Questions tagged [password-cracking]

for questions relating to the cracking of passwords and the practices to mitigate against passwords being cracked.

Filter by
Sorted by
Tagged with
-1
votes
1answer
452 views

wifi cracking using a network adapter which doesn't support packet injection

I'm trying to crack my wifi (WPA-CCMP) password to test its strength and security, I'm using the commview for wifi and aircrack-ng software on windows 10. I've three laptops, Windows 10 (64bit) with ...
2
votes
1answer
297 views

Security of PIN that spells out words?

Description PayPal suggests that generating a PIN by spelling words (on a numeric pad, e.g., [ABC] = 2) is a good method for security and memorability, e.g., B-L-U-E-C-O-W = 2583269. My knowledge ...
34
votes
5answers
7k views

Does it matter if a brute force search for a password returns a collision and not the password?

Assume the following very basic hashing algorithm. h(k) = k mod 17 Let's say we create a password 12345 for a website that uses this very basic hashing algorithm. That would yield the hash of 3. ...
0
votes
0answers
26 views

Passphrase Cracking Dictionary [duplicate]

I have been discussing this tweet https://twitter.com/marcan42/status/1238125727855206400 and the conversation around it with some folks on an encryption module I am doing as part of a cyber security ...
13
votes
3answers
19k views

Cracking a JWT signature

I am testing an API that uses JWT for authentication. This JWT has a HS256 signature to prevent modification. I figured that if I determine the secret key used in this signature, I can create my own ...
1
vote
1answer
89 views

PDF User Password always give access to the Owner Password, even when encrypted with AES-128

I've been messing around with qpdf, and noticed something that seems huge: that a document's Owner Password is essentially useless, as it can be easily unset, and therefore that only the User Password ...
0
votes
1answer
58 views

How to determine the type [duplicate]

Today I discover a encryption method Which 0 = 35 1 = 34 2 = 37 3 = 36 4 = 31 5 = 30 6 = 33 7 = 32 8 = 3d 9 = 3c It's the encode of number 1 to 0 for the method Can you please help me to ...
1
vote
2answers
321 views

Hashcat Mask Help

I'm wondering on how to run hashcat against wpa2 passwords that are in the following format: common dictionary word . three digits . common dictionary word Password Example: falcon.824.watchman Is ...
7
votes
4answers
3k views

Password list generation

I've found during a lot of recent pen-tests that companies will use passwords like c0mp4ny@b( for a company called "company abc" Is there any quick and easy way to generate a list of ...
3
votes
1answer
4k views

Breaking EncFS given .encfs6.xml

I forgot the password of a EncFS folder (created, went to vacation, forgot). But I remember how the password was created (e.g. was a sequence of 4 dictionary words). So I decided to try to find the ...
3
votes
2answers
17k views

Generate John the Ripper rule

This question asks for pointers about generating JtR rulesets, but the OP states I understand how to use it to make various permutations from a given wordlist Could someone please explain that? ...
3
votes
1answer
2k views

Pointers for john the ripper rulesets

I've been pouring over the JtR ruleset documentation and making little progress. I understand how to use it to make various permutations from a given wordlist, that's fine. However, I'm trying to ...
0
votes
1answer
115 views

Cracking less than 4 letter linux password using john

I am trying to crack a less than 4 character Linux password using john. I unshadowed my password into file.txt I use the following command: john -incremental file.txt the output is: 0g 0:00:00:04 ...
0
votes
0answers
59 views

Issue using John The Ripper

First things first, I'm a newbie so, bear with me... I created a word list with a combination of a possible password for a certain user using Crunch (it's the dictionary output) and need to use John ...
0
votes
0answers
102 views

How to crack rar file with protected pass with only the AES-256 key?

I have rar with protected pass.But I have the AES-256 key can I crack it and if I can. how?
1
vote
0answers
446 views

John the Ripper performance

I have two questions regarding performance of John the Ripper. Within the format files, there is a variable named MIN_KEYS_PER_CRYPT and MAX_KEYS_PER_CRYPT. How much do they influence the performance....
6
votes
2answers
34k views

show previously hacked passwords with John The Ripper

I tried to crack my windows passwords on the SAM file with john the ripper, it worked just fine, and it shows me the password. But when i try to hack the same file again, john just tells me : Loaded ...
5
votes
3answers
21k views

Brute force alphanumeric password using JohnTheRipper

I recently recovered a zip archive with some files I need access to, but I can't remember the password. All I can remember is that the password was short (around 3-4 characters), and contained only ...
0
votes
1answer
3k views

How to recover lost zip file password?

I have a folder with very important files on my computer and I zipped it with a password for security reasons. Unfortunately, I'm not able to recover the password. Usually, I always use the same kind ...
3
votes
3answers
7k views

what order does the incremental mode of john the ripper, brute force passwords in?

I am practicing reversing md5 hashed passwords using John the Riper and was curious about some behaviour. I added the md5 hash of zaa to the top of the file with the hashes and when I ran john ...
0
votes
0answers
128 views

Mimikatz Windows 10 password recovery

I'm trying to log into my Windows 10 laptop that was using a Microsoft login. I used to mimikatz to retrieve the SAMkey, LSA secret, dpapi, System masterkeys, and the password hash but it's the ...
6
votes
2answers
1k views

How many known time/result combinations does it take to guess a HOTP/TOTP secret?

I thought about "recovering", "determining", "guessing", "calculating" or "reproducing" the HOTP/TOTP secrets when only the outcome (6-digit code + time) is known. In case we can view the live ...
3
votes
0answers
699 views

How to “unprotect” malicious workbook without knowing password

Right now I'm looking at an office document (most likely rtf based on it exploiting equation editor) that opens just fine when you double click it, but on further examination in a hex editor and in ...
0
votes
4answers
497 views

Password hashing that is resistant to ASIC-assisted cracking without risking DoS of server

Previously, authentication systems stored passwords in cleartext. This made it trivial for an attacker to log in to an account if he had access to a leaked password file. Later, passwords were hashed ...
0
votes
0answers
2k views

Unable to start hashcat in mode 13600 WinZip : Separator Unmatched

I have a zip file containing a JPEG image of size 3.5 MB, encrypted with AES-256. I used WinZip for the creation of the zip file. In order to create the hash of the zip file, I used John The Ripper's ...
0
votes
0answers
53 views

Storing safely files in the cloud - what is the current state of the art encrpytion method for it?

What is considered as safe method to store files in the cloud currently and in the future (quantums) so that no potential hacker could open the file? Which current encryption methods to use for it to ...
1
vote
2answers
185 views

Approximately how much entropy/security is lost by typing passphrase words using a number pad?

For context, the coldcard hardware wallet has a number pad as input. In order to maintain my sanity, I'd like to input an alphanumeric passphrase using a single keypress for each letter or number. ...
93
votes
11answers
61k views

Why is client-side hashing of a password so uncommon?

There are very few websites that hash the users password before submitting it to the server. Javascript doesn't even have support for SHA or other algorithms. But I can think of quite a few ...
18
votes
3answers
5k views

Does revealing part of your hash give an attacker advantage when attacking your password? [duplicate]

This question was prompted by a recent visit to a certain site that provides (apparently for GDPR reasons) a table with all of your data, including part of your hashed password. I understand this ...
2
votes
0answers
22 views

How can I crack WPA2 hash with some limitations? [duplicate]

I want to crack an 8 character password, but I know this password doesn't contain more than 4 symbols, 4 uppercase letters, 4 lowercase letters and 4 numbers, and it contains at least 2 symbols, 2 ...
7
votes
4answers
1k views

Can using emojis make someone's password safer?

I was just thinking about this the other day, after reading about making safe passwords, you have a few options: The first would be, adding numbers, or something other than just a word Password15068 ...
2
votes
1answer
247 views

Is better to have as password a sentence or first letter of the sentence?

Which is better master KeePass password to prevent any type of bruteforce between theses two type of password : Complete sentence invented by user like : I like cheeseburger, tomatoes and fries ! :) ...
4
votes
2answers
6k views

Password Cracking Twitter With THC Hydra

I am looking to password crack my twitter account using THC Hydra but am running into some sort of syntax error. Here is what I have: hydra -l email@domain.com -P passphrase.txt -s 80 -f https://...
4
votes
4answers
1k views

Should I vary the length of my completely-random passwords for the best security?

I use LastPass comprehensively, and for each new site/password I almost always have it generate a random password of the same number of characters, allowing letters, numbers, and symbols (except when ...
6
votes
2answers
1k views

Crack passwords hashed with PHP?

Is this the right way to crack a password hashed with PHP? I used the password_hash function to hash a password (PHP version 7.3). Then I created a word list using a Python script. It's around 1GB in ...
-2
votes
1answer
179 views

Is there a way to hack your Facebook account back? [closed]

I think that from title it's pretty obvious what I'm trying to do. My Facebook account has been hacked, as it's using e-mail from whom I've forgotten password I can't get it back. I'm not using this e-...
-1
votes
1answer
183 views

Calculating Time for a Attack on Password Hashes [closed]

Suppose I have a database containing hashes. Hashes are obtained from password developed from randomly chosen set of 94 characters such that each password size is of 8 characters. So we have 94^8 ...
4
votes
2answers
12k views

How to crack encrypted disk (crypto-LUKS) in an efficient way?

I had a disk encrypted by crypto-LUKS but forgotten password. I read a question posted here. LUKS HDD Encryption crack But before that I want to know if there's some free software I can use to ...
17
votes
10answers
12k views

Crack hashed passwords using a known password

I'm a dev trying to deploy a new dashboard I've written at work, the old one is a mess of hacked together libraries and only about half of the codebase is still even in use (dead code everywhere that ...
2
votes
1answer
104 views

When knowing an individual's plaintext password history, how much information is expected to be gained with a new password? Do we know this?

The premise: Knowing a persons password history should provide information to help when guessing a new password of theirs. At an extreme end, with a password history of wildcats, wildcats1, then ...
11
votes
3answers
7k views

If WPA2-PSK is insecure, what other options do home users have?

from what I'm reading online it seems that one can land attacks and successfully crack a WPA2-PSK wifi network, is that true and if it is, how home users can secure their networks? I seen an ...
2
votes
1answer
1k views

Is it as easy to crack a wifi password, as shown in the video?

I was browsing YouTube and I came across this video In the video they show how to crack the password of a wifi using CommView, Aircrack and Wordlist. According to the video it takes about two ...
7
votes
7answers
9k views

Is it possible to detect password length from hash? Does doubling your password add more security?

Assuming a service doesn't store a plain text password, am I right in saying that the answer to this question depends on the service? On a bad service, the hash length is related to the password ...
1
vote
3answers
293 views

If no one knows a password, is there a reason to change it?

Scenario: A high level access account on a single machine, where the account is created by the system/application with a secure password, without exposing the password to a human or to any other ...
0
votes
0answers
43 views

How long shall a password be to resist a botnet brute force? [duplicate]

Imagine that I'm an evil genius, and I had the brilliant idea of creating a botnet for brute forcing passwords. Or I'm just the owner of the Echelon, and I have a farm of distributed servers around ...
1
vote
1answer
108 views

JohnTheRipper Advanced Mask

I have problem to construct advanced mask to crack hash of 7zip file. The password have 16 chars where are all lower, upper, decimal and !@#$%-_=+: Main information is that any char can't duplicate ...
3
votes
1answer
154 views

Can having certain restrictions/rules make passcodes less secure?

Say I have a phone whose security is corporately managed, and this management demands that I use a 6 digit passcode to lock the phone. So far, so reasonable. This gives an attacker a possibility of 1,...
0
votes
0answers
124 views

Logged in with a hacker's email address

I have an active account at ebay-kleinanzeigen.de (like Craigslist in the US). Today I got a valid email from them that my email address was changed. On my mac, I opened up my ebay-kleinanzeigen ...
0
votes
1answer
252 views

I don't know how to identify the method behind the hash [closed]

I found online an web app that is vulnerable to blind sql injection, I manage to get in users table and I looked at my password, in the table was the hased version, this one->57b0fcbe39b9336d, now I ...
2
votes
2answers
178 views

Given Diceware, why does the requirement to contain uppercase, numerics & punctuation in passwords still stand?

Example strong diceware password: widow stout harvey crest zomba zloty butyl This password will be rejected by most sites, for example by Outlook.com. (Notable exceptions: Gmail, Stackoverflow, ...

1 2
3
4 5
14