Skip to main content

Questions tagged [password-cracking]

for questions relating to the cracking of passwords and the practices to mitigate against passwords being cracked.

Filter by
Sorted by
Tagged with
107 votes
13 answers
75k views

Why is client-side hashing of a password so uncommon?

There are very few websites that hash the users password before submitting it to the server. Javascript doesn't even have support for SHA or other algorithms. But I can think of quite a few ...
Maestro's user avatar
  • 1,183
156 votes
17 answers
22k views

Is the BBC’s advice on choosing a password sensible?

In this article on the BBC’s website they offer advice on how to develop a password. The steps are as follows. Step 1: Choose an artist (a recording artist I presume) Lets choose as an example ...
TheJulyPlot's user avatar
  • 7,829
92 votes
11 answers
16k views

Is there a threshold for a password so long it doesn't get any more secure or even becomes insecure?

I always hear "A long password is good, a longer password is better". But is there such a thing as a "Password is so long it is becoming unsafe" or "Password is long enough, making it longer won't ...
Mindwin Remember Monica's user avatar
61 votes
4 answers
108k views

How secure is 7z encryption?

I have a text file in which I store all my bank details. I compress and encrypt it with 7-Zip using the following parameters: Compression parameters: Archive format: 7z Compression level: Ultra ...
Anmol Singh Jaggi's user avatar
6 votes
6 answers
678 views

How secure is this process for creating passwords?

I've been research into how to be as secure as possible when it comes to password security for online services and websites. Obviously there are some big no no's like using dictionary words, using the ...
Sam Kluender's user avatar
8 votes
2 answers
3k views

How many known time/result combinations does it take to guess a HOTP/TOTP secret?

I thought about "recovering", "determining", "guessing", "calculating" or "reproducing" the HOTP/TOTP secrets when only the outcome (6-digit code + time) is known. In case we can view the live ...
Bob Ortiz's user avatar
  • 6,715
3 votes
1 answer
12k views

How do we estimate the time taken to crack a hash using brute force techniques

A German hacker famously managed to brute force crack a 160 bit SHA1 hash with passwords between 1 to 6 digits in 49 minutes. Now keeping everything constant (hardware, cracking technique - here brute-...
dozer's user avatar
  • 241
3 votes
3 answers
1k views

To lighten server load, is hashing a client-side Argon2-hashed password with SHA-256 on the server-side at least as safe as server-side only Argon2?

I am trying to achieve better security in my authentication system implementation with both server-side hashing and client-side hashing. (See the first reference below for more prerequisite knowledge.)...
Shreck Ye's user avatar
  • 141
23 votes
8 answers
8k views

Is there a way to make a WEP-secured AP uncrackable?

For some days, I was feeling that my Internet bill was booming. Then, I recently found out that a boy near my house was accessing my router to use the Internet. Then, I read some articles how to crack ...
Snake Eyes's user avatar
11 votes
2 answers
63k views

If hashing is one way, why can we decrypt MD5 hashes?

I have read some times that hashing is a one way function, that is you can make the hash of a message, but you can't recover the original message from the hash, just check its integrity. However, if ...
user avatar
9 votes
1 answer
21k views

Bruteforce with hashcat, how to set the mask properly?

Let's say I've an hash of this type: test::::4e45c7bab093d7011e9b3a5df7d9fa88212beac5ac9c8c47:d6ff3373aa353f3b:123456 I would like to bruteforce it using hashcat, but I'm failing to set the correct ...
MeaMelone's user avatar
7 votes
4 answers
14k views

Are files encrypted with 7ZIP vulnerable to password crackers?

A client says they can't accept password-protected PDFs to put in their payroll system, so I have to send them without security. I don't want to send unsecured PDFs via e-mail because e-mail is ...
M -'s user avatar
  • 1,947
35 votes
2 answers
43k views

Why are GPUs so good at cracking passwords?

What is it about GPUs that lets them crack passwords so quickly? It seems like the driving force behind adopting good key-derivation functions for passwords (bcrpyt, PBKDF2, scrypt) instead of ...
Nick's user avatar
  • 455
27 votes
3 answers
8k views

How bad would a partial hash leak be, realistically?

Even though the current recommendation for storing passwords is the usage of a slow key derivation function such as Argon2, scrypt, PBKDF2 or bcrypt1, many websites still use the traditional hash(...
user avatar
14 votes
1 answer
108k views

Forgot password to 7-Zip archive

I think I already know the answer to this question, but I thought I'd ask the experts anyway. A few months back, I created a password-protected 7-Zip archive which housed the source code of a simple ...
Matthew's user avatar
  • 343
11 votes
4 answers
1k views

Why do salts for hashing passwords need to be globally unique, not just system/site-unique?

I was reading an answer by Terry Chia to another question about the requirements for a salt, in which he/she (among others) specified that salts need to be globally unique, but don't go into any ...
Char Star's user avatar
  • 113
10 votes
4 answers
7k views

Password manager vs password book

I have seen a lot of discussion online surrounding whether using password management software is more secure than writing your passwords down on paper and vice versa. However, a lot of this discussion ...
Luke Glazebrook's user avatar
10 votes
6 answers
6k views

What is the best way to calculate true password entropy for human created passwords?

Okay, I know it might seem this has already been beaten to death but, hear me out. I am including a fairly good password strength algorithm for my app for users on sign-up. This one, which I've copied ...
RobbB's user avatar
  • 261
8 votes
3 answers
9k views

File security when encrypting files directly with the openssl command / and what about SHA1 hashing password first?

I've been using this command to encrypt files for a while now: openssl aes-256-cbc -a -salt -in secrets.txt -out secrets.txt.enc Then I type in a password. Can someone tell me, roughly speaking, ...
user21203's user avatar
  • 273
8 votes
2 answers
58k views

How to crack `salt + SHA256(salt + password)` hashes with JTR?

I have a set of password hashes. Here is an example: 9e74437e97ff201ff38416138a22a7f3adfa3b9c10e947481bd94b16eed7df6b6e2806 From the source code of the application generating this hash I learned that ...
golem's user avatar
  • 1,013
7 votes
7 answers
13k views

Is it possible to detect password length from hash? Does doubling your password add more security?

Assuming a service doesn't store a plain text password, am I right in saying that the answer to this question depends on the service? On a bad service, the hash length is related to the password ...
superuser's user avatar
  • 1,151
6 votes
1 answer
28k views

Decrypting SAM hive after Windows 10 anniversary update?

After a lot of frustration, I've finally cracked my local Windows 10 password using mimikatz to extract the proper NTLM hash. In particular, samdump2 decrypted the SAM hive into a list of users with &...
Shuzheng's user avatar
  • 1,267
5 votes
2 answers
27k views

Generate John the Ripper rule

This question asks for pointers about generating JtR rulesets, but the OP states I understand how to use it to make various permutations from a given wordlist Could someone please explain that? ...
serv-inc's user avatar
  • 471
4 votes
4 answers
1k views

Should I vary the length of my completely-random passwords for the best security?

I use LastPass comprehensively, and for each new site/password I almost always have it generate a random password of the same number of characters, allowing letters, numbers, and symbols (except when ...
ErikE's user avatar
  • 157
4 votes
2 answers
3k views

Pattern based password cracking

I need to select a project for this semester. I'm a second year uni student in Ethical Hacking and Countermeasures. My idea was to see if using some kind of pattern based password cracking can be more ...
Juicy's user avatar
  • 1,447
2 votes
2 answers
3k views

Is it a good idea to combine words from different languages to increase a password's strength? [duplicate]

I was thinking of a way to generate a password that is easy to remember, but hard to crack, like the famous "correct horse battery staple" suggested by XKCD, also discussed here, and I've realized I'...
Fabio says Reinstate Monica's user avatar
1 vote
3 answers
12k views

Cracking passwords after a pattern with John

So I am trying to find out how easy it is to crack a password using some great Linux tools. We all know about John as a password cracker and how great it is. But how about specifying a pattern. Let'...
Daniel's user avatar
  • 195
65 votes
5 answers
7k views

Do 2FA sites leak info by confirming a correct password guess?

Here's my relatively layman's view of the issue. Many websites tout multifactor authentication (MFA) as an enormous boost to the security of users' accounts, and it can be if implemented properly. ...
Ben Sandeen's user avatar
56 votes
5 answers
407k views

How to recover a lost zip file password?

I have some files I was given by my teacher at University, I could chase him up, but I may as well try getting blood from a stone, his response rate isn't great and I completed my degree a year ago! ...
bluekeys's user avatar
  • 681
42 votes
1 answer
19k views

How does the attacker know what algorithm and salt to use in a dictionary attack?

I am curious about password cracking methods like dictionary and brute force attacks. Nowadays passwords are stored as hashes and not plaintext on the server. Then how can the plaintext passwords in ...
andjava's user avatar
  • 608
29 votes
4 answers
12k views

Is randomly generating passwords from an assortment of dictionary words cryptographically secure? [duplicate]

We should all know the XKCD comic on password strength, suggesting (appropriately) that a password based on multiple common words is more secure and memorable than a password such as Aw3s0m3s4u(3 or ...
Der Kommissar's user avatar
27 votes
4 answers
7k views

Does putting salt first make it easier for attacker to bruteforce the hash?

Many recommendations for storing passwords recommend hash(salt + password) rather than hash(password + salt). Doesn't putting the salt first make it much faster for the attacker to bruteforce the ...
user avatar
18 votes
6 answers
5k views

Is it a good idea to use non-Latin Unicode characters in a password?

I've heard many suggestions as to what makes a good password (hard to guess, not a dictionary word or permutation thereof, at least a certain length, etc.) so that it cannot be cracked in a realistic ...
user1475412's user avatar
15 votes
1 answer
6k views

Understanding brute-forcing algorithms [duplicate]

I've been reading up on brute-forcing techniques and possible methods of prevention, but there is one issue that I haven't been able to find a clear answer to. The way I understand it, a 'simple' ...
akseli's user avatar
  • 261
11 votes
1 answer
95k views

show previously hacked passwords with John The Ripper

I tried to crack my windows passwords on the SAM file with john the ripper, it worked just fine, and it shows me the password. But when i try to hack the same file again, john just tells me : Loaded ...
Sidahmed's user avatar
  • 679
9 votes
3 answers
9k views

Which is faster - brute-forcing, or using a dictionary attack that contains all possible permutations?

Assuming a 6-character password uses the mixalphanumeric charset, giving each character a character set of 62 and the entire password a keyspace of 62^6 = 46.6 billion (if my calculations are correct)....
Hashim Aziz's user avatar
8 votes
2 answers
20k views

Estimate the time to crack passwords using bcrypt

I am reading on the Ashley Madison password exposure case. Dean Pierce was able to output about 4000 cracked passwords within 5 days given his system. I'm assuming that he generated a table of hashes ...
user2197917's user avatar
8 votes
5 answers
7k views

A password manager a single point of failure. Then why is it so often recommended nowadays? [duplicate]

The conclusion of this article is that to protect passwords in 2017, you need length and randomness. It recommends giving up all little hacks and techniques like turning "o" into 0 in favor of picking ...
Clamdow's user avatar
  • 81
7 votes
2 answers
22k views

Cracking a password Protected pdf file using John the ripper

What exactly happens after I provide the hash from the pdf file to John for cracking the password? Does John extract just the password hash from the file and work on it, or is there something else?
rats20's user avatar
  • 119
7 votes
4 answers
916 views

Password Policy: Issue random generated passwords / Let the user choose a password

I'm currently thinking about a new password policy. Originally I wanted the users to choose a password that is X digits long, contains numbers, special chars, lower and upper case,... but then I did ...
davidb's user avatar
  • 4,343
7 votes
1 answer
5k views

What is "NAND mirroring", the alleged technique that the FBI will use to crack the San Bernardino shooter's iPhone?

According to Ars Technica, Jonathan Zdziarski, a leading independent Apple iOS security researcher and forensics expert, has a theory about the FBI's newly discovered potential route into the ...
William's user avatar
  • 181
5 votes
1 answer
22k views

John the ripper passwd file format with salt not working

I'm trying test password strength in one of our e-commerce sites. I'm using john the ripper to brute-force a password file. The algorithm used by PHP is: $hash = md5($salt . $pass) No other ...
user2253620's user avatar
5 votes
4 answers
1k views

What are possible methods for calculating password entropy?

I noticed there are tons of questions and answers about password entropy on this forum, some even suggesting formulas for calculating it. None did answer my exact question. What are possible or ...
Bob Ortiz's user avatar
  • 6,715
5 votes
2 answers
2k views

Can a weak password generate the same hash as a strong password?

Conventional password advice encourages the use of long passwords with the rationale being hashing the entire password space (rainbow table or brute force) takes longer with each character added. ...
jimp's user avatar
  • 221
4 votes
2 answers
3k views

How does a zip file detect a correct password?

When extracting files from an encrypted zip archive, the user is asked to give a password in order to read the original file. How does an encrypted ZIP detect when the user has given the correct ...
CodyBugstein's user avatar
3 votes
2 answers
617 views

How to choose between password derivation or encryption?

Suppose you use a password manager having all possible features of modern password managers: encryption with a key derived from your master password, auto-filling, cloud or local storage, browser ...
CidTori's user avatar
  • 183
2 votes
1 answer
5k views

Is there any smarter way to crack wpa-2 handshake?

I was testing on my own router that how secure is my password. First I set a random 9 digit number as a password but the aircrack-ng was unable to crack it even in 45 minutes and tried other tools ...
daya's user avatar
  • 177
1 vote
1 answer
5k views

How long to crack an 8 character WPA2 hash if first char is known

I know the first char is A and it's all upper alphanumeric. Is there a way to estimate how long a mid level single GPU using hashcat would take to crack it?
user7668482's user avatar
1 vote
1 answer
2k views

WPA/PSK Dictionaries

I have been reading some articles on WPA/PSK encryption and one said that the hash is calculated like this: Key = PBKDF2(passphrase, ssid, 4096, 256) Where PBKDF2 is a standardized method to derive ...
Ouerghi Yassine's user avatar
1 vote
2 answers
9k views

Brute-Forcing DVWA login page with hydra

I'm learning how to brute force web login pages with a popular brute force tool called "Hydra". I'm using Kali Linux (VirtualBox) to do this. I've installed DVWA (Damn Vulnerable Web Application) and ...
CoderPE's user avatar
  • 11