Questions tagged [password-cracking]

for questions relating to the cracking of passwords and the practices to mitigate against passwords being cracked.

Filter by
Sorted by
Tagged with
1
vote
0answers
45 views

Hardware for password cracking

I'm planning to extend my pentest services to Password Cracking, to be more precise: Cracking Active Directory Passwords, extracted from the customers Active Directory in order to check users ...
0
votes
0answers
27 views

How To Generate a custom worldlist [closed]

I want to generate a wordlist. It's a bit hard to explain what I want so look at this example character set: 4, 3, 2, 1, 0 I want every string to start with 4 and a bigger number does not succeed a ...
0
votes
0answers
24 views

Specifying wordsets in variables within hashcat masks/rules? [closed]

Hashcat documentation shows the following variables that we can use inside masks: ?l = abcdefghijklmnopqrstuvwxyz ?u = ABCDEFGHIJKLMNOPQRSTUVWXYZ ?d = 0123456789 ?h = 0123456789abcdef ?H = ...
0
votes
1answer
205 views

John the ripper - ecryptfs - sample not cracked: 0 password hashes cracked

I tried to use john the ripper on the sample : ecryptfs_sample_metadata.tar (password is 'openwall') Which I downloaded from here: https://openwall.info/wiki/john/sample-non-hashes If i try sudo ...
1
vote
1answer
52 views

Does knowing part of a passphrase for sure really mean that you can “disregard” that entire part when trying to crack it?

Alice bought 1 Bitcoin and encrypted her wallet.dat in Bitcoin Core. Samantha, Alice's friend, notices the Bitcoin price skyrocketing and, while Alice is in the bathroom, steals Alice's wallet.dat as ...
1
vote
1answer
88 views

zip password cracking with permutation

I have a zip file (.zip created by 7zip v15.10) that I remember the password to (~12 characters long), but it seems I've typed the password wrong while zipping it and now it doesn't open. What are the ...
6
votes
3answers
7k views

Running Ophcrack against Windows 10

I'm putting together a demo of Ophcrack for my team here. It's been a while since I used it, like 7-10 years. Booting up into either the Ophcrack live CD or using it in Kali, I'm seeing samdump2 and ...
2
votes
1answer
82 views

Password generation

I'm trying to generate all possible variation of a password. The base word is like "PleaseSub!" and I need all possible version of it with uppercase, lowercase, etc.. I know there is ...
-1
votes
0answers
36 views

nt in my phone. I also recieved weired messages from many numbers [closed]

Those numbers from which I got weired messages are found out to be from delhi . These are marked as spam or fraud on truecaller.
2
votes
1answer
730 views

How do Field Programmable Gate Arrays (FPGAs) compare to Graphics Processing Units (GPUs); for cracking hashes?

As a general rule, GPUs are more effective than CPUs when it comes to performing acutely repetitive tasks, like iterating over lists and generating permutations of a set (i.e. exhausting dictionaries &...
6
votes
2answers
2k views

How are website passwords cracked? [closed]

What approaches are there for cracking user passwords for website/e-mail accounts? can only think of three strategies, but what else? Algorithmically: Combinatorially attempting different sequences ...
1
vote
1answer
100 views

Can you bruteforce a SSH password without alerting the server owner?

What happened? This is a live event that a friend of mine is working on, a company's systems were breached by a Threat Actor (TA), when the Cyber Sec company was called in and tried to regain access ...
2
votes
1answer
67 views

How can the passphrase matter besides the very most obvious patterns? [duplicate]

Let's say that my passphrase is: aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaapassword9 Yes, it looks ridiculous. But only because we already know it. An attacker, trying to brute-force their way into this ...
1
vote
0answers
18 views

TikTok's Password Character Limit [duplicate]

I've been making websites now for a while and when I've created websites or apps I've always put a minimum password size but usually a relatively large password size that isn't ever an issue for my ...
0
votes
1answer
566 views

Generate every alphanumerical combination in crunch within 8-20 characters in length

I want to generate combinations in sequential range of the length 8-20 with the following characters: abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ1234567890!@#$%^&*()~`";.,/[]-= How ...
0
votes
1answer
82 views

Is using SHA256 to create 256bit secret key from bcrypt good ok?

I am trying to Use AES to store passwords for a password manager. For authentication I am already using bcrypt. As AES uses 256 bit Key can I use SHA256 to generate 256 bit key from hashed value of ...
0
votes
2answers
484 views

How can we estimate the time and computing resources needed to break or crack an encryption algorithm and/or password?

I am not too familiar with the technical jargon, so bear with me while I explain the issue in simple and naive words. I have looked into many places but still haven't found a solution to this specific ...
6
votes
1answer
133 views

For bcrypt why is JTR so much faster than hashcat?

To keep it short I've recently been learning about hashing and password hash cracking on TryHackMe. I was tasked to crack the following hash: $2y$10$0veO/JSFh4389Lluc4Xya.dfy2MF.bZhz0jVMw.V....
0
votes
1answer
85 views

Knowing when a hacked password is correct

I was recently a victim of the any van data breach and so I started read up on password encryption and security - it is pretty amazing stuff. One thing that confuses me though is, since GPUs can now ...
1
vote
2answers
186 views

Hacking WPA/WPA2 passwords

Is there another method apart from using a wordlist to crack WPA/WPA2 passwords? because it's not going to work for all cases. Even using the biggest wordlist ever, there are cases where there won't ...
2
votes
4answers
22k views

How do I crack an id_rsa encrypted private key with john the ripper?

I am trying to crack a password protected id_rsa, with john the ripper. But it doesn't find the correct password for some reason. I have create a new user and generated a new id_rsa with ssh-keygen (...
4
votes
3answers
4k views

Prevention of user's passwords being stored as plain text in bash history

Say I want to find the password of a linux user sudoer account. Assume he uses a strong password. Assume I have physical access to the machine. I can get hold of his passwd and shadow file and brute-...
0
votes
0answers
69 views

Isn't this kind of password ultimately secure and insanely easy to remember? [duplicate]

Pick any dictionary word. Think of a number over 10 and below 20. Repeat the word as many times as the number, and end off with the same number (for example, "12"). Example: ...
1
vote
1answer
128 views

Password cracking using Quantum Computers

Suppose that I have a password that is n-digits long. Each digit can take m values. So the number of permutations will be m^n. I wanted to know how much time it would take a quantum computer to crack ...
1
vote
5answers
368 views

Can use this security system on websites?

I have created a password security system. I wanted to get your reviews about it and its technical problems. In this system, users create a dynamic password that will change every time they try to ...
0
votes
0answers
24 views

How to assess security of Argon2 parameters [duplicate]

I would like to hash user password with Argon2id, then use this hash as ECDSA private key. I made some tests with Python and passlib.hash and found following parameters: memory: 32 MB iterations: 100 ...
0
votes
3answers
1k views

If my password is not on rockyou.txt does it mean that is a good password?

I have been wondering if all my online and wifi passwords are complex enough. So to test this I was checking if the password was already present on the rockyou.txt wordlist. If the password is not ...
-1
votes
1answer
32 views

Wordlist generate: uppercase and each character appears only one [closed]

I want to generate a wordlist that contains only uppercase characters on length 8 and each character appears only once. Is there any way to do that?
7
votes
3answers
7k views

File security when encrypting files directly with the openssl command / and what about SHA1 hashing password first?

I've been using this command to encrypt files for a while now: openssl aes-256-cbc -a -salt -in secrets.txt -out secrets.txt.enc Then I type in a password. Can someone tell me, roughly speaking, ...
1
vote
1answer
4k views

Brute-Forcing DVWA login page with hydra

I'm learning how to brute force web login pages with a popular brute force tool called "Hydra". I'm using Kali Linux (VirtualBox) to do this. I've installed DVWA (Damn Vulnerable Web Application) and ...
9
votes
2answers
44k views

Recover password from .pfx file

I have an old Windows SmartClient application that is published with a signed certificate (a .pfx file). We want to extend the expiration date to more than one year. I've used a program called ...
0
votes
0answers
20 views

Time it will take to crack a password file? [duplicate]

I'm trying to answer a multiple-choice question which is the following: "Consider the security of a password file, which includes a 10 bit salt and all passwords are hashed, but known to consist ...
1
vote
1answer
82 views

What is the minimum secure length for gpg -c file.txt?

I want to use gpg -c with a user-generated password that I can easily remember. Are 16 characters enough? for example would a password similar to "I own 32 houses." be bruteforcable?
28
votes
4answers
8k views

When passwords of a website leak, are all leaked passwords equally easy to read?

As far as I know, when passwords from a website leak, they leak in an encrypted form. Are all those passwords equally easy to decrypt? My hunch is that a 10-character-long password maybe gets ...
0
votes
1answer
131 views

How does john the ripper crack hashes using wordlists?

How does John The Ripper work when trying to crack passphrase of a private ssh key? As in what steps are involved when it tries to do so? What's the role of ssh2john in the whole process?
2
votes
2answers
176 views

Recommended length for WPA-2 password in 2020

I'm auditing my network setup and trying to determine an appropriate password length with a random set of digits and numbers. I found a Security Stack exchange answer but it was written in 2012 and ...
3
votes
2answers
3k views

truecrypt volume - Recover 18char known password with hashcat (characters variations)

I have an old truecrypt file that I'd like to decrypt. I know the 18 characters password I was using at the time, I'm sure of it. However I made a "variation" of it : I mapped some characters to l33t ...
2
votes
1answer
346 views

How to interpret the attempt information from Hydra

I was performing a Hydra attack on my TP-Link router and for that I prepared a passwords.txt file with 288 passwords. hydra -l webadmin -P test_creds/passwords.txt xxx.xxx.xxx.xxx ftp A minute ...
0
votes
1answer
9k views

Simple Hydra test with Windows RDP

I am using VMware and have 3 VMs all on the NAT network with DHCP. All three machines can ping each other. From one windows to the other windows, I can RDP into the 192.168.190.130 windows machine ...
0
votes
1answer
580 views

What is the plaintext password of 'hash part 1' in the shadow file?

on immersivelabs lab Password Hashes II https://dca.immersivelabs.online/labs/password-hashes-ii/ there is a question: What is the plaintext password of 'hash part 1' in the shadow file? shadow.txt ...
0
votes
1answer
86 views

Smaller password lists [closed]

I hack wifi passwords with kali linux on airmon-ng and I make always password lists with crunch but the lists are always too long (I'm talking about <100 PT) and I want to know if is there a ...
2
votes
2answers
992 views

Are partial passwords a security improvement over full passwords?

With full password authentication, you need to enter the full password every time. With partial password authentication, you're asked for some subset of the password each time, and which characters ...
6
votes
2answers
2k views

How much faster does a GPU or FPGA crack an RSA key compared to a CPU?

Are there any significant speed up in time on cracking an RSA key (either brute-force or factoring with general number field sieve) using a GPA or FPGA compared to a CPU? If there is a speed advantage,...
0
votes
1answer
119 views

What vulnerabilities would this type of “password manager” have?

When I was searching for a password manager to use I stumbled upon the concept of Master Password which instead of encrypting and saving your passwords, generates them by using your master password ...
0
votes
0answers
32 views

Are there intrinsically weaknesses in accessing a same payload encrypted with different keys?

Assume we use AES256 to encrypt the same payload 100 times, each with a different key. An attacker gains access to the 100 encrypted payloads, and nothing else. Is there some way the attacker can gain ...
65
votes
5answers
7k views

Do 2FA sites leak info by confirming a correct password guess?

Here's my relatively layman's view of the issue. Many websites tout multifactor authentication (MFA) as an enormous boost to the security of users' accounts, and it can be if implemented properly. ...
1
vote
3answers
199 views

How can wireless password cracking be detected?

Our team was hired for a red team engagement for a client. A part of the engagement is attempting to crack the WiFi passwords of their office APs. However, we obviously want to stay undetected. What ...
0
votes
2answers
76 views

Is there a utility you would use to create wordlists from directories and files? [closed]

I have a home directory and a gpg file I am attempting to brute force. Is there a utility that you know that will recursively create wordlist from directives and file contents?
1
vote
1answer
1k views

John the Ripper Custom Dynamic Hash Function Usage

I have created a custom dynamic hash function comprised of a series of different existing hash functions chained together. I'll spare you the exact details because it's for a class assignment. I've ...
0
votes
1answer
92 views

routersploit bruteforce cred attcack using http

while i'm trying to do a brutforce attack on my router using routersploit. Im getting the error rsf (HTTP Basic/Digest Bruteforce) > run [*] Running module creds/generic/...

1
2 3 4 5
14