Questions tagged [password-cracking]

for questions relating to the cracking of passwords and the practices to mitigate against passwords being cracked.

Filter by
Sorted by
Tagged with
0
votes
1answer
67 views

Guessing speed in offline password cracking [on hold]

What is the current speed an offline password cracking attack can be performed in guesses per seconds? It is for sure heavily influenced by the used hashing-algorithm and the used hardware. But I am ...
0
votes
0answers
52 views

How can I recover an important gmail password that I've forgotten [on hold]

Forgotten a gmail account that I'm using to apply for grad jobs. Im waiting on several emails back but got locked out of the account. is there any program that or way i can use to try and recover it. ...
-1
votes
1answer
45 views

Is it beneficial to know the first char of a wpa2 hash [duplicate]

All I will need to check is AAAAAAAA - AZZZZZZZ. So I will only have to check the A's but will checking the A's be faster knowing the first char , I can't see why it would be as it would have to ...
1
vote
1answer
194 views

How long to crack an 8 character WPA2 hash if first char is known

I know the first char is A and it's all upper alphanumeric. Is there a way to estimate how long a mid level single GPU using hashcat would take to crack it?
0
votes
1answer
88 views

Security of adding letter in front of passphrase [duplicate]

I am wondering about the security of adding a letter in front of a long passphrase to help me have different passphrases for each site I use while not requiring me to remember several different N word ...
0
votes
0answers
19 views

60 character hex encrypted value with 32 character hex seed [duplicate]

Attempting to recover lost admin passwords from an old industrial control system database. We believe these have been encrypted rather than hashed (at least we know password version 0 for this system ...
1
vote
1answer
103 views

Combined-Dictionary attack with hashcat, for 4 words passphrases?

Reading the new advice on password which seems to spead easily (at least in my workplace), I was wondering how to use hashcat for cracking four-word password hashes? Say I have this hash ...
0
votes
1answer
125 views

Is a thousand character password worth the security on my personal accounts? [duplicate]

As for now: don't care about user experience, meaning that time spent reading, typing, memorizing password. not thinking about quantum computing attacks. 8 characters good, 24 characters better, ...
29
votes
6answers
5k views

The most secure way to handle someone forgetting to verify their account?

Suppose we send out email verification to new subscribers that where they have to click on a link to verify their account. Suppose they forget to verify it, and later try to login. Should the error ...
0
votes
1answer
95 views

Lost RAR password, is there any way to access my data? [closed]

I lost my winrar password of my file. I need to access it. Is it possible? If yes, how?
4
votes
1answer
133 views

BIOS Password vs. BitLocker Pre-boot PIN

I'm attempting to ensure maximum security for my PC. I'm running Windows 10 Pro on a business-class HP notebook. Unless I'm mistaken, I understand that both a BIOS password and the BitLocker pre-boot ...
2
votes
1answer
98 views

Does knowledge of one or more passwords from my password manager help an attacker crack the master password?

I use a keepass password manager with a master password of more than 100 bits. I keep the password file in cloud storage. If an attacker has my password file, it should be difficult for them to ...
55
votes
9answers
13k views

Are randomly-generated passwords starting with “a” less secure?

I generated a password recently for a new account and the first three characters were "aa1". After exhausting all other attacks, a cracker would start brute forcing. On the assumption they'd start ...
0
votes
1answer
39 views

Can't figure out input format for Hashcat salts with odd characters in salt

I have passwords that are stored by: Generating a random, 36-character "string" in the range of CHAR(1) to CHAR(256) Appending this to the entered password Retrieving the SHA512 hash of the result ...
2
votes
2answers
74 views

Does the use of a Hardware Security Module improve the security of a password storage?

Basic Assumptions Let us assume I work for a company, which aims to authenticate users using traditional usernames and passwords. The company currently uses a slow key-derivation function to hash ...
1
vote
0answers
58 views

When knowing an individual's plaintext password history, how much information is expected to be gained with a new password? Do we know this?

The premise: Knowing a persons password history should provide information to help when guessing a new password of theirs. At an extreme end, with a password history of wildcats, wildcats1, then ...
2
votes
1answer
96 views

How long are password hashes stored locally?

Suppose Alice logs into Windows machine M (which is part of an enterprise network managed through Active Directory). My understanding is that M will contact the domain controller to get Alice's ...
0
votes
1answer
265 views

Estimating Password Cracking Speed Based on GPU?

I was wondering if there was a calculator or formula I could use to find a rough estimation of the time it takes to crack hashes based on GPU. I am trying to assess how much performance I would lose/...
63
votes
1answer
13k views

I found a password with hashcat, but it doesn't work

My assignment required me to find the password for a PowerPoint file (97 - 2003, v. 8.0 - v. 11.0). I used office2john.py to retrieve the hash, and I removed the file name. The hash is: $...
0
votes
0answers
73 views

Where are NTLM and LM hashes stored in a password protected microsoft presentation file

I have a password protected presentation file (MS office 2003). My assignment required me to either remove the password or find it. In my research i found out that presentation use ntlm and/or nt ...
27
votes
4answers
6k views

Does putting salt first make it easier for attacker to bruteforce the hash?

Many recommendations for storing passwords recommend hash(salt + password) rather than hash(password + salt). Doesn't putting the salt first make it much faster for the attacker to bruteforce the ...
26
votes
3answers
6k views

How bad would a partial hash leak be, realistically?

Even though the current recommendation for storing passwords is the usage of a slow key derivation function such as Argon2, scrypt, PBKDF2 or bcrypt1, many websites still use the traditional hash(...
0
votes
1answer
49 views

How to make John the Ripper output example hashes for a given hash type?

Is it possible to make John the Ripper output example hashes for a given hash type given by the --format= option? This is possible using Hashcat, but currently I look in John the Ripper's source code ...
9
votes
1answer
3k views

What local resources are used when bruteforcing a remote service?

What pc resources are used when bruteforcing ? I mean bruteforcing something online, not hashes. Do you need a good amount a RAM and a good CPU or it's just about the internet speed ?
3
votes
1answer
204 views

Crack 8-char password with known number of set bits

At University, I got some CTFs to do for my security lectures. Basically, I need to crack an 8-character password (96 possible characters). I know that 42 of the 64 bits are set to 1 and I know the ...
0
votes
1answer
110 views

Limiting the number of duplicate character types in crunch

I'm trying to generate a password list of 10 character passwords containing only a combination of 3 - 6 numbers and 3 - 6 uppercase letters. I see option -d which allows a set limit of duplicates of ...
0
votes
1answer
119 views

Generating passwords with rule: the contents within a 10 characters string must maintain a certain ratio of numbers and letters in no particular order

I'm playing around with Kali and am looking to crack my WPA2 default password. I started generating 10 character passwords with a charset of solely digits and upper alpha lastnight and after 10 mins, ...
1
vote
1answer
77 views

Is there any methods available other than brute force and dictionary attacks?

I am curious to know about the wifi attacks. And I have known a little bit about brute force attack and dictionary attack. Is there any other methods available other than these two...?
1
vote
1answer
129 views

Using BITMAIN AntMiner L3+ for cracking password [closed]

I want to use a BITMAIN AntMiner L3+ miner to crack passwords. How can I do that? Can I install hashcat agent to L3+ ?
0
votes
0answers
62 views

Cracking Zip File Password Encryption [duplicate]

Hey all I am currently taking a computer security course and while doing some research in cryptography I found that it was possible to crack the encryption of a password protected file in an encrypted ...
1
vote
1answer
85 views

Will SIM‐like PIN on website as second password increase security

On SIM cards, which are used in mobile telephony, PIN (and PUK) is used. Unlike a password, they are locked after some incorrect attempts to prevent brute force attack. If wrong PIN is entered 3 times,...
0
votes
0answers
18 views

Security risks in confirming the username instead of confirming the username and password combination [duplicate]

Most of the login pages like Google, Outlook and Yahoo! confirm the username first and then ask for a password instead of confirming the username and password combination altogether. Isn't it less ...
3
votes
2answers
278 views

Is haveibeenpwned (HIBP) free and reliable? [closed]

I have just started to explore HIBP to check whether we can use HIBP in our public facing interfaces. AS per my read I have 3 options to check out. Download the password dictionary and implement my ...
5
votes
1answer
144 views

Do ciphers and encoding schemes make passwords more secure?

I recently came across a tech professional advising a user to take some plaintext of their choice, run it through one of these ciphers, convert it to Base64, and then use the result as their master ...
0
votes
1answer
47 views

Specify Amount of type of character Crunch

I'm sure these questions pop up a lot, but I can't find one that does what I'm looking for. So, I'm trying to use crunch to generate a wordlist with specific amounts of each type of character, i.e. 2 ...
0
votes
0answers
81 views

Convincing client to drop password validation rules

My client wants to include some rules to validate the passwords his clients can choose when creating a new account. Since his company handles sensitive client data, I think I want to convince him to ...
0
votes
1answer
199 views

Benchmark Password Cracking Tools

I want to perform a benchmark for the most popular offline password cracking tools (john the ripper and hashcat)? What metrics or approach should i take about benchmarking in order to determine what ...
19
votes
2answers
2k views

Store Credit Card Information in Password Manager?

For convenience purposes I manage my passwords with the password manager Bitwarden on my personal computer and smartphone with autofill function (but with asking for the master password or fingerprint ...
0
votes
0answers
52 views

John the Ripper: OpenMP mode vs using the “--fork=N” option?

Clang on OSX doesn't support OpenMP by default, so I could not compile JtR with OpenMP support without another Clang installation. However, after looking at the below option, I wonder what the ...
0
votes
1answer
105 views

Can't detect hash type even if I have the password?

I can't found the hash type used in a database hosted in a VM. My hash is c39e02416d974229752c28d7fcefe6e1, and my password is "azerty123456". I noticed that the user table has a column called ...
-1
votes
1answer
1k views

hashcat - cracking a salted sha256

Given a SHA512 hash, a salt, and username I am trying to crack the hash using hashcat. Every example I've found used a hashfile as input, is there way to provide salt and hash via commandline without ...
3
votes
1answer
164 views

Could a cracked password run as a command on the attacker's system?

I recently was made aware of 6 passwords that I use becoming compromised in data leaks, and they are now exposed in plain text. I don't know how attackers go about cracking passwords or how they ...
3
votes
2answers
197 views

Is password dependent iteration count a good practice?

I consider the possibility of improving password security by increasing the hashing iteration count for short passwords. The security benefits I see of this practice are: Short passwords are better ...
0
votes
1answer
3k views

Crack password protected zip file with pkcrack

I have allfiles.zip contains only file allfiles.exe and is password protected. I heard about pkcrack, it is possible to get the file from a zip file which is encrypted if we have some part of ...
-1
votes
1answer
104 views

Best tool for cracking SHA-1s with unique pre and post salts? [closed]

I can't find a tool that supports cracking SHA-1s with different pre and post salts. Any suggestions?
0
votes
1answer
106 views

Question about birthday attack on password

Based on birthday attack, you need to generate at least 2^n/2 of possible combination to have 50% chance of finding a password. I have a list of 3000 random password make from 16 characters of upper, ...
1
vote
1answer
163 views

AES, RSA, ECC Key size [closed]

It is generally said that 2048-bit RSA keys are roughly equivalent to 112-bit symmetric keys and 2048-bit RSA keys are "sufficient for commercial use until around the year 2030" (https://security....
-3
votes
1answer
76 views

Finding encryption type of hash [closed]

Is it possible to find encryption type of a hash with a salt? I have my other password in same encryption type, with the hash from that and the password, if that helps. $2y$10$...
1
vote
1answer
77 views

Multicore hacker tools?

Have a school project coming up in multicore programming. I'm interested in/have used hacking tools alot before, and was wondering if there were any good tools out there that could benefit from being ...
1
vote
1answer
147 views

Do I understand SHA-1 brute-forcing speeds correctly? (Firefox Password Manager)

I read that the Firefox Password Manager has a "bug" (or rather poor design) in that it uses only a single sha-1 hash iteration for the password (which makes it extremely easy to brute-force ...