Questions tagged [password-cracking]

for questions relating to the cracking of passwords and the practices to mitigate against passwords being cracked.

Filter by
Sorted by
Tagged with
3
votes
1answer
5k views

Using hashcat in order to crack the JWT signature in WebGoat

I've recently started to practice my penetration testing skills and I got started with WebGoat. I got to the "Authentication Bypass" chapter, to the JWT Token cracking. WebGoat presents this JWT ...
1
vote
1answer
240 views

Using BITMAIN AntMiner L3+ for cracking password [closed]

I want to use a BITMAIN AntMiner L3+ miner to crack passwords. How can I do that? Can I install hashcat agent to L3+ ?
0
votes
0answers
66 views

Cracking Zip File Password Encryption [duplicate]

Hey all I am currently taking a computer security course and while doing some research in cryptography I found that it was possible to crack the encryption of a password protected file in an encrypted ...
0
votes
0answers
18 views

Security risks in confirming the username instead of confirming the username and password combination [duplicate]

Most of the login pages like Google, Outlook and Yahoo! confirm the username first and then ask for a password instead of confirming the username and password combination altogether. Isn't it less ...
2
votes
2answers
17k views

Password cracking speeds according to Hashcat

from the site: http://www.netmux.com/blog/how-to-build-a-password-cracking-rig - they used 4 GPUs: Hashtype: Keepass 1 (AES/Twofish) and Keepass 2 (AES) Speed.Dev.#*.....: 416.5 kH/s Hashtype: ...
3
votes
2answers
344 views

Is haveibeenpwned (HIBP) free and reliable? [closed]

I have just started to explore HIBP to check whether we can use HIBP in our public facing interfaces. AS per my read I have 3 options to check out. Download the password dictionary and implement my ...
5
votes
1answer
149 views

Do ciphers and encoding schemes make passwords more secure?

I recently came across a tech professional advising a user to take some plaintext of their choice, run it through one of these ciphers, convert it to Base64, and then use the result as their master ...
0
votes
0answers
85 views

Convincing client to drop password validation rules

My client wants to include some rules to validate the passwords his clients can choose when creating a new account. Since his company handles sensitive client data, I think I want to convince him to ...
0
votes
1answer
359 views

Benchmark Password Cracking Tools

I want to perform a benchmark for the most popular offline password cracking tools (john the ripper and hashcat)? What metrics or approach should i take about benchmarking in order to determine what ...
1
vote
1answer
10k views

Can't get John the Ripper to work — keeps giving two common errors

The error I'm getting is this: (I have to double-newline (press enter twice) these because it automatically attempts to write them straight out, and that makes it more confusing.) Using default input ...
20
votes
2answers
3k views

Store Credit Card Information in Password Manager?

For convenience purposes I manage my passwords with the password manager Bitwarden on my personal computer and smartphone with autofill function (but with asking for the master password or fingerprint ...
-2
votes
2answers
733 views

How secure is aes-256-cbc with a 40 char password [closed]

I'm using this command from this article to encrypt a file: openssl enc -aes-256-cbc -in /etc/services -out services.dat -k MYPASSWORD If MYPASSWORD is 40 characters in length, roughly how long ...
0
votes
0answers
100 views

John the Ripper: OpenMP mode vs using the “--fork=N” option?

Clang on OSX doesn't support OpenMP by default, so I could not compile JtR with OpenMP support without another Clang installation. However, after looking at the below option, I wonder what the ...
0
votes
1answer
123 views

Can't detect hash type even if I have the password?

I can't found the hash type used in a database hosted in a VM. My hash is c39e02416d974229752c28d7fcefe6e1, and my password is "azerty123456". I noticed that the user table has a column called ...
0
votes
1answer
3k views

hashcat - cracking a salted sha256

Given a SHA512 hash, a salt, and username I am trying to crack the hash using hashcat. Every example I've found used a hashfile as input, is there way to provide salt and hash via commandline without ...
7
votes
3answers
755 views

How secure is using your fingerprint for password against opportunist thieves?

If someone has access to your fingerprints then using your finger print as a password on your phone or other device is obviously compromised. But assuming they do not have access to your finger prints,...
3
votes
1answer
166 views

Could a cracked password run as a command on the attacker's system?

I recently was made aware of 6 passwords that I use becoming compromised in data leaks, and they are now exposed in plain text. I don't know how attackers go about cracking passwords or how they ...
3
votes
2answers
234 views

Is password dependent iteration count a good practice?

I consider the possibility of improving password security by increasing the hashing iteration count for short passwords. The security benefits I see of this practice are: Short passwords are better ...
-1
votes
1answer
182 views

Best tool for cracking SHA-1s with unique pre and post salts? [closed]

I can't find a tool that supports cracking SHA-1s with different pre and post salts. Any suggestions?
0
votes
1answer
4k views

Crack password protected zip file with pkcrack

I have allfiles.zip contains only file allfiles.exe and is password protected. I heard about pkcrack, it is possible to get the file from a zip file which is encrypted if we have some part of ...
1
vote
1answer
211 views

AES, RSA, ECC Key size [closed]

It is generally said that 2048-bit RSA keys are roughly equivalent to 112-bit symmetric keys and 2048-bit RSA keys are "sufficient for commercial use until around the year 2030" (https://security....
155
votes
17answers
21k views

Is the BBC’s advice on choosing a password sensible?

In this article on the BBC’s website they offer advice on how to develop a password. The steps are as follows. Step 1: Choose an artist (a recording artist I presume) Lets choose as an example ...
12
votes
2answers
17k views

What is Pixie dust attack on router?

I read an article on this site, but didn't get what I wanted so my concerns are: How does pixie dust attack work? What is the flaw that only certain routers contain to being vulnerable for Pixie-Dust ...
0
votes
1answer
144 views

Question about birthday attack on password

Based on birthday attack, you need to generate at least 2^n/2 of possible combination to have 50% chance of finding a password. I have a list of 3000 random password make from 16 characters of upper, ...
-3
votes
1answer
98 views

Finding encryption type of hash [closed]

Is it possible to find encryption type of a hash with a salt? I have my other password in same encryption type, with the hash from that and the password, if that helps. $2y$10$...
0
votes
2answers
862 views

Cracking WI-FI password offline at distance, is that possible?

Let's suppose I was able to get a handshake from my target's network and I got the .CAP file (containing the handshake), but I would like to crack the password from another location (away from the ...
1
vote
1answer
86 views

Multicore hacker tools?

Have a school project coming up in multicore programming. I'm interested in/have used hacking tools alot before, and was wondering if there were any good tools out there that could benefit from being ...
9
votes
2answers
18k views

John the ripper is not identifying hashes

I'm attempting to use JTR against a password protected zip. I have created the hash file using:zip2john filename.zip > filename.hash and i get a successful output:file.txt is using AES encryption, ...
1
vote
1answer
184 views

Do I understand SHA-1 brute-forcing speeds correctly? (Firefox Password Manager)

I read that the Firefox Password Manager has a "bug" (or rather poor design) in that it uses only a single sha-1 hash iteration for the password (which makes it extremely easy to brute-force ...
3
votes
1answer
642 views

KeePass Key File - Does it provide any meaningful security?

KeePass has the option for a master password and key file (and windows login). But I am not sure how it really helps security that much. I can see a couple of scenario's: The database and key are on ...
0
votes
1answer
91 views

How to create combinations of a password [duplicate]

I don't remember my password, I can't remember exactly the variation. How can I brute force all the permutations of a word knowing the following conditions: Idea of the word (in my mind). Lower and/...
0
votes
1answer
18k views

Hashcat passwordcracking separator unmatched

I have the task to crack a bunch of passwords like: $1$V5l3qvml$Q.fDn30gGhjcEIZH8utah/ $1$DcuX.dRK$bR4utyGQ4ET4sobpMMtfo0 $1$WbXWIqFu$Qu1fT/MmTIvSUz4xw4mlI0 $1$8Y7TfkZ5$LnuF99mgFbV1wvQ61dMZB1 I was ...
0
votes
0answers
160 views

How to define rules for Jack the Ripper

I'm verry new to jack the ripper and I'm wondering how to use special rules for cracking a txt file. The password of my txt file is 123 and with the single crack mode it takes a lot of time to crack ...
0
votes
1answer
472 views

Recommended length of password [duplicate]

Why are we recommended to have at least 8 characters, and not 6 or 7 etc.? and the different set of character?. I only know that the longer the password is, the harder it is for brute force attack to ...
1
vote
1answer
200 views

Hashcat Mask Help

I'm wondering on how to run hashcat against wpa2 passwords that are in the following format: common dictionary word . three digits . common dictionary word Password Example: falcon.824.watchman Is ...
1
vote
0answers
441 views

Can a smartphone's PIN or password be brute-forced in an offline attack?

I know of exhaustive offline dictionary and brute-force attacks against any given online account, but can the same method be applied against phones, either Android/iPhones? Or would any such attack be ...
0
votes
0answers
819 views

John the ripper 0 password hashes cracked, 38 left

I'm stuck and new to this and would greatly appreciate any assistance! Kali linux latest build trying to use Jack the Ripper I have the hashes in a file called userhash.txt So I try this: (just ...
5
votes
2answers
6k views

Estimate the time to crack passwords using bcrypt

I am reading on the Ashley Madison password exposure case. Dean Pierce was able to output about 4000 cracked passwords within 5 days given his system. I'm assuming that he generated a table of hashes ...
1
vote
1answer
2k views

hashcat specify number of characters

I am trying to figure out a macOS hash 10.8+ and I happen to know that it uses A-Z, a-z, 0-9, is 6-8 characters, and almost certainly random. Currently, it spits out an error regarding hash length ...
1
vote
3answers
578 views

What should a secure passphrase look like?

We all know that passwords should not only be randomly generated, but also look random. The reason is that attackers can use patterns or existing words to be able to bruteforce the passwords faster, ...
27
votes
1answer
10k views

How does the attacker know what algorithm and salt to use in a dictionary attack?

I am curious about password cracking methods like dictionary and brute force attacks. Nowadays passwords are stored as hashes and not plaintext on the server. Then how can the plaintext passwords in ...
0
votes
1answer
2k views

THC Hydra on Windows RDP Domain

I am testing a bruteforce on a windows rdp server within a domain. It seems to not be working because nothing is locking out the account I am targeting. How do you specify a domain username? I tried ...
0
votes
2answers
2k views

Is it possible to crack Joomla hash password?

I'm a developer and suddenly I fall in a stupid situation like I need to crack a hash Joomla password which is (5aa154999c111bf7f33a1a3cadba5847) and I don't know the salt. is there any way to crack ...
3
votes
3answers
222 views

How ethical is it to publish an (anonymous) password list from real sources

I'm currently doing security research on the dangers of using default or well known 'secrets' for applications. To test how big of an issue this actually is, I decided to download local copies of ...
2
votes
1answer
428 views

Is there a well-researched and user-friendly solution to the password problem? [closed]

The Password Problem has been spoken on many times, but most places I've seen offer terrible solutions such as modifying a dictionary word, changing your password requirements to include special ...
0
votes
0answers
59 views

Breaking a tough password using john

I'm trying to crack a pretty advanced password on my computer and I've had it running for about a day on john's default settings. Its gotten through roughly (a day times 23000kp/s) passwords. I have ...
2
votes
2answers
205 views

Can a rogue client bypass the Wi-Fi Access Point?

Let's assume that one client contains malware, and that it belongs to a Wi-Fi network protected with WPA2/Personal (hence, via a password known to the piece of malware), where some other vulnerable ...
3
votes
0answers
1k views

Where is the Administrator password for McAfee Endpoint Security stored on the local machine?

Where is the Administrator password for McAfee Endpoint Security stored on the local machine? I've tried to locate the Administrator password for McAfee Endpoint Security in the registry on the local ...
3
votes
1answer
81 views

How much less secure is a password with a repetitive pattern of characters?

I want to make sure my password is very difficult to bruteforce but also easy to remember and convenient. So my idea is to just use a short password and repeat it a few times like this: ...
7
votes
0answers
166 views

Kerberos Attacks Questions

It's amazing how many "Attacks on Kerberos" articles exist out there and almost none really explains the small details. My guess is that usually they assume it's basic knowledge and sometimes, they ...