But only because we already know it. An attacker, trying to brute-force their way into this ...
0
votes
0answers
38 views
TikTok's Password Character Limit [duplicate]
I've been making websites now for a while and when I've created websites or apps I've always put a minimum password size but usually a relatively large password size that isn't ever an issue for my ...
0
votes
1answer
311 views
Is using SHA256 to create 256bit secret key from bcrypt good ok?
I am trying to Use AES to store passwords for a password manager. For authentication I am already using bcrypt. As AES uses 256 bit Key can I use SHA256 to generate 256 bit key from hashed value of ...
0
votes
1answer
126 views
Knowing when a hacked password is correct
I was recently a victim of the any van data breach and so I started read up on password encryption and security - it is pretty amazing stuff. One thing that confuses me though is, since GPUs can now ...
