Questions tagged [password-cracking]

for questions relating to the cracking of passwords and the practices to mitigate against passwords being cracked.

Filter by
Sorted by
Tagged with
2
votes
3answers
4k views

Is it possible to brute-force a CVV code?

If I'm not wrong, the CVV code almost always follows a certain pattern based on the credit card number and dates. What are the possibilities to go through to hypothetically brute-force a CVV code? Is ...
0
votes
1answer
57 views

create a custom password list by crunch [closed]

i want to create a password list by crunch and then pass it to hashcat but first of all i have a custom password list and i want to add numbers to my characters in that passlist with crunch before ...
-1
votes
1answer
62 views

Calculating Time for a Attack on Password Hashes [closed]

Suppose I have a database containing hashes. Hashes are obtained from password developed from randomly chosen set of 94 characters such that each password size is of 8 characters. So we have 94^8 ...
2
votes
2answers
8k views

How to crack encrypted disk (crypto-LUKS) in an efficient way?

I had a disk encrypted by crypto-LUKS but forgotten password. I read a question posted here. LUKS HDD Encryption crack But before that I want to know if there's some free software I can use to ...
0
votes
1answer
39 views

Is User Account Login Related to BitLocker Encryption Key

When I enabled BitLocker on my system-drive, I wasn't asked to select an unlock-method. I didn't have to enter any new passwords/keys. I only selected a few options for the encryption, and the process ...
16
votes
10answers
10k views

Crack hashed passwords using a known password

I'm a dev trying to deploy a new dashboard I've written at work, the old one is a mess of hacked together libraries and only about half of the codebase is still even in use (dead code everywhere that ...
2
votes
1answer
98 views

When knowing an individual's plaintext password history, how much information is expected to be gained with a new password? Do we know this?

The premise: Knowing a persons password history should provide information to help when guessing a new password of theirs. At an extreme end, with a password history of wildcats, wildcats1, then ...
9
votes
3answers
6k views

If WPA2-PSK is insecure, what other options do home users have?

from what I'm reading online it seems that one can land attacks and successfully crack a WPA2-PSK wifi network, is that true and if it is, how home users can secure their networks? I seen an ...
0
votes
0answers
120 views

John the Ripper Custom Dynamic Hash Function Usage

I have created a custom dynamic hash function comprised of a series of different existing hash functions chained together. I'll spare you the exact details because it's for a class assignment. I've ...
2
votes
1answer
1k views

Is it as easy to crack a wifi password, as shown in the video?

I was browsing YouTube and I came across this video In the video they show how to crack the password of a wifi using CommView, Aircrack and Wordlist. According to the video it takes about two ...
6
votes
7answers
8k views

Is it possible to detect password length from hash? Does doubling your password add more security?

Assuming a service doesn't store a plain text password, am I right in saying that the answer to this question depends on the service? On a bad service, the hash length is related to the password ...
1
vote
1answer
368 views

BitLocker Recovery Key and Microsoft Account Password

I have a Windows 10 Pro machine; the administrator (and only) account is a Microsoft account. I am trying to set up BitLocker to ensure maximum security and safety, even from Microsoft. I understand ...
1
vote
3answers
254 views

If no one knows a password, is there a reason to change it?

Scenario: A high level access account on a single machine, where the account is created by the system/application with a secure password, without exposing the password to a human or to any other ...
0
votes
0answers
35 views

How long shall a password be to resist a botnet brute force? [duplicate]

Imagine that I'm an evil genius, and I had the brilliant idea of creating a botnet for brute forcing passwords. Or I'm just the owner of the Echelon, and I have a farm of distributed servers around ...
1
vote
1answer
80 views

JohnTheRipper Advanced Mask

I have problem to construct advanced mask to crack hash of 7zip file. The password have 16 chars where are all lower, upper, decimal and !@#$%-_=+: Main information is that any char can't duplicate ...
3
votes
1answer
120 views

Can having certain restrictions/rules make passcodes less secure?

Say I have a phone whose security is corporately managed, and this management demands that I use a 6 digit passcode to lock the phone. So far, so reasonable. This gives an attacker a possibility of 1,...
3
votes
1answer
12k views

Generate John the Ripper rule

This question asks for pointers about generating JtR rulesets, but the OP states I understand how to use it to make various permutations from a given wordlist Could someone please explain that? ...
0
votes
0answers
115 views

Logged in with a hacker's email address

I have an active account at ebay-kleinanzeigen.de (like Craigslist in the US). Today I got a valid email from them that my email address was changed. On my mac, I opened up my ebay-kleinanzeigen ...
0
votes
1answer
126 views

I don't know how to identify the method behind the hash [closed]

I found online an web app that is vulnerable to blind sql injection, I manage to get in users table and I looked at my password, in the table was the hased version, this one->57b0fcbe39b9336d, now I ...
2
votes
2answers
131 views

Given Diceware, why does the requirement to contain uppercase, numerics & punctuation in passwords still stand?

Example strong diceware password: widow stout harvey crest zomba zloty butyl This password will be rejected by most sites, for example by Outlook.com. (Notable exceptions: Gmail, Stackoverflow, ...
3
votes
2answers
124 views

How strong is a password consisting of words arbitrarily chosen from the dictionary?

Diceware wants us to actually randomly pick n words from a given set of m=65 words. Assume a user does not actually use a dice. Instead they take a physical dictionary of m words and "randomly" picks ...
2
votes
5answers
281 views

Can you avoid ever sending a password over the wire?

Let's say I want to secure authentication on a web app or a mobile app or even a machine to machine app. My first approach to secure the password is to enable HTTPS and some sort of client-side ...
10
votes
4answers
25k views

Bypassing Windows 10 password with Utilman.exe trick - fixed?

Recently I run into a locked down laptop with Windows 10 OS (actually I guess it was updated from Windows 7 if that matters). My collegue was using this computer some time ago and lost his login and ...
0
votes
0answers
16 views

Is there any method to perform a classic dictionnary attack against wifi ap? [duplicate]

the wifi attacks require you "capture a session/ a handshake ?". Why can we do not simply use a classic dictionnary attack withouth trying to get the hash of the key. If i create a script who test the ...
0
votes
2answers
639 views

Generating multi-word passphrases from a wordlist [closed]

As part of pentesting NT hashes where the underlying passwords are minimum 16 characters of length, I have created a wordlist of common words, sports teams, movies, names, years etc. - inspired by the ...
0
votes
1answer
52 views

Specify Amount of type of character Crunch

I'm sure these questions pop up a lot, but I can't find one that does what I'm looking for. So, I'm trying to use crunch to generate a wordlist with specific amounts of each type of character, i.e. 2 ...
2
votes
1answer
62 views

How does MariaDB's ed25519 auth scheme work?

Newer versions of MariaDB (a MySQL database server fork) have a new password based auth scheme called "ed25519". The docs are very sparse regarding how it works and what it does. https://mariadb.com/...
41
votes
5answers
260k views

How to recover a lost zip file password?

I have some files I was given by my teacher at University, I could chase him up, but I may as well try getting blood from a stone, his response rate isn't great and I completed my degree a year ago! ...
101
votes
3answers
18k views

Why is Sojdlg123aljg a common password?

I was going through the list of top 100K passwords and found Sojdlg123aljg near the top of the list. Does anyone have any idea why this is such a common password?
0
votes
2answers
11k views

Most efficient way to crack a NTLM hash

I've been given a non-salted NTLM hash and a week worth of time to find the password it hides. I have also been told the password length is 11 chars, and that it is a Windows 10 user password. I'm ...
0
votes
1answer
69 views

differentiate correct and incorrect password [closed]

So here it is, I had time to kill, so I used it to hack into my own gmail address with THC Hydra. (very fun I know). So I checked out some old forums and gradually learned how to do it. I understood ...
1
vote
1answer
486 views

How can i fine tune hydra to find the correct password

I am having a bit of a pickle getting hydra to see the correct password when the page is redirected. The condition where the password is correct is if the login is redirected to a certain page in the ...
0
votes
1answer
2k views

Brute-Forcing DVWA login page with hydra

I'm learning how to brute force web login pages with a popular brute force tool called "Hydra". I'm using Kali Linux (VirtualBox) to do this. I've installed DVWA (Damn Vulnerable Web Application) and ...
11
votes
3answers
557 views

Why do salts for hashing passwords need to be globally unique, not just system/site-unique?

I was reading an answer by Terry Chia to another question about the requirements for a salt, in which he/she (among others) specified that salts need to be globally unique, but don't go into any ...
51
votes
7answers
15k views

Is this password scheme legit?

I received an invitation for an IT security fair (https://www.it-sa.de/en). They additionally delivered a password "Kryptonizer". That is a little card to hang on your keychain with the following (...
-1
votes
1answer
117 views

Find Confirmation Code (FindBug.io) [closed]

I have solve half of the problem by decoding a base64 code that reveal the next URL(https://app.findbug.io/app/task/FinDBuG-CTF2019) but now i don't know what to find or where i tried it with ...
0
votes
1answer
339 views

Both Ophcrack and ONTP&RE incorrectly show Windows 10 passwords as blank

I'm trying to crack a Windows 10 laptop that I myself set a password on a day or so ago. So far I've tried booting into Ophcrack 3.6 and ONTP&RE (Offline NT Password & Registry Editor) from ...
0
votes
1answer
123 views

Guessing speed in offline password cracking [closed]

What is the current speed an offline password cracking attack can be performed in guesses per seconds? It is for sure heavily influenced by the used hashing-algorithm and the used hardware. But I am ...
2
votes
1answer
202 views

How to interpret the attempt information from Hydra

I was performing a Hydra attack on my TP-Link router and for that I prepared a passwords.txt file with 288 passwords. hydra -l webadmin -P test_creds/passwords.txt xxx.xxx.xxx.xxx ftp A minute ...
7
votes
2answers
3k views

How secure is a Windows 10 PIN not needing enter?

I've searched around about Windows 10 PINs and although have seen a few answers regarding the security of them as a whole, I haven't found any discussing the fact that when I type in my PIN, the ...
1
vote
1answer
288 views

How long to crack an 8 character WPA2 hash if first char is known

I know the first char is A and it's all upper alphanumeric. Is there a way to estimate how long a mid level single GPU using hashcat would take to crack it?
0
votes
1answer
6k views

Simple Hydra test with Windows RDP

I am using VMware and have 3 VMs all on the NAT network with DHCP. All three machines can ping each other. From one windows to the other windows, I can RDP into the 192.168.190.130 windows machine ...
3
votes
1answer
432 views

What are the factors making a WPA2 handshake suitable for cracking?

Days ago I was dumping handshakes of my APs using airodump-ng. I would later use aircrack-ng to crack them using wordlists which would purposely contain the passphrases. However, I noticed that some ...
0
votes
2answers
560 views

WEP password cracking

I was testing WEP password cracking on my router. I had set a thirteen character password ("TESTING123456") and tried these commands: airmon-ng start wlan0 Then I started airodump-ng using this ...
-1
votes
1answer
49 views

Is it beneficial to know the first char of a wpa2 hash [duplicate]

All I will need to check is AAAAAAAA - AZZZZZZZ. So I will only have to check the A's but will checking the A's be faster knowing the first char , I can't see why it would be as it would have to ...
0
votes
1answer
94 views

Security of adding letter in front of passphrase [duplicate]

I am wondering about the security of adding a letter in front of a long passphrase to help me have different passphrases for each site I use while not requiring me to remember several different N word ...
0
votes
0answers
19 views

60 character hex encrypted value with 32 character hex seed [duplicate]

Attempting to recover lost admin passwords from an old industrial control system database. We believe these have been encrypted rather than hashed (at least we know password version 0 for this system ...
1
vote
1answer
524 views

Combined-Dictionary attack with hashcat, for 4 words passphrases?

Reading the new advice on password which seems to spead easily (at least in my workplace), I was wondering how to use hashcat for cracking four-word password hashes? Say I have this hash ...
2
votes
1answer
145 views

How long are password hashes stored locally?

Suppose Alice logs into Windows machine M (which is part of an enterprise network managed through Active Directory). My understanding is that M will contact the domain controller to get Alice's ...
0
votes
1answer
132 views

Is a thousand character password worth the security on my personal accounts? [duplicate]

As for now: don't care about user experience, meaning that time spent reading, typing, memorizing password. not thinking about quantum computing attacks. 8 characters good, 24 characters better, ...