Questions tagged [password-cracking]
for questions relating to the cracking of passwords and the practices to mitigate against passwords being cracked.
655
questions
0
votes
0answers
51 views
Cracking known salt MD5 Hashes online [closed]
I've been having trouble with this certain salted MD5 hash, even though I know the salt, and I've been having trouble finding anywhere online that will crack salted MD5 hashes. All I'm finding is just ...
0
votes
0answers
11 views
I need to read the contents of a crd file as plain text [migrated]
I lost all my passwords due to a dumb mistake I did yesterday. These passwords are really important. My computer has them saved under windows credentials. However, I can't view passwords stored under ...
0
votes
1answer
72 views
Can an iPhone be accessed via a compromised router?
Can someone have access to my iPhone if my router is compromised?
Such as:
having access to my Gmail app on iPhone
access to my Gmail/other passwords
be able to send or delete mails via iPhone?
Can ...
0
votes
1answer
123 views
Is it safe to generate the longest password possible?
Context
In another question about password generation, I have read an answer suggesting something along the line of:
Let your password manager select characters from all the accepted categories (...
0
votes
1answer
84 views
John The Ripper and PBKDF2-HMAC-SHA1
I am trying to hash a list of passwords with PBKDF2-HMAC-SHA1 and then crack them using John. However, John does not recognise the hashes and I get a No Hashes Found error. It works with SHA256, but I ...
0
votes
0answers
53 views
John The Ripper 'No password hashes loaded'(see FAQ)
I am trying to learn John. I've been through the FAQ and this tutorial, but am stuck.
I have made a RAR4 password hash. It's super simple. The password is 'test'. I now want to use a tool to crack it.
...
3
votes
4answers
250 views
Is password strength exclusively a function of character set size multiplied by password length-in-characters?
My team is responsible for the creation and management of many passwords (hundreds), which we do almost exclusively programmatically (all generation is random-enough). We leverage a variety of of ...
4
votes
1answer
77 views
Why isn't it more popular to increase the p (parallelization) parameter of scrypt?
First of all, the understanding I have of the p parameter in scrypt is that it multiplies the amount of work to do, but in such a way that the additional workloads are independent from each other, and ...
0
votes
1answer
110 views
John The Ripper - find password when you know a part of it
I left my old job a few years back and wanted to check a few of my old pdf payslips but for the life of me I can't remember the password.
I've tried using John The Ripper in incremental mode because I ...
3
votes
2answers
98 views
Is this method of 32 char hash generation secure enough for online-based attacks?
A fellow developer and I have been having a discussion about how vulnerable a few different methods of developing a hash are, and I've come here to see if smarter people than I (us?) can shed some ...
2
votes
2answers
77 views
Are there any known attacks (technical or social) against enterprises where password resets are scheduled on fixed (known) intervals?
A company I know of has a password policy that requires employees to change passwords (on AD server) every 90 days. The vast majority of its new hires start on the 1st of the month. Thus, several ...
0
votes
1answer
48 views
How do maintainers calculate x number of accounts compromised by hack? [closed]
I am always curious by reports in the news of big network sites getting hacked and the report confidently stating a statistic such as "only 10,000 users were affected" or "Microsoft confirms 40,000 ...
1
vote
1answer
88 views
Breaking Wifi password knowing its length of 8 [A-Z] alpha (upper-case) characters using Hashcat
I got the WPA handshake, now it's turn to crack the password using Hashcat. First, I wanted to make a wordlist of passwords [A-Z] the length of 8, but Crunch (the tool in Kali Linux) said it will take ...
4
votes
2answers
102 views
Is this (explained in body) a possible attack vector when using haveibeenpwned API?
I'm currently working on understanding and contemplating to implement password strength validation for sign ups in my app, to include checking haveibeenpwned if entered password is compromised ...
0
votes
1answer
56 views
Very beginner question about JtR
I Have lost my zip file password and I tried to recover it with Windows 10, using John the Ripper 1.9.0 Jumbo.
Things I know from this password:
9 to 11 characters
Alphabetics A B E F and a b e f (...
0
votes
0answers
54 views
Recent research on custom hardware to break RSA-1024
In 2003, Adi Shamir and Eran Tromer proposed an ASIC device called TWIRL, which should be able to sieve RSA-1024 using the General Number Field Sieve during a year, "only" using 10-20M$ of investment ...
0
votes
0answers
56 views
Recovery of files from a zip containing a directory (unencrypted) and 3 files (encrypred - ZipCrypto Deflate), possibe use of bkcrack?
I have a zip file, Example.zip consisting of a directory Example and three files *.dat. I can see the names of all 3 files. The dat files are encrypted (ZipCrypto Deflate). I'm interested to know if I ...
2
votes
1answer
97 views
Crack windows excel password
I have many password protected microsoft excel worksheet and I need to be able to edit it. I have forgotten the password, and I know that I can edit the file and take out the password check, but I ...
2
votes
1answer
112 views
Why do PDFs contain password hashes?
Reading this question about extracting PDF password hashes to feed into john the ripper has me wondering why password hashes are in a PDF in the first place? Shouldn't it be using the supplied ...
0
votes
0answers
265 views
PMKID found , but it should be WPA handshake
i was trying to get access in wifi network but i came to something that i need to ask afteraireplay-ng ā0 20 āa [router bssid] āc [client bssid] wlan0mon i expect
WPA handshake
in right top ...
0
votes
1answer
76 views
What vulnerabilities would this type of “password manager” have?
When I was searching for a password manager to use I stumbled upon the concept of Master Password which instead of encrypting and saving your passwords, generates them by using your master password ...
-1
votes
2answers
189 views
How secure is a 24 character mysql password?
I recently set up my WordPress blog and I changed the password of its mysql database to a 24 character randomly generated password. I have a few questions about the database:
Is my database name ...
0
votes
3answers
345 views
If my password is not on rockyou.txt does it mean that is a good password?
I have been wondering if all my online and wifi passwords are complex enough.
So to test this I was checking if the password was already present on the rockyou.txt wordlist.
If the password is not ...
0
votes
2answers
77 views
Is chain hashing algorithms the ultimate solution for hashing passwords?
Let's say I my password is a simple password, 123456
Then if the database was exposed, if the password was:
-- stored in plain text -> cracked
-- stored it hashed with no salt -> prone to rainbow ...
2
votes
2answers
115 views
Can you help me with some misconceptions about bcrypt and salting?
I researched password hashing and cracking and I have some misconceptions:
First rule of thumb to create a strong password is to use 10+ combination of digits/upper/lower/symbols to prevent brute ...
0
votes
1answer
101 views
JtR Password hash not recognized
I am attempting to encrypt some passwords by hand to use in a project with JtR. Unfortunately, the program is having difficulty recognizing the hash types of the passwords after hashing them.
...
2
votes
2answers
140 views
What wrong with this system to proactively check if customers' passwords have been found in a breach?
Let's say that during account creation, I already prohibit passwords known to be reused from breaches of other sites, like if it's in the Have I Been Pwned list. But breaches happen all the time, so ...
3
votes
3answers
425 views
Have gotten a blackmail email with a password of mine - what to do? [duplicate]
I've gotten the following email today (the password has been changed; and the Greek characters are reproduced verbatim):
Your ĻasswĪærd is REPLACED. Ī kĪ·ow Ī± lot more Ļhngs about you ĻhaĪ· ĻhĪ±t.
...
2
votes
1answer
86 views
Why does pwdump7 retrieve LM hashes even though they're disabled?
I'm currently undergoing a penetration testing certification, where I'm asked to :
Set up a fully-patched Windows 10 Pro VM (done)
Retrieve local password hashes from the SAM database using pwdump7
...
0
votes
2answers
117 views
How to properly calculate password entropy
I am very confused with calculating password entropy i know that the formula is E = log2(RL).
where E is password entropy, R is the range of available characters, and L is the password length.
but ...
0
votes
1answer
192 views
How to approach Web App? [closed]
I'm doing testing on the app, if we take only login url as a starting point.
How to expand my horizons?
I want to make my surface wider, really kinda stuck on this one.
3
votes
1answer
98 views
What advantages does it have if a password manager locks the DB automatically on locking the computer? Disadvantages of turning it off?
When I unlock my PC the password manager (any type) needs the password again to unlock it's DB containing passwords. I was wondering what the benefit is in that, as my computer is locked anyway.
...
0
votes
0answers
96 views
John the ripper - ecryptfs - sample not cracked: 0 password hashes cracked
I tried to use john the ripper on the sample :
ecryptfs_sample_metadata.tar (password is 'openwall')
Which I downloaded from here:
https://openwall.info/wiki/john/sample-non-hashes
If i try
sudo ...
-1
votes
1answer
206 views
wifi cracking using a network adapter which doesn't support packet injection
I'm trying to crack my wifi (WPA-CCMP) password to test its strength and security, I'm using the commview for wifi and aircrack-ng software on windows 10. I've three laptops, Windows 10 (64bit) with ...
2
votes
1answer
288 views
Security of PIN that spells out words?
Description
PayPal suggests that generating a PIN by spelling words (on a numeric pad, e.g., [ABC] = 2) is a good method for security and memorability, e.g., B-L-U-E-C-O-W = 2583269.
My knowledge ...
0
votes
0answers
25 views
Passphrase Cracking Dictionary [duplicate]
I have been discussing this tweet https://twitter.com/marcan42/status/1238125727855206400 and the conversation around it with some folks on an encryption module I am doing as part of a cyber security ...
34
votes
5answers
6k views
Does it matter if a brute force search for a password returns a collision and not the password?
Assume the following very basic hashing algorithm.
h(k) = k mod 17
Let's say we create a password 12345 for a website that uses this very basic hashing algorithm. That would yield the hash of 3.
...
1
vote
1answer
79 views
PDF User Password always give access to the Owner Password, even when encrypted with AES-128
I've been messing around with qpdf, and noticed something that seems huge: that a document's Owner Password is essentially useless, as it can be easily unset, and therefore that only the User Password ...
0
votes
1answer
58 views
How to determine the type [duplicate]
Today I discover a encryption method
Which
0 = 35
1 = 34
2 = 37
3 = 36
4 = 31
5 = 30
6 = 33
7 = 32
8 = 3d
9 = 3c
It's the encode of number 1 to 0 for the method
Can you please help me to ...
1
vote
2answers
150 views
How can wireless password cracking be detected?
Our team was hired for a red team engagement for a client. A part of the engagement is attempting to crack the WiFi passwords of their office APs. However, we obviously want to stay undetected. What ...
0
votes
1answer
109 views
Cracking less than 4 letter linux password using john
I am trying to crack a less than 4 character Linux password using john. I unshadowed my password into file.txt I use the following command:
john -incremental file.txt
the output is:
0g 0:00:00:04 ...
0
votes
0answers
135 views
Generate every alphanumerical combination in crunch within 8-20 characters in length
I want to generate combinations in sequential range of the length 8-20 with the following characters:
abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ1234567890!@#$%^&*()~`";.,/[]-=
How ...
0
votes
0answers
57 views
Issue using John The Ripper
First things first, I'm a newbie so, bear with me...
I created a word list with a combination of a possible password for a certain user using Crunch (it's the dictionary output) and need to use John ...
0
votes
0answers
86 views
How to crack rar file with protected pass with only the AES-256 key?
I have rar with protected pass.But I have the AES-256 key can I crack it and if I can. how?
0
votes
1answer
992 views
How to recover lost zip file password?
I have a folder with very important files on my computer and I zipped it with a password for security reasons. Unfortunately, I'm not able to recover the password. Usually, I always use the same kind ...
0
votes
0answers
94 views
Mimikatz Windows 10 password recovery
I'm trying to log into my Windows 10 laptop that was using a Microsoft login. I used to mimikatz to retrieve the SAMkey, LSA secret, dpapi, System masterkeys, and the password hash but it's the ...
0
votes
0answers
1k views
Unable to start hashcat in mode 13600 WinZip : Separator Unmatched
I have a zip file containing a JPEG image of size 3.5 MB, encrypted with AES-256. I used WinZip for the creation of the zip file. In order to create the hash of the zip file, I used John The Ripper's ...
2
votes
0answers
393 views
How to “unprotect” malicious workbook without knowing password
Right now I'm looking at an office document (most likely rtf based on it exploiting equation editor) that opens just fine when you double click it, but on further examination in a hex editor and in ...
0
votes
4answers
464 views
Password hashing that is resistant to ASIC-assisted cracking without risking DoS of server
Previously, authentication systems stored passwords in cleartext. This made it trivial for an attacker to log in to an account if he had access to a leaked password file.
Later, passwords were hashed ...
0
votes
0answers
53 views
Storing safely files in the cloud - what is the current state of the art encrpytion method for it?
What is considered as safe method to store files in the cloud currently and in the future (quantums) so that no potential hacker could open the file? Which current encryption methods to use for it to ...
