Questions tagged [password-cracking]
for questions relating to the cracking of passwords and the practices to mitigate against passwords being cracked.
622
questions
0
votes
0answers
43 views
user password authentication and cracking password - multiple rounds of hashing [closed]
when multiple rounds of hashing are performed, why is it that john the ripper cannot crack hashed passwords? (multiple rounds of hashes basically).
On the other hand, the system can, however, ...
1
vote
2answers
101 views
How can wireless password cracking be detected?
Our team was hired for a red team engagement for a client. A part of the engagement is attempting to crack the WiFi passwords of their office APs. However, we obviously want to stay undetected. What ...
0
votes
1answer
104 views
Cracking less than 4 letter linux password using john
I am trying to crack a less than 4 character Linux password using john. I unshadowed my password into file.txt I use the following command:
john -incremental file.txt
the output is:
0g 0:00:00:04 ...
0
votes
0answers
43 views
Generate every alphanumerical combination in crunch within 8-20 characters in length
I want to generate combinations in sequential range of the length 8-20 with the following characters:
abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ1234567890!@#$%^&*()~`";.,/[]-=
How ...
0
votes
0answers
42 views
Issue using John The Ripper
First things first, I'm a newbie so, bear with me...
I created a word list with a combination of a possible password for a certain user using Crunch (it's the dictionary output) and need to use John ...
0
votes
0answers
44 views
How to crack rar file with protected pass with only the AES-256 key?
I have rar with protected pass.But I have the AES-256 key can I crack it and if I can. how?
0
votes
1answer
53 views
How to recover lost zip file password?
I have a folder with very important files on my computer and I zipped it with a password for security reasons. Unfortunately, I'm not able to recover the password. Usually, I always use the same kind ...
0
votes
0answers
60 views
Mimikatz Windows 10 password recovery
I'm trying to log into my Windows 10 laptop that was using a Microsoft login. I used to mimikatz to retrieve the SAMkey, LSA secret, dpapi, System masterkeys, and the password hash but it's the ...
0
votes
0answers
95 views
Unable to start hashcat in mode 13600 WinZip : Separator Unmatched
I have a zip file containing a JPEG image of size 3.5 MB, encrypted with AES-256. I used WinZip for the creation of the zip file. In order to create the hash of the zip file, I used John The Ripper's ...
2
votes
0answers
142 views
How to “unprotect” malicious workbook without knowing password
Right now I'm looking at an office document (most likely rtf based on it exploiting equation editor) that opens just fine when you double click it, but on further examination in a hex editor and in ...
0
votes
4answers
425 views
Password hashing that is resistant to ASIC-assisted cracking without risking DoS of server
Previously, authentication systems stored passwords in cleartext. This made it trivial for an attacker to log in to an account if he had access to a leaked password file.
Later, passwords were hashed ...
0
votes
0answers
52 views
Storing safely files in the cloud - what is the current state of the art encrpytion method for it?
What is considered as safe method to store files in the cloud currently and in the future (quantums) so that no potential hacker could open the file? Which current encryption methods to use for it to ...
2
votes
1answer
166 views
If my protonmail password is compromised, does that potentially mean that my whole account is, permanently?
My (limited) understanding is that my password is used to encrypt the keys which are used to encrypt my mail messages on protonmail's servers. Does that mean that knowledge of my password could ...
1
vote
2answers
3k views
How do i crack an id_rsa encrypted private key with john the ripper
I am trying to crack a password protected id_rsa, with john the ripper. But it doesn't find the correct password for some reason.
I have create a new user and generated a new id_rsa with ssh-keygen (...
1
vote
2answers
150 views
Approximately how much entropy/security is lost by typing passphrase words using a number pad?
For context, the coldcard hardware wallet has a number pad as input. In order to maintain my sanity, I'd like to input an alphanumeric passphrase using a single keypress for each letter or number.
...
2
votes
0answers
21 views
How can I crack WPA2 hash with some limitations? [duplicate]
I want to crack an 8 character password, but I know this password doesn't contain more than 4 symbols, 4 uppercase letters, 4 lowercase letters and 4 numbers, and it contains at least 2 symbols, 2 ...
18
votes
3answers
5k views
Does revealing part of your hash give an attacker advantage when attacking your password? [duplicate]
This question was prompted by a recent visit to a certain site that provides (apparently for GDPR reasons) a table with all of your data, including part of your hashed password. I understand this ...
2
votes
1answer
204 views
Is better to have as password a sentence or first letter of the sentence?
Which is better master KeePass password to prevent any type of bruteforce between theses two type of password :
Complete sentence invented by user like : I like cheeseburger,
tomatoes and fries ! :)
...
6
votes
2answers
307 views
Crack passwords hashed with PHP?
Is this the right way to crack a password hashed with PHP?
I used the password_hash function to hash a password (PHP version 7.3).
Then I created a word list using a Python script. It's around 1GB in ...
0
votes
0answers
29 views
Cracking zip password [duplicate]
I am trying to decode a zip file password decoded form of: %3C%7C%3D3r%28Strong%29
I have tried to convert in to MD5 hash and use john the ripper to crack the password. Can someone explain how to do ...
-2
votes
1answer
141 views
Is there a way to hack your Facebook account back? [closed]
I think that from title it's pretty obvious what I'm trying to do. My Facebook account has been hacked, as it's using e-mail from whom I've forgotten password I can't get it back. I'm not using this e-...
-1
votes
1answer
68 views
Calculating Time for a Attack on Password Hashes [closed]
Suppose I have a database containing hashes. Hashes are obtained from password developed from randomly chosen set of 94 characters such that each password size is of 8 characters. So we have 94^8 ...
17
votes
10answers
10k views
Crack hashed passwords using a known password
I'm a dev trying to deploy a new dashboard I've written at work, the old one is a mess of hacked together libraries and only about half of the codebase is still even in use (dead code everywhere that ...
0
votes
0answers
289 views
John the Ripper Custom Dynamic Hash Function Usage
I have created a custom dynamic hash function comprised of a series of different existing hash functions chained together. I'll spare you the exact details because it's for a class assignment.
I've ...
1
vote
3answers
269 views
If no one knows a password, is there a reason to change it?
Scenario: A high level access account on a single machine, where the account is created by the system/application with a secure password, without exposing the password to a human or to any other ...
0
votes
0answers
38 views
How long shall a password be to resist a botnet brute force? [duplicate]
Imagine that I'm an evil genius, and I had the brilliant idea of creating a botnet for brute forcing passwords. Or I'm just the owner of the Echelon, and I have a farm of distributed servers around ...
0
votes
1answer
52 views
Is User Account Login Related to BitLocker Encryption Key
When I enabled BitLocker on my system-drive, I wasn't asked to select an unlock-method. I didn't have to enter any new passwords/keys. I only selected a few options for the encryption, and the process ...
1
vote
1answer
86 views
JohnTheRipper Advanced Mask
I have problem to construct advanced mask to crack hash of 7zip file.
The password have 16 chars where are all lower, upper, decimal and !@#$%-_=+:
Main information is that any char can't duplicate ...
3
votes
1answer
129 views
Can having certain restrictions/rules make passcodes less secure?
Say I have a phone whose security is corporately managed, and this management demands that I use a 6 digit passcode to lock the phone. So far, so reasonable. This gives an attacker a possibility of 1,...
0
votes
0answers
117 views
Logged in with a hacker's email address
I have an active account at ebay-kleinanzeigen.de (like Craigslist in the US).
Today I got a valid email from them that my email address was changed.
On my mac, I opened up my ebay-kleinanzeigen ...
0
votes
1answer
152 views
I don't know how to identify the method behind the hash [closed]
I found online an web app that is vulnerable to blind sql injection, I manage to get in users table and I looked at my password, in the table was the hased version, this one->57b0fcbe39b9336d, now I ...
3
votes
2answers
132 views
How strong is a password consisting of words arbitrarily chosen from the dictionary?
Diceware wants us to actually randomly pick n words from a given set of m=65 words.
Assume a user does not actually use a dice. Instead they take a physical dictionary of m words and "randomly" picks ...
2
votes
2answers
143 views
Given Diceware, why does the requirement to contain uppercase, numerics & punctuation in passwords still stand?
Example strong diceware password:
widow stout harvey crest zomba zloty butyl
This password will be rejected by most sites, for example by Outlook.com. (Notable exceptions: Gmail, Stackoverflow, ...
0
votes
0answers
16 views
Is there any method to perform a classic dictionnary attack against wifi ap? [duplicate]
the wifi attacks require you "capture a session/ a handshake ?".
Why can we do not simply use a classic dictionnary attack withouth trying to get the hash of the key.
If i create a script who test the ...
2
votes
5answers
293 views
Can you avoid ever sending a password over the wire?
Let's say I want to secure authentication on a web app or a mobile app or even a machine to machine app.
My first approach to secure the password is to enable HTTPS and some sort of client-side ...
3
votes
1answer
104 views
How does MariaDB's ed25519 auth scheme work?
Newer versions of MariaDB (a MySQL database server fork) have a new password based auth scheme called "ed25519". The docs are very sparse regarding how it works and what it does.
https://mariadb.com/...
101
votes
3answers
18k views
Why is Sojdlg123aljg a common password?
I was going through the list of top 100K passwords and found Sojdlg123aljg near the top of the list. Does anyone have any idea why this is such a common password?
0
votes
1answer
79 views
differentiate correct and incorrect password [closed]
So here it is, I had time to kill, so I used it to hack into my own gmail address with THC Hydra. (very fun I know).
So I checked out some old forums and gradually learned how to do it.
I understood ...
-1
votes
1answer
151 views
Find Confirmation Code (FindBug.io) [closed]
I have solve half of the problem by decoding a base64 code that reveal the next URL(https://app.findbug.io/app/task/FinDBuG-CTF2019) but now i don't know what to find or where i tried it with ...
51
votes
7answers
15k views
Is this password scheme legit?
I received an invitation for an IT security fair (https://www.it-sa.de/en).
They additionally delivered a password "Kryptonizer". That is a little card to hang on your keychain with the following (...
0
votes
1answer
175 views
Guessing speed in offline password cracking [closed]
What is the current speed an offline password cracking attack can be performed in guesses per seconds?
It is for sure heavily influenced by the used hashing-algorithm and the used hardware. But I am ...
-1
votes
1answer
49 views
Is it beneficial to know the first char of a wpa2 hash [duplicate]
All I will need to check is AAAAAAAA - AZZZZZZZ.
So I will only have to check the A's but will checking the A's be faster knowing the first char , I can't see why it would be as it would have to ...
1
vote
1answer
352 views
How long to crack an 8 character WPA2 hash if first char is known
I know the first char is A and it's all upper alphanumeric. Is there a way to estimate how long a mid level single GPU using hashcat would take to crack it?
0
votes
1answer
94 views
Security of adding letter in front of passphrase [duplicate]
I am wondering about the security of adding a letter in front of a long passphrase to help me have different passphrases for each site I use while not requiring me to remember several different N word ...
0
votes
0answers
19 views
60 character hex encrypted value with 32 character hex seed [duplicate]
Attempting to recover lost admin passwords from an old industrial control system database. We believe these have been encrypted rather than hashed (at least we know password version 0 for this system ...
3
votes
1answer
966 views
Combined-Dictionary attack with hashcat, for 4 words passphrases?
Reading the new advice on password which seems to spead easily (at least in my workplace), I was wondering how to use hashcat for cracking four-word password hashes?
Say I have this hash ...
0
votes
1answer
136 views
Is a thousand character password worth the security on my personal accounts? [duplicate]
As for now:
don't care about user experience, meaning that time spent reading, typing, memorizing password.
not thinking about quantum computing attacks.
8 characters good, 24 characters better, ...
29
votes
6answers
5k views
The most secure way to handle someone forgetting to verify their account?
Suppose we send out email verification to new subscribers that where they have to click on a link to verify their account.
Suppose they forget to verify it, and later try to login.
Should the error ...
0
votes
1answer
223 views
Lost RAR password, is there any way to access my data? [closed]
I lost my winrar password of my file. I need to access it. Is it possible? If yes, how?
4
votes
1answer
386 views
BIOS Password vs. BitLocker Pre-boot PIN
I'm attempting to ensure maximum security for my PC. I'm running Windows 10 Pro on a business-class HP notebook.
Unless I'm mistaken, I understand that both a BIOS password and the BitLocker pre-boot ...
