Questions tagged [password-cracking]

for questions relating to the cracking of passwords and the practices to mitigate against passwords being cracked.

Filter by
Sorted by
Tagged with
4
votes
2answers
94 views

Is this (explained in body) a possible attack vector when using haveibeenpwned API?

I'm currently working on understanding and contemplating to implement password strength validation for sign ups in my app, to include checking haveibeenpwned if entered password is compromised ...
0
votes
1answer
50 views

Very beginner question about JtR

I Have lost my zip file password and I tried to recover it with Windows 10, using John the Ripper 1.9.0 Jumbo. Things I know from this password: 9 to 11 characters Alphabetics A B E F and a b e f (...
0
votes
0answers
54 views

Recent research on custom hardware to break RSA-1024

In 2003, Adi Shamir and Eran Tromer proposed an ASIC device called TWIRL, which should be able to sieve RSA-1024 using the General Number Field Sieve during a year, "only" using 10-20M$ of investment ...
0
votes
0answers
26 views

Recovery of files from a zip containing a directory (unencrypted) and 3 files (encrypred - ZipCrypto Deflate), possibe use of bkcrack?

I have a zip file, Example.zip consisting of a directory Example and three files *.dat. I can see the names of all 3 files. The dat files are encrypted (ZipCrypto Deflate). I'm interested to know if I ...
1
vote
1answer
79 views

Crack windows excel password

I have many password protected microsoft excel worksheet and I need to be able to edit it. I have forgotten the password, and I know that I can edit the file and take out the password check, but I ...
-1
votes
0answers
35 views

Bruteforce password hash in crypt format

I recently lost a password to a Linux box, luckily due to various reasons I had manually set the password after generating it with openssl passwd -crypt and I still have this generated string. Would ...
2
votes
1answer
102 views

Why do PDFs contain password hashes?

Reading this question about extracting PDF password hashes to feed into john the ripper has me wondering why password hashes are in a PDF in the first place? Shouldn't it be using the supplied ...
0
votes
0answers
91 views

PMKID found , but it should be WPA handshake

i was trying to get access in wifi network but i came to something that i need to ask afteraireplay-ng –0 20 –a [router bssid] –c [client bssid] wlan0mon i expect WPA handshake in right top ...
0
votes
1answer
71 views

What vulnerabilities would this type of “password manager” have?

When I was searching for a password manager to use I stumbled upon the concept of Master Password which instead of encrypting and saving your passwords, generates them by using your master password ...
-1
votes
2answers
181 views

How secure is a 24 character mysql password?

I recently set up my WordPress blog and I changed the password of its mysql database to a 24 character randomly generated password. I have a few questions about the database: Is my database name ...
0
votes
3answers
221 views

If my password is not on rockyou.txt does it mean that is a good password?

I have been wondering if all my online and wifi passwords are complex enough. So to test this I was checking if the password was already present on the rockyou.txt wordlist. If the password is not ...
0
votes
2answers
69 views

Is chain hashing algorithms the ultimate solution for hashing passwords?

Let's say I my password is a simple password, 123456 Then if the database was exposed, if the password was: -- stored in plain text -> cracked -- stored it hashed with no salt -> prone to rainbow ...
2
votes
2answers
102 views

Can you help me with some misconceptions about bcrypt and salting?

I researched password hashing and cracking and I have some misconceptions: First rule of thumb to create a strong password is to use 10+ combination of digits/upper/lower/symbols to prevent brute ...
0
votes
1answer
50 views

JtR Password hash not recognized

I am attempting to encrypt some passwords by hand to use in a project with JtR. Unfortunately, the program is having difficulty recognizing the hash types of the passwords after hashing them. ...
2
votes
2answers
135 views

What wrong with this system to proactively check if customers' passwords have been found in a breach?

Let's say that during account creation, I already prohibit passwords known to be reused from breaches of other sites, like if it's in the Have I Been Pwned list. But breaches happen all the time, so ...
3
votes
3answers
415 views

Have gotten a blackmail email with a password of mine - what to do? [duplicate]

I've gotten the following email today (the password has been changed; and the Greek characters are reproduced verbatim): Your ρasswοrd is REPLACED. Ι kηow α lot more τhngs about you τhaη τhαt. ...
2
votes
1answer
55 views

Why does pwdump7 retrieve LM hashes even though they're disabled?

I'm currently undergoing a penetration testing certification, where I'm asked to : Set up a fully-patched Windows 10 Pro VM (done) Retrieve local password hashes from the SAM database using pwdump7 ...
0
votes
2answers
112 views

How to properly calculate password entropy

I am very confused with calculating password entropy i know that the formula is E = log2(RL). where E is password entropy, R is the range of available characters, and L is the password length. but ...
0
votes
1answer
108 views

How to approach Web App? [closed]

I'm doing testing on the app, if we take only login url as a starting point. How to expand my horizons? I want to make my surface wider, really kinda stuck on this one.
3
votes
1answer
95 views

What advantages does it have if a password manager locks the DB automatically on locking the computer? Disadvantages of turning it off?

When I unlock my PC the password manager (any type) needs the password again to unlock it's DB containing passwords. I was wondering what the benefit is in that, as my computer is locked anyway. ...
0
votes
0answers
72 views

John the ripper - ecryptfs - sample not cracked: 0 password hashes cracked

I tried to use john the ripper on the sample : ecryptfs_sample_metadata.tar (password is 'openwall') Which I downloaded from here: https://openwall.info/wiki/john/sample-non-hashes If i try sudo ...
-1
votes
1answer
129 views

wifi cracking using a network adapter which doesn't support packet injection

I'm trying to crack my wifi (WPA-CCMP) password to test its strength and security, I'm using the commview for wifi and aircrack-ng software on windows 10. I've three laptops, Windows 10 (64bit) with ...
2
votes
1answer
283 views

Security of PIN that spells out words?

Description PayPal suggests that generating a PIN by spelling words (on a numeric pad, e.g., [ABC] = 2) is a good method for security and memorability, e.g., B-L-U-E-C-O-W = 2583269. My knowledge ...
0
votes
0answers
24 views

Passphrase Cracking Dictionary [duplicate]

I have been discussing this tweet https://twitter.com/marcan42/status/1238125727855206400 and the conversation around it with some folks on an encryption module I am doing as part of a cyber security ...
34
votes
5answers
6k views

Does it matter if a brute force search for a password returns a collision and not the password?

Assume the following very basic hashing algorithm. h(k) = k mod 17 Let's say we create a password 12345 for a website that uses this very basic hashing algorithm. That would yield the hash of 3. ...
1
vote
1answer
75 views

PDF User Password always give access to the Owner Password, even when encrypted with AES-128

I've been messing around with qpdf, and noticed something that seems huge: that a document's Owner Password is essentially useless, as it can be easily unset, and therefore that only the User Password ...
0
votes
1answer
57 views

How to determine the type [duplicate]

Today I discover a encryption method Which 0 = 35 1 = 34 2 = 37 3 = 36 4 = 31 5 = 30 6 = 33 7 = 32 8 = 3d 9 = 3c It's the encode of number 1 to 0 for the method Can you please help me to ...
1
vote
2answers
126 views

How can wireless password cracking be detected?

Our team was hired for a red team engagement for a client. A part of the engagement is attempting to crack the WiFi passwords of their office APs. However, we obviously want to stay undetected. What ...
0
votes
1answer
107 views

Cracking less than 4 letter linux password using john

I am trying to crack a less than 4 character Linux password using john. I unshadowed my password into file.txt I use the following command: john -incremental file.txt the output is: 0g 0:00:00:04 ...
0
votes
0answers
98 views

Generate every alphanumerical combination in crunch within 8-20 characters in length

I want to generate combinations in sequential range of the length 8-20 with the following characters: abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ1234567890!@#$%^&*()~`";.,/[]-= How ...
0
votes
0answers
53 views

Issue using John The Ripper

First things first, I'm a newbie so, bear with me... I created a word list with a combination of a possible password for a certain user using Crunch (it's the dictionary output) and need to use John ...
0
votes
0answers
76 views

How to crack rar file with protected pass with only the AES-256 key?

I have rar with protected pass.But I have the AES-256 key can I crack it and if I can. how?
0
votes
1answer
343 views

How to recover lost zip file password?

I have a folder with very important files on my computer and I zipped it with a password for security reasons. Unfortunately, I'm not able to recover the password. Usually, I always use the same kind ...
0
votes
0answers
85 views

Mimikatz Windows 10 password recovery

I'm trying to log into my Windows 10 laptop that was using a Microsoft login. I used to mimikatz to retrieve the SAMkey, LSA secret, dpapi, System masterkeys, and the password hash but it's the ...
0
votes
0answers
646 views

Unable to start hashcat in mode 13600 WinZip : Separator Unmatched

I have a zip file containing a JPEG image of size 3.5 MB, encrypted with AES-256. I used WinZip for the creation of the zip file. In order to create the hash of the zip file, I used John The Ripper's ...
2
votes
0answers
271 views

How to “unprotect” malicious workbook without knowing password

Right now I'm looking at an office document (most likely rtf based on it exploiting equation editor) that opens just fine when you double click it, but on further examination in a hex editor and in ...
0
votes
4answers
450 views

Password hashing that is resistant to ASIC-assisted cracking without risking DoS of server

Previously, authentication systems stored passwords in cleartext. This made it trivial for an attacker to log in to an account if he had access to a leaked password file. Later, passwords were hashed ...
0
votes
0answers
53 views

Storing safely files in the cloud - what is the current state of the art encrpytion method for it?

What is considered as safe method to store files in the cloud currently and in the future (quantums) so that no potential hacker could open the file? Which current encryption methods to use for it to ...
2
votes
1answer
169 views

If my protonmail password is compromised, does that potentially mean that my whole account is, permanently?

My (limited) understanding is that my password is used to encrypt the keys which are used to encrypt my mail messages on protonmail's servers. Does that mean that knowledge of my password could ...
2
votes
3answers
12k views

How do i crack an id_rsa encrypted private key with john the ripper

I am trying to crack a password protected id_rsa, with john the ripper. But it doesn't find the correct password for some reason. I have create a new user and generated a new id_rsa with ssh-keygen (...
1
vote
2answers
162 views

Approximately how much entropy/security is lost by typing passphrase words using a number pad?

For context, the coldcard hardware wallet has a number pad as input. In order to maintain my sanity, I'd like to input an alphanumeric passphrase using a single keypress for each letter or number. ...
2
votes
0answers
21 views

How can I crack WPA2 hash with some limitations? [duplicate]

I want to crack an 8 character password, but I know this password doesn't contain more than 4 symbols, 4 uppercase letters, 4 lowercase letters and 4 numbers, and it contains at least 2 symbols, 2 ...
18
votes
3answers
5k views

Does revealing part of your hash give an attacker advantage when attacking your password? [duplicate]

This question was prompted by a recent visit to a certain site that provides (apparently for GDPR reasons) a table with all of your data, including part of your hashed password. I understand this ...
2
votes
1answer
218 views

Is better to have as password a sentence or first letter of the sentence?

Which is better master KeePass password to prevent any type of bruteforce between theses two type of password : Complete sentence invented by user like : I like cheeseburger, tomatoes and fries ! :) ...
6
votes
2answers
525 views

Crack passwords hashed with PHP?

Is this the right way to crack a password hashed with PHP? I used the password_hash function to hash a password (PHP version 7.3). Then I created a word list using a Python script. It's around 1GB in ...
0
votes
0answers
30 views

Cracking zip password [duplicate]

I am trying to decode a zip file password decoded form of: %3C%7C%3D3r%28Strong%29 I have tried to convert in to MD5 hash and use john the ripper to crack the password. Can someone explain how to do ...
-2
votes
1answer
160 views

Is there a way to hack your Facebook account back? [closed]

I think that from title it's pretty obvious what I'm trying to do. My Facebook account has been hacked, as it's using e-mail from whom I've forgotten password I can't get it back. I'm not using this e-...
-1
votes
1answer
92 views

Calculating Time for a Attack on Password Hashes [closed]

Suppose I have a database containing hashes. Hashes are obtained from password developed from randomly chosen set of 94 characters such that each password size is of 8 characters. So we have 94^8 ...
17
votes
10answers
11k views

Crack hashed passwords using a known password

I'm a dev trying to deploy a new dashboard I've written at work, the old one is a mess of hacked together libraries and only about half of the codebase is still even in use (dead code everywhere that ...
0
votes
0answers
525 views

John the Ripper Custom Dynamic Hash Function Usage

I have created a custom dynamic hash function comprised of a series of different existing hash functions chained together. I'll spare you the exact details because it's for a class assignment. I've ...

1
2 3 4 5
13