Questions tagged [password-cracking]
for questions relating to the cracking of passwords and the practices to mitigate against passwords being cracked.
801
questions
0
votes
0
answers
21
views
hydra only tries 16 of the passwords in the txt file [closed]
When I run the command
hydra -l sergeeva_kori -P /home/kali/Desktop/rockyousplit/file00 instagram.com http-get
to crack my own instagram account, it tries some of the passwords and says
1 of 1 ...
1
vote
1
answer
283
views
John the Ripper doesn't identify hash
I have a ZIP file of my gallery that contains images and videos which is over 5GB in size. I forgot the password for that ZIP file now I'm trying to crack it to extract files from there. I tried using ...
2
votes
8
answers
498
views
Will "☺ ¹²³ µ‼µ ÚÛÙ ♥♦♣♠" work as a password?
Will "☺ ¹²³ µ‼µ ÚÛÙ ♥♦♣♠" work as a password? If so, can you give me a password cracker specifically designed to crack non-keyboard characters? If yes, do you think it will crack this one?
- 21
-1
votes
1
answer
233
views
Is there anyway to crack this salted Hash? [closed]
The Task is kind of a CTF task that I was given and I have no idea how to do this.
I had to crack a password on a zipfile and then crack the 3 hashes in the txt file within the zip file. I cracked the ...
- 9
0
votes
0
answers
203
views
John the Ripper not working properly
I am new to JTR and am currently trying to crack some passworts I generated.
Because I am new to JTR, I wanted to start by hashing a simple password like "Cat", write it in a file named pw....
- 1
4
votes
1
answer
775
views
Find password decryption used in MSSQL
I have the 2 encrypted passwords in my MSSQL database and I'm trying to decrypt it. Here's one of the encrypted password:
E4-68-3F-BE-91-CC-BE-B9-27-4B-18-B1-5F-1B-39-66
The password to the above ...
- 143
7
votes
4
answers
9k
views
Is a randomly generated 80-bit password strong enough nowadays?
Theoretical question - Say we have a randomly generated password with 80-bit entropy, stored as a single-round, unsalted SHA256 hash. For a determined attacker with current (2024) technology, what ...
- 73
1
vote
2
answers
209
views
Weak password hash + strong rate limiter = secure?
I have a microservice which sole purpose is to serve as a cache for other microservices. The point of the cache is to speed up processing, but the strong password hash algo counter that purpose. (...
- 13
0
votes
0
answers
168
views
Cracking 1000-password assignment from hashed file
OS: Ubuntu 20.04 on VMWare, tool: John the ripper
The whole system is up-to-date
The file has 1000 hashed passwords. There are 40 rules provided, a small word list is provided to help crack part of ...
-1
votes
1
answer
349
views
bruteforce local software's password
There is a lot of online tools to bruteforce online server like hydra and offline with hashes like hashcat. Yet it seems very weird that there is not a single offline bruteforcing app for software. ...
0
votes
1
answer
168
views
FFUF command returns status code 400, regardless of mode option: clusterbomb, pitchfork, sniper
I'm working on a lab on PortSwigger.com titled Username enumeration via different responses. While using ffuf to solve the lab, the output keeps returning a 400 status code.
So far this is what I've ...
- 103
1
vote
0
answers
101
views
What's the most simple approach to this wordlist generation and ruleset problem?
This is a password recovery project, which is more complex than just generated a wordlist, since using my tries (see below) it seems to be not enough to just generate a wordlist.
I'm trying to recover ...
- 1,633
0
votes
0
answers
664
views
How can I understand the zip2john hash format?
I had a .zip file that was apparently encrypted with AES-256 deflate.
7z l -slt archive.zip | grep Method
Method = AES-256 Deflate
Then I used zip2john to get a "hash" out of it:
archive....
2
votes
1
answer
293
views
John the Ripper - Zip Password help - Latter half digit command advice
I'm trying to use John to recover some old ZIP files with a password I remember half. One half being a word, the latter half being a mix of four to six digits.
I remember the word, but not the digits ...
- 21
1
vote
0
answers
2k
views
How to crack KeePass database when knowing the first part of the master password [duplicate]
I have a KeePass 2.47 database which is protected with a master password and a key file.
I managed to lose the 2nd part of my master password. So, I have access to the database, the key file and the ...
- 111
0
votes
1
answer
935
views
How to create a hash file of a .dmg file for use in JTR?
I have a .dmg file on my MacBook. I have forgotten the password of the .dmg file and now I'm not able to access the files in it.
I tried using John the Ripper. However, whenever I run john --format=...
- 1
1
vote
1
answer
773
views
john the ripper tool - how to combine wordlist with incremental modes?
In hashcat, when we need to crack password based on wordlist, but additionally want to try partly bruteforce random ASCII characters in the end of any entry from the wordlist, we can use the following ...
- 13
0
votes
2
answers
204
views
Is there any good way of calculating a brain-generated password's entropy?
After reading this post, I understand that a password's entropy depends on the assumptions made when it is to be attacked (e.g. if it is generated randomly from a list of 2048 words, etc.).
Let's ...
- 165
24
votes
4
answers
7k
views
Does a password policy with a restriction of repeated characters increase security?
A security value called Restriction of Repeated Characters for Passwords (QPWDLMTREP) can be configured in IBM i. If QPWDLMTREP has a value of 1, then "the same character cannot be used more than ...
- 359
1
vote
1
answer
2k
views
Cracking WiFi credentials without handshake or PKMS
How can I crack WiFi credentials WITHOUT using the traditional method of capturing a PKMS or Handshake?
When I connect to a WiFi network, I simply enter a password into a text box just like any other ...
- 31
3
votes
2
answers
3k
views
How can I identify the salt value used in a password hash?
I'm currently learning about password cracking, and I have a set of passwords with their respective hash values. I used Hashcat to crack the hash values, just to see how it works, but I got different ...
2
votes
1
answer
4k
views
Why does Hydra SMB attack not work while Metasploit does?
I'm learning about password attacks, and doing TryHackMe labs.
User: penny
Pass: leo1234
When using Hydra to find the password for the SMB user, I get no valid results:
I know the valid password is ...
- 23
0
votes
1
answer
1k
views
How long would it take to crack hashed password stored in plain sight?
I want to store a password hash in plain sight. If I am using a dictionary to crack an Argon2 hashed password that I am storing in plain sight, how long would it take (assuming my password is ...
0
votes
3
answers
212
views
How to analyze the security of a custom passphrase?
Let's assume person A chooses 15 words for a passphrase with an average length of 5. The passphrase meets following conditions.
Word conditions:
The first word is not a valid word and can't be found ...
- 56
0
votes
1
answer
145
views
How do password protected files differ from keygen protected software?
From some posts I read here:
Regarding keygen protected software:
As long as the user has full control of the hardware where the software is running on (i.e. typical PC) it is impossible to fully ...
- 3
0
votes
0
answers
988
views
Cracking an MD5 password with little info to go off of
I am taking a security class and part of an assignment this week is to crack a given MD5 hash.
All the professor has given us for this task is the hash, the knowledge that the password is 6 or 7 ...
- 1
0
votes
1
answer
3k
views
Cracking password when knowing the length and the containing letters in relation to digits
Say I want to crack the password of a specific database account, beforehand I know the length of the password and amount of letters in relation to digits, for example LLLLDD (6 in length containing 4 ...
0
votes
0
answers
249
views
Variant of words for John
Is it possible to specify a mask (of sorts) on the command like with John the Ripper where most of the words are known (but not the permutations used in the passphrase)?
Example: If part of the ...
- 1
-1
votes
1
answer
309
views
How can you calculate the entropy of arbitrary password rules with known distributions? [duplicate]
Many online entropy calculators make certain assumptions (like assuming a password is as rare as the set of random characters that will generate it), or handwave away the math. I want to know how to ...
0
votes
1
answer
481
views
How to use a logical OR in Hashcat rules
I'm currently trying to crack a password-hash in hashcat.
But I'm facing a problem and can't figure out how to solve it.
I have to substitute the same char with a different rule sometimes (something ...
- 1
0
votes
2
answers
1k
views
Whats the difference between secret and password managers?
Are there fundamental underlying differences in how secrets and passwords should be managed?
I'm curious of the technical/cryptographic differences between secret managers and password managers are. ...
1
vote
0
answers
42
views
Open Veracrypt container (password+keyfile) without password? [duplicate]
I lost my password for encrypted disk.
Is there a way to do something without dumb cracking?
Maybe recovery mode? Because I just lost 50% of my auth data...?
- 11
15
votes
4
answers
8k
views
Can 777-characters long passphrase be considered too short?
Is Rumkin.com's password tool a reliable tool for password strength checking?
I am asking because:
I am getting confusing suggestions:
(the password in this example is 777 characters long)
D. W.'s ...
- 3,669
3
votes
3
answers
602
views
Why removing just one letter form passwords makes it 20x easier to break according to zxcvbn test
Since I am a decent fan of the XKCD no 936 (or actually conclusions and implications it brings), I wanted to test (using try zxcvbn) the complexity and the possiblity of breaking a password like the ...
- 3,669
1
vote
2
answers
146
views
exploiting the scenario and how to generate a secure reset password token
I am using the following line of code to create a reset password code sent to the user in her/his email. when scanned with brakeman to my ruby code, this line of code is catched and describes it as it ...
- 131
0
votes
1
answer
3k
views
John The Ripper succedeed in finding password without printing it
Some days ago I tried to found the password of a file encrypted with AxCrypt 1.x.
I tried John The Ripper and HashCat, but for unknown reason with the last one I failed, and I will open a new thread ...
user285664
3
votes
0
answers
342
views
Can hashes labeled 'lm' in SAM database mimikatz dump be another type than (NT)LM?
When I dump the password history hashes stored in the SAM database with mimikatz lsadump::dcsync tool, for every i'th password (re-)set by a SAM account there are two hashes stored by Active Directory ...
3
votes
2
answers
2k
views
Brute forcing lost password for PGP encrypted file (symmetric)
I have a file I encrypted with PGP in 2003. It contains some personal data I'd like to regain access to. I have vague idea of the password, but not enough to successfully guess; but I know its ...
- 31
1
vote
0
answers
89
views
Blank decrypted Windows 10 passwords [duplicate]
I'm getting hashes from Windows 10 SAM using samdump2, then pass this to John the Ripper, with the --format=NT and --show arguments, and get:
username::1001:aad3b435b51404eeaad3b435b51404ee:...
- 11
1
vote
0
answers
251
views
"john --format=axcrypt" is not returning results
I would like to open a mysterious old file that I found on my Hard Disk, the contents of which I do not know nor can I guess from its name (PB-mp4-rar.axx).
The file was password-protected with the ...
user285664
1
vote
0
answers
445
views
Cracking passwords following rules with John or hashcat
I would like to crack the forgotten password of a very old archive file (rar) with JTR or hashcat.
I remember it was starting with a certain number from a set of numbers e.g.
prefix number from the ...
- 11
0
votes
0
answers
26
views
How do I report that the organization is using common passwords for the backend [duplicate]
I was surfing on a big company's website, and I tried to make an account on it. I found that the account registration was quite buggy so I checked the page source. I found that there were error logs ...
- 101
10
votes
6
answers
6k
views
What is the best way to calculate true password entropy for human created passwords?
Okay, I know it might seem this has already been beaten to death but, hear me out. I am including a fairly good password strength algorithm for my app for users on sign-up. This one, which I've copied ...
- 261
0
votes
0
answers
20
views
How to decrypt windows password with SAM and SYSTEM files? [duplicate]
Suppose we have access to SAM and SYSTEM file, I want to decrypt the password. I'd like not to use any third-party software and write my own algorithm. Is there a way to do so?
- 101
2
votes
1
answer
5k
views
kali linux encrypting passwords with yescrypt - how to change?
I'm using John The Ripper for password cracking and adding new users/passwords to test it out. When I create a new user and password, the hash starts with $y$ which is from yescrypt. When testing a ...
4
votes
1
answer
1k
views
Practicality of outsourcing password hashing using enclaves
I've been pondering some potential cybersecurity applications for enclaves. One of them being the problem of password hashing.
Some clients have enclave support, meaning part of their CPU can securely ...
- 280
1
vote
1
answer
261
views
How long "digits-only recovery code" is secure enough?
I'm implementing encryption in one of my webextension which will encrypt locally stored data.
I have a single master CryptoKey (AES-GCM) that encrypts everything.
And this master key is then encrypted ...
- 113
0
votes
0
answers
35
views
Does having the hash make it easier to crack the password than not having the hash? [duplicate]
For example, a password hash is: edgjcgo4866864rfhobd38790g764hkp
Does having the hash of the password make it easier for the attacker to crack the password than not having the hash?
If yes, why does ...
0
votes
1
answer
140
views
Cryptographic hash functions and personal password management [duplicate]
Background: I've always reused same username/password on all websites and got hacked regularly. I am considering using a password manager, but I don't like the need of storing a database. So I came up ...
- 103
1
vote
2
answers
1k
views
Is it unsecure to use only a passphrase in luks for whole system partition encryption?
When I use only a passphrase in LUKS for my whole system partition encryption, so I need to insert a password to decrypt my system partition to boot up my OS, is this unsecure and can it be cracked ...
- 129