Questions tagged [password-cracking]
for questions relating to the cracking of passwords and the practices to mitigate against passwords being cracked.
678
questions
0
votes
1answer
67 views
Smaller password lists [closed]
I hack wifi passwords with kali linux on airmon-ng and I make always password lists with crunch but the lists are always too long (I'm talking about <100 PT) and I want to know if is there a ...
1
vote
1answer
40 views
What is the minimum secure length for gpg -c file.txt?
I want to use gpg -c with a user-generated password that I can easily remember. Are 16 characters enough? for example would a password similar to "I own 32 houses." be bruteforcable?
-1
votes
0answers
79 views
Is it REALLY possible to crack WPA2 handshakes?
I used Kali Linux, and this guide.
Every guide out there shows this process as something "simple", but they are always using dictionaries and brute force... isn't this a bit of a nonsense?
I'...
0
votes
0answers
31 views
Are there intrinsically weaknesses in accessing a same payload encrypted with different keys?
Assume we use AES256 to encrypt the same payload 100 times, each with a different key.
An attacker gains access to the 100 encrypted payloads, and nothing else.
Is there some way the attacker can gain ...
0
votes
1answer
88 views
How does john the ripper crack hashes using wordlists?
How does John The Ripper work when trying to crack passphrase of a private ssh key? As in what steps are involved when it tries to do so? What's the role of ssh2john in the whole process?
0
votes
2answers
66 views
Is there a utility you would use to create wordlists from directories and files? [closed]
I have a home directory and a gpg file I am attempting to brute force. Is there a utility that you know that will recursively create wordlist from directives and file contents?
1
vote
0answers
23 views
Making custom wordlists for languages besides English
I'm testing a site whose audience doesn't usually have English as their main language. When it comes to non-English, I consider there to be 3 groups
The target language's alphabet is a subset of the ...
2
votes
4answers
258 views
Are files encrypted with 7ZIP vulnerable to password crackers?
A client says they can't accept password-protected PDFs to put in their payroll system, so I have to send them without security. I don't want to send unsecured PDFs via e-mail because e-mail is ...
0
votes
0answers
41 views
Javascript PDF Brute Forcing
I am trying to learn PDF Brute forcing with javascript.
I've read about encryption algorithm of PDF 1.4 documentation here https://www.adobe.com/content/dam/acom/en/devnet/pdf/pdf_reference_archive/...
0
votes
0answers
32 views
If there is a fixed number of each character type, how do you calculate the number of permutations of passwords? [migrated]
If your password generation says you must have 4 lowercase characters, 4 uppercase characters and 8 numbers arranged in any order, how do you calculate the number of possible combinations?
I ask this ...
7
votes
4answers
4k views
Storing Username and salt in separate table
You have a User table:
UserID (auto-incrementing Integer)
Password hash
LastLogin
All related tables are linked by the UserID.
You also have a Username table:
Username
Salt
IncorrectLoginCount
...
1
vote
1answer
270 views
What is the plaintext password of 'hash part 1' in the shadow file?
on immersivelabs lab Password Hashes II
https://dca.immersivelabs.online/labs/password-hashes-ii/
there is a question:
What is the plaintext password of 'hash part 1' in the shadow file?
shadow.txt ...
0
votes
1answer
106 views
Brute-Forcing a Chrome Login Data file
Say I have a "Login Data" Chrome file that is encrypted with the user's Windows password. Is there a way I can brute-force the file and try to decrypt it using every password possible?
0
votes
1answer
39 views
routersploit bruteforce cred attcack using http
while i'm trying to do a brutforce attack on my router using routersploit.
Im getting the error
rsf (HTTP Basic/Digest Bruteforce) > run
[*] Running module creds/generic/...
1
vote
2answers
116 views
Cracking a truncated hash of type sha256(salt+pw+salt) [duplicate]
I'm trying to crack a password, whose hash was formed by first concatenating a known salt, the password and and another known salt, then applying sha256 and then truncating that to 32 characters. So:
...
1
vote
1answer
46 views
Does the random presence of a common password sequence within a larger password weaken the password?
I have a somewhat basic understanding of how entropy relates to password strength - generating a password with a truly random selection from some set (whether that's characters, or a set of dictionary ...
0
votes
1answer
61 views
Doesn't Hashing Negate Quantum Computer Cracking?
I've read/watched a lot about Quantum Computers, trying to really get into the physics of it. Seems like the topic is poorly explained. I do understand that it takes a lot of qbits to beat modern ...
0
votes
2answers
50 views
How do I make a word list for cracking password? [duplicate]
I already know the password format: 1 Upper Case Letters + 5 digits + bf (bf is the known letters, they must included in the password and at the end)
For example: A12345bf, C12301bf, D10282bf.
I want ...
1
vote
1answer
319 views
Unable to get John the Ripper to crack PDF password
I am new to Kali Linux and JTR but am playing around trying to crack a PDF file. I set the PDF Password to test so it's a known password on my own file. For whatever reason JTR appears to finish ...
1
vote
2answers
173 views
What's the difference between these MD5 hashes?
What's the difference between this format:
Hash found: admin:$1$$oLN1UCc1Y3T30QkMcKMSx0
and the following:
5f4dcc3b5aa765d61d8327deb882cf99
And also,
How to turn the first hash format into the ...
1
vote
2answers
98 views
Security of master password in a derived password manager
I am aware of other questions asking similar things as this one, but I believe this design addresses many of the issues raised in those questions. I'm also not concerned with making sure there's no ...
2
votes
0answers
184 views
Recovered a 7z password with hashcat, but it's not the right one
I am trying to recover a 7z file, but have forgotten the password. It's completely AES-256 encrypted (i.e. not even the filenames are available).
Steps:
Generated hash file with 7z2hashcat.pl
Ran a ...
1
vote
1answer
157 views
How to apply custom filters for John The Ripper when cracking RAR3 archive password?
My problem is that I'm trying to crack RAR file with is encrypted with RAR3 encryption.
Decided to try with John The Ripper.
Here are clues I have from my friend.
Max password length is 8
Only ...
0
votes
0answers
420 views
Decrypting a password-protected 7z file with Delta filter fails
I have made a 7z archive using Delta filter containing a wav file and I have protected it with a password. I am running a terminal in Kali Linux. My problem is that I cannot get the password cracked ...
0
votes
1answer
95 views
Which would be the best “keyfile” for KeepassXC and/or Veracrypt?
I am a Mac user. I opened a keyfile generated by Veracrypt and one generated by KeepassXC. The texts in both of them were quite short. Which keyfile is best (i.e., most random and harder to break ...
14
votes
13answers
9k views
Couldn't we create a string that produces the same hash as another string in SHA-256?
Let's say we have a separate hashing algorithm called s2 and it would convert Hello into dug84nd8.
If we could take the algorithm and just reverse engineer it to generate a string like 8GN492MD that ...
0
votes
1answer
169 views
Is it safe to generate the longest password possible?
Context
In another question about password generation, I have read an answer suggesting something along the line of:
Let your password manager select characters from all the accepted categories (...
0
votes
1answer
364 views
John The Ripper and PBKDF2-HMAC-SHA1
I am trying to hash a list of passwords with PBKDF2-HMAC-SHA1 and then crack them using John. However, John does not recognise the hashes and I get a No Hashes Found error. It works with SHA256, but I ...
0
votes
0answers
156 views
John The Ripper 'No password hashes loaded'(see FAQ)
I am trying to learn John. I've been through the FAQ and this tutorial, but am stuck.
I have made a RAR4 password hash. It's super simple. The password is 'test'. I now want to use a tool to crack it.
...
3
votes
4answers
261 views
Is password strength exclusively a function of character set size multiplied by password length-in-characters?
My team is responsible for the creation and management of many passwords (hundreds), which we do almost exclusively programmatically (all generation is random-enough). We leverage a variety of of ...
4
votes
1answer
82 views
Why isn't it more popular to increase the p (parallelization) parameter of scrypt?
First of all, the understanding I have of the p parameter in scrypt is that it multiplies the amount of work to do, but in such a way that the additional workloads are independent from each other, and ...
0
votes
1answer
319 views
John The Ripper - find password when you know a part of it
I left my old job a few years back and wanted to check a few of my old pdf payslips but for the life of me I can't remember the password.
I've tried using John The Ripper in incremental mode because I ...
3
votes
2answers
104 views
Is this method of 32 char hash generation secure enough for online-based attacks?
A fellow developer and I have been having a discussion about how vulnerable a few different methods of developing a hash are, and I've come here to see if smarter people than I (us?) can shed some ...
2
votes
2answers
81 views
Are there any known attacks (technical or social) against enterprises where password resets are scheduled on fixed (known) intervals?
A company I know of has a password policy that requires employees to change passwords (on AD server) every 90 days. The vast majority of its new hires start on the 1st of the month. Thus, several ...
0
votes
1answer
51 views
How do maintainers calculate x number of accounts compromised by hack? [closed]
I am always curious by reports in the news of big network sites getting hacked and the report confidently stating a statistic such as "only 10,000 users were affected" or "Microsoft confirms 40,000 ...
1
vote
1answer
107 views
Breaking Wifi password knowing its length of 8 [A-Z] alpha (upper-case) characters using Hashcat
I got the WPA handshake, now it's turn to crack the password using Hashcat. First, I wanted to make a wordlist of passwords [A-Z] the length of 8, but Crunch (the tool in Kali Linux) said it will take ...
4
votes
2answers
107 views
Is this (explained in body) a possible attack vector when using haveibeenpwned API?
I'm currently working on understanding and contemplating to implement password strength validation for sign ups in my app, to include checking haveibeenpwned if entered password is compromised ...
0
votes
1answer
62 views
Very beginner question about JtR
I Have lost my zip file password and I tried to recover it with Windows 10, using John the Ripper 1.9.0 Jumbo.
Things I know from this password:
9 to 11 characters
Alphabetics A B E F and a b e f (...
0
votes
0answers
54 views
Recent research on custom hardware to break RSA-1024
In 2003, Adi Shamir and Eran Tromer proposed an ASIC device called TWIRL, which should be able to sieve RSA-1024 using the General Number Field Sieve during a year, "only" using 10-20M$ of investment ...
0
votes
0answers
120 views
Recovery of files from a zip containing a directory (unencrypted) and 3 files (encrypred - ZipCrypto Deflate), possibe use of bkcrack?
I have a zip file, Example.zip consisting of a directory Example and three files *.dat. I can see the names of all 3 files. The dat files are encrypted (ZipCrypto Deflate). I'm interested to know if I ...
2
votes
1answer
182 views
Crack windows excel password
I have many password protected microsoft excel worksheet and I need to be able to edit it. I have forgotten the password, and I know that I can edit the file and take out the password check, but I ...
2
votes
1answer
131 views
Why do PDFs contain password hashes?
Reading this question about extracting PDF password hashes to feed into john the ripper has me wondering why password hashes are in a PDF in the first place? Shouldn't it be using the supplied ...
0
votes
0answers
708 views
PMKID found , but it should be WPA handshake
i was trying to get access in wifi network but i came to something that i need to ask afteraireplay-ng –0 20 –a [router bssid] –c [client bssid] wlan0mon i expect
WPA handshake
in right top ...
0
votes
1answer
111 views
What vulnerabilities would this type of “password manager” have?
When I was searching for a password manager to use I stumbled upon the concept of Master Password which instead of encrypting and saving your passwords, generates them by using your master password ...
-1
votes
2answers
230 views
How secure is a 24 character mysql password?
I recently set up my WordPress blog and I changed the password of its mysql database to a 24 character randomly generated password. I have a few questions about the database:
Is my database name ...
0
votes
3answers
634 views
If my password is not on rockyou.txt does it mean that is a good password?
I have been wondering if all my online and wifi passwords are complex enough.
So to test this I was checking if the password was already present on the rockyou.txt wordlist.
If the password is not ...
0
votes
2answers
87 views
Is chain hashing algorithms the ultimate solution for hashing passwords?
Let's say I my password is a simple password, 123456
Then if the database was exposed, if the password was:
-- stored in plain text -> cracked
-- stored it hashed with no salt -> prone to rainbow ...
2
votes
2answers
150 views
Can you help me with some misconceptions about bcrypt and salting?
I researched password hashing and cracking and I have some misconceptions:
First rule of thumb to create a strong password is to use 10+ combination of digits/upper/lower/symbols to prevent brute ...
0
votes
1answer
194 views
JtR Password hash not recognized
I am attempting to encrypt some passwords by hand to use in a project with JtR. Unfortunately, the program is having difficulty recognizing the hash types of the passwords after hashing them.
...
2
votes
2answers
145 views
What wrong with this system to proactively check if customers' passwords have been found in a breach?
Let's say that during account creation, I already prohibit passwords known to be reused from breaches of other sites, like if it's in the Have I Been Pwned list. But breaches happen all the time, so ...
