Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [password-cracking]

for questions relating to the cracking of passwords and the practices to mitigate against passwords being cracked.

3
votes
3answers
178 views

How ethical is it to publish an (anonymous) password list from real sources

I'm currently doing security research on the dangers of using default or well known 'secrets' for applications. To test how big of an issue this actually is, I decided to download local copies of ...
0
votes
0answers
46 views

Breaking a tough password using john

I'm trying to crack a pretty advanced password on my computer and I've had it running for about a day on john's default settings. Its gotten through roughly (a day times 23000kp/s) passwords. I have ...
0
votes
0answers
17 views

How to generate passwords from a wordlist with settings to how many maximum and minimum times a word occurs in a password in crunch [closed]

Sorry for bad grammar I wanted to ask If you have a wordlist and you want to generate passwords by combining 7-8 words, i want to set limits to how many time a word can occur in a password, For ...
2
votes
2answers
87 views

Can a rogue client bypass the Wi-Fi Access Point?

Let's assume that one client contains malware, and that it belongs to a Wi-Fi network protected with WPA2/Personal (hence, via a password known to the piece of malware), where some other vulnerable ...
1
vote
1answer
121 views

Using hashcat in order to crack the JWT signature in WebGoat

I've recently started to practice my penetration testing skills and I got started with WebGoat. I got to the "Authentication Bypass" chapter, to the JWT Token cracking. WebGoat presents this JWT ...
1
vote
0answers
34 views

Where is the Administrator password for McAfee Endpoint Security stored on the local machine?

Where is the Administrator password for McAfee Endpoint Security stored on the local machine? I've tried to locate the Administrator password for McAfee Endpoint Security in the registry on the local ...
3
votes
1answer
71 views

How much less secure is a password with a repetitive pattern of characters?

I want to make sure my password is very difficult to bruteforce but also easy to remember and convenient. So my idea is to just use a short password and repeat it a few times like this: ...
4
votes
0answers
60 views

Kerberos Attacks Questions

It's amazing how many "Attacks on Kerberos" articles exist out there and almost none really explains the small details. My guess is that usually they assume it's basic knowledge and sometimes, they ...
1
vote
1answer
98 views

How to crack a list of hashed passwords given their possibilities

I am trying to crack a number of passwords that have been hashed using SHA-256 using some java code. I have the hashes available and I also have the possibilities in which the password can be. Some ...
3
votes
1answer
196 views

How secure is a 100-bit password in 2018 and onwards?

Long story short, I share a server with a few other people and store my backups there. All these backups are archived to a .7z file using AES-256 encryption, using a randomly-generated password of ...
4
votes
2answers
294 views

How does a zip file detect a correct password?

When extracting files from an encrypted zip archive, the user is asked to give a password in order to read the original file. How does an encrypted ZIP detect when the user has given the correct ...
1
vote
2answers
108 views

How to crack a password given its hash and its possibilities

I am trying to crack a number of passwords that have been hashed using SHA-256. I have the hashes available and I also have the possibilities in which the password can be. Some of these possibilities ...
-4
votes
2answers
134 views

How secure is my hashing algorithm? [duplicate]

This is probably the common question on stack exchange but I need to know is this really safe as it seems to be? //Password hashing stage 1 $a_password = sha1($a_password); $a_password = md5($...
1
vote
2answers
164 views

How bad is using date to generate a “random” password?

I came across a post about generating random passwords. Apparently the preferred way is date | md5sum I am aware that using the date for this is bad, but how bad is it? How does it fare when ...
0
votes
1answer
60 views

Choose a sentence, a number, and the name as password [duplicate]

I would like to have your point of view about something I found on internet. The goal here is to help people to use stronger passwords, it's not perfect, but I believe that asking people to use ...
1
vote
1answer
53 views

Define Patterns in Crunch

I am trying to achieve a very specific pattern with crunch. The Wireless Router I use has a very specific Pattern used for the default Password generated by my Provider. I want to create a wordlist or ...
3
votes
2answers
141 views

Is using a phrase from a book as a password such a bad idea

I've been told/seen online that choosing a sentence or a phrase from a book and using it as a password is a bad idea. How is this true? Unless the potential attacker knew which book you used I don't ...
3
votes
2answers
208 views

How to choose between password derivation or encryption?

Suppose you use a password manager having all possible features of modern password managers: encryption with a key derived from your master password, auto-filling, cloud or local storage, browser ...
1
vote
1answer
240 views

Can a password cracker reverse engineer my generation method?

Lets say I generated a password with really awful entropy seed (5 bits~), but then used another selection process (with a low entropy seed as well) to select at random a method to generate a password (...
0
votes
3answers
118 views

Would it be more secure to enforce “at least one upper case” or to enforce “at least one letter (any case)”

I am devising a set of password requirements. I am requiring users to use the following: Minimum 8 characters Minimum 1 number Minimum 1 special character Minimum 1 letter (any case) I would like ...
1
vote
0answers
38 views

Increase password iterations?

Is it possible to strengthen the macOS login password by increasing the number of sha-512 iterations?
1
vote
1answer
56 views

How do Field Programmable Gate Arrays (FPGAs) compare to Graphics Processing Units (GPUs); for cracking hashes?

As a general rule, GPUs are more effective than CPUs when it comes to performing acutely repetitive tasks, like iterating over lists and generating permutations of a set (i.e. exhausting dictionaries &...
1
vote
0answers
66 views

How to create a keygen [closed]

I have a list with approx 500 serial numbers (each one with 10 digits) and all the 500 passcodes generated for those serials (also with 10 digits, but alphanumeric). Is possible to discover the ...
1
vote
1answer
111 views

Hashcat: How to discard words of length less than N after rules have been applied?

Hashcat: How to discard words of length less than N after rules have been applied? I know of the rules <N and >N that discards the word if its length is less than and greater than N, ...
0
votes
1answer
112 views

Both Ophcrack and ONTP&RE incorrectly show Windows 10 passwords as blank

I'm trying to crack a Windows 10 laptop that I myself set a password on a day or so ago. So far I've tried booting into Ophcrack 3.6 and ONTP&RE (Offline NT Password & Registry Editor) from ...
1
vote
1answer
79 views

Do hacks of mainstream web applications tend to happen more from random attackers brute forcing or from targeted heuristic attacks?

I'm writing up advice for selecting a master password for a password manager, and I'm wondering if there is available data about the likelihood of different attacks that result in a cracked password. ...
0
votes
1answer
442 views

Brute-Forcing DVWA login page with hydra

I'm learning how to brute force web login pages with a popular brute force tool called "Hydra". I'm using Kali Linux (VirtualBox) to do this. I've installed DVWA (Damn Vulnerable Web Application) and ...
1
vote
1answer
109 views

If someone has a hashed password, how long till they decrypt it?

Earlier my friend suggested that we have a race to see who could decrypt a hashed password first. I want to do it but I don't want it to be an all month thing. I know when passwords are hashed they ...
1
vote
0answers
44 views

How to brute force ARJ passwords? [closed]

I came across some password protected ARJ files. Can anyone name a password cracker for those archives? Ideally running on linux or OSX.
-2
votes
2answers
250 views

What are most dangerous vulnerabilities of users of password management? [closed]

Are there any examples where something goes wrong. For example, say people misused password managers and got hacked or take some loss? If so how? Basically, I sort of know the typical vulnerabilities ...
1
vote
1answer
156 views

Are partial passwords a security improvement over full passwords?

With full password authentication, you need to enter the full password every time. With partial password authentication, you're asked for some subset of the password each time, and which characters ...
27
votes
4answers
11k views

Cracking double encrypted router password?

I noticed in the html of my router this parameter: form.addParameter('Password', base64encode(SHA256(Password.value))); So when I type in the password passw I get this via sslstrip: 2018-09-25 21:...
1
vote
2answers
249 views

John the Riper couldn't crack all the passwoords

I have a password file with 7 passwords, but JTR only could crack 4 and 3 that couldn't. What it's the reason? C:\tmp\john179j5\run>john --show shadow.txt root:password:12923:0:99999:7::: student1:...
2
votes
1answer
67 views

Is there any defense against this kind of attacks? (key comparison attack, or something)

is there any defense against this kind of attack? https://youtu.be/7U-RbOKanYs?t=974 I know someone who uses a password encryption hashing that generates the same length of keys as in this video and ...
1
vote
3answers
504 views

Hashcat doesn’t write to output file [closed]

I am using hashcat to crack a list of md5 hashes and have used the following command hashcat -m 0 -a 0 -o out.txt --force hashdump.txt ../rockyou.txt which gives the output Session..........: ...
0
votes
3answers
134 views

Assuming my password is strong enough, how else can I protect my account? [closed]

I'm a very insecure person, so I made my gmail account's password so long, that I started to question whether or not it's possible for someone to hack it with any given method (It's a passphrase with ...
1
vote
1answer
81 views

Best practices to protect public/private SSH key pair in web interface?

I've got a dilemma here: I'm working on a system that will connect to remote linux servers for monitoring and automating some processes. Since user+pass is insecure for obvious reasons and public/...
1
vote
0answers
159 views

crunch password generation with multiple character sets

I'm trying to use crunch to generate a password list. However, if I add all necessary characters into one character set, as in: file: charset_huge.lst complex = [...
1
vote
1answer
130 views

How to increase the time for an offline password attack

I am trying to answer a CASP exam practice question. Could someone comment on the options below regarding the logic behind each item? Where is the logical error behind each statement? A Storage-...
0
votes
2answers
697 views

Is it possible to crack Joomla hash password?

I'm a developer and suddenly I fall in a stupid situation like I need to crack a hash Joomla password which is (5aa154999c111bf7f33a1a3cadba5847) and I don't know the salt. is there any way to crack ...
0
votes
2answers
116 views

Generating multi-word passphrases from a wordlist

As part of pentesting NT hashes where the underlying passwords are minimum 16 characters of length, I have created a wordlist of common words, sports teams, movies, names, years etc. - inspired by the ...
39
votes
14answers
12k views

How can I make a strong password that's easy to remember? Is the 4 Word method safe? [duplicate]

I have heard of the method of using 4 random dictionary words, it gives you lots of characters and is easy to remember. But that seems to be open to dictionary attacks, especially if the attacker has ...
1
vote
1answer
247 views

hashcat specific brute force

Is this scenario possible: I know the first three letters of the password (exact), i know the password is between 10-14 characters, i know the rest of the characters are "b,t,p,1,3,6,7" which can be ...
0
votes
2answers
2k views

Most efficient way to crack a NTLM hash

I've been given a non-salted NTLM hash and a week worth of time to find the password it hides. I have also been told the password length is 11 chars, and that it is a Windows 10 user password. I'm ...
1
vote
1answer
861 views

Best tool to BruteForcing RDP

I have tried many tools and to do not seem to be successful with locking out an account I am testing on my network with an RDP domain. I used crowbar, ncrack and THC hydra but they don't seem to be ...
-1
votes
1answer
87 views

Where can i find a pre-computed 8 caracter uppercase password file/dictionary

To create an all permutations dictionary of an 8 character uppercase only password, I get I can use crunch to make this wordlist and file would roughly be 1.8 - 2Tb in size. Is there anywhere I can ...
0
votes
1answer
681 views

THC Hydra on Windows RDP Domain

I am testing a bruteforce on a windows rdp server within a domain. It seems to not be working because nothing is locking out the account I am targeting. How do you specify a domain username? I tried ...
2
votes
1answer
499 views

Crack Putty Private Key (PPK)

I found a private key which seems to be in the putty private key format. The key has the following header: ---- BEGIN SSH2 ENCRYPTED PRIVATE KEY ---- Subject: <sensitive> Comment: <...
8
votes
1answer
892 views

Mitigating the new attack on WPA2 involving PMKID

A new attack was discovered which allows cracking a WPA2 passphrase without needing to capture the 4-way handshake. While this doesn't weaken the password itself, it does mean that an attacker can ...
1
vote
2answers
362 views

Finding and attacking an IMAP Server

For a security challenge I am supposed to dictionary attack an IMAP service. A rather simple exercise using hydra. So far I failed, since I've given hydra the actual website instead of the mail ...