Questions tagged [password-cracking]
for questions relating to the cracking of passwords and the practices to mitigate against passwords being cracked.
696
questions
1
vote
0answers
45 views
Hardware for password cracking
I'm planning to extend my pentest services to Password Cracking, to be more precise: Cracking Active Directory Passwords, extracted from the customers Active Directory in order to check users ...
0
votes
0answers
27 views
How To Generate a custom worldlist [closed]
I want to generate a wordlist. It's a bit hard to explain what I want so look at this example character set: 4, 3, 2, 1, 0
I want every string to start with 4 and a bigger number does not succeed a ...
0
votes
0answers
24 views
Specifying wordsets in variables within hashcat masks/rules? [closed]
Hashcat documentation shows the following variables that we can use inside masks:
?l = abcdefghijklmnopqrstuvwxyz
?u = ABCDEFGHIJKLMNOPQRSTUVWXYZ
?d = 0123456789
?h = 0123456789abcdef
?H = ...
0
votes
1answer
205 views
John the ripper - ecryptfs - sample not cracked: 0 password hashes cracked
I tried to use john the ripper on the sample :
ecryptfs_sample_metadata.tar (password is 'openwall')
Which I downloaded from here:
https://openwall.info/wiki/john/sample-non-hashes
If i try
sudo ...
1
vote
1answer
52 views
Does knowing part of a passphrase for sure really mean that you can “disregard” that entire part when trying to crack it?
Alice bought 1 Bitcoin and encrypted her wallet.dat in Bitcoin Core.
Samantha, Alice's friend, notices the Bitcoin price skyrocketing and, while Alice is in the bathroom, steals Alice's wallet.dat as ...
1
vote
1answer
88 views
zip password cracking with permutation
I have a zip file (.zip created by 7zip v15.10) that I remember the password to (~12 characters long), but it seems I've typed the password wrong while zipping it and now it doesn't open.
What are the ...
6
votes
3answers
7k views
Running Ophcrack against Windows 10
I'm putting together a demo of Ophcrack for my team here. It's been a while since I used it, like 7-10 years. Booting up into either the Ophcrack live CD or using it in Kali, I'm seeing samdump2 and ...
2
votes
1answer
82 views
Password generation
I'm trying to generate all possible variation of a password.
The base word is like "PleaseSub!" and I need all possible version of it with uppercase, lowercase, etc.. I know there is ...
-1
votes
0answers
36 views
nt in my phone. I also recieved weired messages from many numbers [closed]
Those numbers from which I got weired messages are found out to be from delhi . These are marked as spam or fraud on truecaller.
2
votes
1answer
730 views
How do Field Programmable Gate Arrays (FPGAs) compare to Graphics Processing Units (GPUs); for cracking hashes?
As a general rule, GPUs are more effective than CPUs when it comes to performing acutely repetitive tasks, like iterating over lists and generating permutations of a set (i.e. exhausting dictionaries &...
6
votes
2answers
2k views
How are website passwords cracked? [closed]
What approaches are there for cracking user passwords for website/e-mail accounts? can only think of three strategies, but what else?
Algorithmically: Combinatorially attempting different sequences ...
1
vote
1answer
100 views
Can you bruteforce a SSH password without alerting the server owner?
What happened?
This is a live event that a friend of mine is working on, a company's systems were breached by a Threat Actor (TA), when the Cyber Sec company was called in and tried to regain access ...
2
votes
1answer
67 views
How can the passphrase matter besides the very most obvious patterns? [duplicate]
Let's say that my passphrase is:
aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaapassword9
Yes, it looks ridiculous. But only because we already know it. An attacker, trying to brute-force their way into this ...
1
vote
0answers
18 views
TikTok's Password Character Limit [duplicate]
I've been making websites now for a while and when I've created websites or apps I've always put a minimum password size but usually a relatively large password size that isn't ever an issue for my ...
0
votes
1answer
566 views
Generate every alphanumerical combination in crunch within 8-20 characters in length
I want to generate combinations in sequential range of the length 8-20 with the following characters:
abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ1234567890!@#$%^&*()~`";.,/[]-=
How ...
0
votes
1answer
82 views
Is using SHA256 to create 256bit secret key from bcrypt good ok?
I am trying to Use AES to store passwords for a password manager. For authentication I am already using bcrypt. As AES uses 256 bit Key can I use SHA256 to generate 256 bit key from hashed value of ...
0
votes
2answers
484 views
How can we estimate the time and computing resources needed to break or crack an encryption algorithm and/or password?
I am not too familiar with the technical jargon, so bear with me while I explain the issue in simple and naive words. I have looked into many places but still haven't found a solution to this specific ...
6
votes
1answer
133 views
For bcrypt why is JTR so much faster than hashcat?
To keep it short I've recently been learning about hashing and password hash cracking on TryHackMe.
I was tasked to crack the following hash: $2y$10$0veO/JSFh4389Lluc4Xya.dfy2MF.bZhz0jVMw.V....
0
votes
1answer
85 views
Knowing when a hacked password is correct
I was recently a victim of the any van data breach and so I started read up on password encryption and security - it is pretty amazing stuff. One thing that confuses me though is, since GPUs can now ...
1
vote
2answers
186 views
Hacking WPA/WPA2 passwords
Is there another method apart from using a wordlist to crack WPA/WPA2 passwords? because it's not going to work for all cases. Even using the biggest wordlist ever, there are cases where there won't ...
2
votes
4answers
22k views
How do I crack an id_rsa encrypted private key with john the ripper?
I am trying to crack a password protected id_rsa, with john the ripper. But it doesn't find the correct password for some reason.
I have create a new user and generated a new id_rsa with ssh-keygen (...
peterh - Reinstate Monica
2,8276 gold badges24 silver badges31 bronze badges
4
votes
3answers
4k views
Prevention of user's passwords being stored as plain text in bash history
Say I want to find the password of a linux user sudoer account. Assume he uses a strong password. Assume I have physical access to the machine. I can get hold of his passwd and shadow file and brute-...
0
votes
0answers
69 views
Isn't this kind of password ultimately secure and insanely easy to remember? [duplicate]
Pick any dictionary word.
Think of a number over 10 and below 20.
Repeat the word as many times as the number, and end off with the same number (for example, "12").
Example:
...
1
vote
1answer
128 views
Password cracking using Quantum Computers
Suppose that I have a password that is n-digits long. Each digit can take m values. So the number of permutations will be m^n. I wanted to know how much time it would take a quantum computer to crack ...
1
vote
5answers
368 views
Can use this security system on websites?
I have created a password security system.
I wanted to get your reviews about it and its technical problems.
In this system, users create a dynamic password that will change every time they try to ...
0
votes
0answers
24 views
How to assess security of Argon2 parameters [duplicate]
I would like to hash user password with Argon2id, then use this hash as ECDSA private key. I made some tests with Python and passlib.hash and found following parameters:
memory: 32 MB
iterations: 100
...
0
votes
3answers
1k views
If my password is not on rockyou.txt does it mean that is a good password?
I have been wondering if all my online and wifi passwords are complex enough.
So to test this I was checking if the password was already present on the rockyou.txt wordlist.
If the password is not ...
-1
votes
1answer
32 views
Wordlist generate: uppercase and each character appears only one [closed]
I want to generate a wordlist that contains only uppercase characters on length 8 and each character appears only once.
Is there any way to do that?
7
votes
3answers
7k views
File security when encrypting files directly with the openssl command / and what about SHA1 hashing password first?
I've been using this command to encrypt files for a while now:
openssl aes-256-cbc -a -salt -in secrets.txt -out secrets.txt.enc
Then I type in a password.
Can someone tell me, roughly speaking, ...
1
vote
1answer
4k views
Brute-Forcing DVWA login page with hydra
I'm learning how to brute force web login pages with a popular brute force tool called "Hydra". I'm using Kali Linux (VirtualBox) to do this. I've installed DVWA (Damn Vulnerable Web Application) and ...
9
votes
2answers
44k views
Recover password from .pfx file
I have an old Windows SmartClient application that is published with a signed certificate (a .pfx file).
We want to extend the expiration date to more than one year. I've used a program called ...
0
votes
0answers
20 views
Time it will take to crack a password file? [duplicate]
I'm trying to answer a multiple-choice question which is the following:
"Consider the security of a password file, which includes a 10 bit
salt and all passwords are hashed, but known to consist ...
1
vote
1answer
82 views
What is the minimum secure length for gpg -c file.txt?
I want to use gpg -c with a user-generated password that I can easily remember. Are 16 characters enough? for example would a password similar to "I own 32 houses." be bruteforcable?
28
votes
4answers
8k views
When passwords of a website leak, are all leaked passwords equally easy to read?
As far as I know, when passwords from a website leak, they leak in an encrypted form. Are all those passwords equally easy to decrypt? My hunch is that a 10-character-long password maybe gets ...
0
votes
1answer
131 views
How does john the ripper crack hashes using wordlists?
How does John The Ripper work when trying to crack passphrase of a private ssh key? As in what steps are involved when it tries to do so? What's the role of ssh2john in the whole process?
2
votes
2answers
176 views
Recommended length for WPA-2 password in 2020
I'm auditing my network setup and trying to determine an appropriate password length with a random set of digits and numbers. I found a Security Stack exchange answer but it was written in 2012 and ...
3
votes
2answers
3k views
truecrypt volume - Recover 18char known password with hashcat (characters variations)
I have an old truecrypt file that I'd like to decrypt.
I know the 18 characters password I was using at the time, I'm sure of it. However I made a "variation" of it : I mapped some characters to l33t ...
2
votes
1answer
346 views
How to interpret the attempt information from Hydra
I was performing a Hydra attack on my TP-Link router and for that I prepared a passwords.txt file with 288 passwords.
hydra -l webadmin -P test_creds/passwords.txt xxx.xxx.xxx.xxx ftp
A minute ...
0
votes
1answer
9k views
Simple Hydra test with Windows RDP
I am using VMware and have 3 VMs all on the NAT network with DHCP. All three machines can ping each other. From one windows to the other windows, I can RDP into the 192.168.190.130 windows machine ...
0
votes
1answer
580 views
What is the plaintext password of 'hash part 1' in the shadow file?
on immersivelabs lab Password Hashes II
https://dca.immersivelabs.online/labs/password-hashes-ii/
there is a question:
What is the plaintext password of 'hash part 1' in the shadow file?
shadow.txt ...
0
votes
1answer
86 views
Smaller password lists [closed]
I hack wifi passwords with kali linux on airmon-ng and I make always password lists with crunch but the lists are always too long (I'm talking about <100 PT) and I want to know if is there a ...
2
votes
2answers
992 views
Are partial passwords a security improvement over full passwords?
With full password authentication, you need to enter the full password every time.
With partial password authentication, you're asked for some subset of the password each time, and which characters ...
6
votes
2answers
2k views
How much faster does a GPU or FPGA crack an RSA key compared to a CPU?
Are there any significant speed up in time on cracking an RSA key (either brute-force or factoring with general number field sieve) using a GPA or FPGA compared to a CPU? If there is a speed advantage,...
0
votes
1answer
119 views
What vulnerabilities would this type of “password manager” have?
When I was searching for a password manager to use I stumbled upon the concept of Master Password which instead of encrypting and saving your passwords, generates them by using your master password ...
0
votes
0answers
32 views
Are there intrinsically weaknesses in accessing a same payload encrypted with different keys?
Assume we use AES256 to encrypt the same payload 100 times, each with a different key.
An attacker gains access to the 100 encrypted payloads, and nothing else.
Is there some way the attacker can gain ...
65
votes
5answers
7k views
Do 2FA sites leak info by confirming a correct password guess?
Here's my relatively layman's view of the issue.
Many websites tout multifactor authentication (MFA) as an enormous boost to the security of users' accounts, and it can be if implemented properly.
...
1
vote
3answers
199 views
How can wireless password cracking be detected?
Our team was hired for a red team engagement for a client. A part of the engagement is attempting to crack the WiFi passwords of their office APs. However, we obviously want to stay undetected. What ...
0
votes
2answers
76 views
Is there a utility you would use to create wordlists from directories and files? [closed]
I have a home directory and a gpg file I am attempting to brute force. Is there a utility that you know that will recursively create wordlist from directives and file contents?
1
vote
1answer
1k views
John the Ripper Custom Dynamic Hash Function Usage
I have created a custom dynamic hash function comprised of a series of different existing hash functions chained together. I'll spare you the exact details because it's for a class assignment.
I've ...
0
votes
1answer
92 views
routersploit bruteforce cred attcack using http
while i'm trying to do a brutforce attack on my router using routersploit.
Im getting the error
rsf (HTTP Basic/Digest Bruteforce) > run
[*] Running module creds/generic/...
