Questions tagged [password-cracking]

for questions relating to the cracking of passwords and the practices to mitigate against passwords being cracked.

Filter by
Sorted by
Tagged with
0
votes
1answer
80 views

Crack Hashed Byte Array? [closed]

I know it would take forever to crack a simple hashed byte array, though for learning sake I was wondering whether it is possible to crack a hashed byte array? And if so, any suggestions how to do ...
4
votes
1answer
153 views

Customized approach to protect plaintext passwords/usernames in database table?

I'm in the process of building an app to let users sign up, connect their many email accounts (like Gmail) to the site, and allow email-related activities... like sending an email (please don't ask or ...
4
votes
3answers
2k views

largely accessible encrypted passwords

Suppose your university has a centralized ldap server used to authenticate all students, teachers and staff for all services provided by the university (email, exams, taxes...) Suppose that in the ...
4
votes
5answers
721 views

What is the most secure way to store the password on a physical medium (paper, etc)? [duplicate]

Let's assume that I have to store the password on a material medium (paper, etc). What is the most secure way to do that? I mean a way of storing the password that does not needs any electronic tools ...
2
votes
3answers
9k views

Is it possible to crack any SHA1 hashed password

I'm trying to understand how easy it is to crack a SHA1 hashed password. I have a training database giving hundreds of password hashed. I have tried to use some online tools to crack them and I have ...
0
votes
1answer
573 views

Use my own wordlist for single mode in John the Ripper

I would like to apply the complete set of mangling rules to a reduced wordlist of user information. How can I do that? I know that's what JtR is supposed to do by default in the single crack mode but ...
0
votes
3answers
2k views

How to estimate the time for a hacker to crack a strong password

Some kind-heart hacker just sql-injected our website, getting the hash of admin password of 10 lower case chars. It took him half a day to crack it without knowing the SALT (he know that we use "...
9
votes
3answers
582 views

How could our passwords be cracked so easily?

We are saving password in a database using PHP: return hash('sha256', PASSWORD_SALT . $password); Recently a (fortunately) good hacker SQL-injected us and cracked some passwords including the admin ...
3
votes
2answers
257 views

Is there a cryptographic disadvantage to applying bcrypt to an already hashed password

I originally asked this on stackoverflow, but due to lack of traction and a recommendation by a user there I have asked it here too. Imagine a scenario where a client application is sending a ...
3
votes
3answers
228 views

Can one find the value of a “constant salt” if they can set the password and get the hash?

Saying we have an oracle that an attacker can use as many time as they want. The attacker can send a non-empty password to this Oracle. The Oracle hashes the password using sha256(password + pepper), ...
3
votes
1answer
578 views

Time to crack passphrase of 4 English word combinations at 7 terahashes/sec

This site suggests using 4 common English words as a password is no longer safe. Apparently the top 5000 English words in any combination of 4 words can be hashed in 1.5 minutes at 7Thash/sec. The ...
1
vote
0answers
236 views

Unable to display login username in Hydra

So I'm performing an authentication cracking lab using Hydra, I use the following command; hydra -L /usr/share/ncrack/minimal.usr -P /usr/share/wordlists/s1.txt -f -V 192.168.99.22 telnet The ...
1
vote
1answer
472 views

Unknown round length makes hash uncrackable?

So I am on an engagement and grabbed some hashes but cracking them has come to no avail. I believe I know the hash type (PBKDF2-HMAC-SHA256) but I am not sure what round size they used. This got me ...
4
votes
3answers
54k views

Is it possible to crack hash with known salt? If yes how?

If the salt in the hash is known to us, then is it possible to crack to extract the password from the hash? If yes, how?
1
vote
0answers
34 views

John the Ripper modify passwords before checking

Assume I have a password I want to crack in the following format: 100 times the character 'a' prepended to Some word found in a wordlist John will probably not be able to crack this with the default ...
27
votes
12answers
17k views

Reusing passwords that can possibly never be cracked

Reusing passwords pose as a terrible risk for users because in the event of a data breach, with the passwords not being stored securely enough, this means that, by default, all other services that ...
2
votes
1answer
704 views

Tools and computer specs for password cracking [closed]

To polish my penetration testing skills I want to attempt to crack NTLM/NTLMv2 hashes (via dictionary/wordlist attack) extracted from Active Directory / SAM database, where the underlying passwords ...
6
votes
5answers
86k views

Cracking CISCO ASA Passwords

I've got a copy of a Cisco ASA config and i want to crack the following example passwords I've got the following lines in the config ASA Version 8.4(2) ! hostname ciscoasa enable ...
3
votes
2answers
308 views

Change the function such that there are no more side-channels

Given is the function compareKey which is a part of a crackme (a binary file). Which side-channel attack can be used to find the right password (password is made up by ASCII coded big and small ...
1
vote
1answer
2k views

Using Windows LSA Hashes obtained from crackmapexec

I have obtained some hashes using crackmapexec and dumping from the LSA process. The hashes are in this form (data below is fake): adm_name:c6f132a235209036744ba5d303bd5d9b:SOME.ORGANISATION.COM:...
2
votes
2answers
242 views

Does having a salted password hash make cracking an unsalted hash of the same password easier?

I've been asked to implement a system to prevent reusing passwords on the same account. The most secure way I know to do this is to compare hashes of the password + a known salt. bcrypt.hash(sha256(...
30
votes
9answers
7k views

What considerations do I need to keep in mind when enforcing passphrases?

According to XKCD: Password Strength, if the password consists of “four random common words”, it will be secure and memorable. I want to make a web application and make users create their passwords ...
2
votes
1answer
2k views

How is it that tools like Hashcat, JTR able to bruteforce an NTLMv2 hashes?

With regards to the following question about the feasibility of (brute|dictionary|rainbowtable)-forcing an NTLMv2 hash: How feasible is it for an attacker to brute-force an NTLMv2 response captured ...
-1
votes
1answer
351 views

Crunch wordlist with different number of words

I'm trying to generate a wordlist, but I need some help with it. Let's say I execute the command: crunch 1 1 -p cat dog cow Crunch will generate the following: catcowdog catdogcow cowcatdog ...
3
votes
2answers
3k views

WPA password cracking setup

let's say i am trying to crack a WPA password and i need to create a virtual machine setup for it. What would the setup be if i limit myself with a specific number of hours ( let's say 24 hours and ...
0
votes
1answer
371 views

How can we estimate the time and computing resources needed to break or crack an encryption algorithm and/or password?

I am not too familiar with the technical jargon, so bear with me while I explain the issue in simple and naive words. I have looked into many places but still haven't found a solution to this specific ...
8
votes
2answers
17k views

How long would it take to brute force an 11 character single-case alphanumeric password?

My previous home wifi router's WPA2 password was permanently fixed to FZ4HBCKHGC8. How long would it take to crack via brute force? Or more pragmatically: How long would it take to exhaust all ...
60
votes
3answers
15k views

Are leet passwords easily crackable?

Making a strong password AND remembering it is like eating while talking. You choke. So the same thing might happen if you have a p455w0(R).|L1K3thys and someone cracks it. I'm just not sure if it's ...
0
votes
1answer
243 views

What is the weakest scheme in common use for password hashing?

Essentially, what's the next step up from plaintext password storage? I suspect the answer is going to be MD5, but I'm not familiar with a broad enough variety of examples to be sure. The reason ...
3
votes
1answer
12k views

John the ripper passwd file format with salt not working

I'm trying test password strength in one of our e-commerce sites. I'm using john the ripper to brute-force a password file. The algorithm used by PHP is: $hash = md5($salt . $pass) No other ...
0
votes
2answers
941 views

Generate variable length wordlist with ! character at the end?

I am trying to create a variable length word list with crunch that guarantees a exclamation point (!) at the end of each word. I want a wordlist of all words of length 4 - 6, with the last character ...
3
votes
3answers
3k views

Generate wordlist with exactly 4 letters and 6 numbers in any order?

I need to configure crunch so that it produces a wordlist with the following set of rules: Exactly 10 characters long Contains exactly 4 letters, which have to be a-f (all lowercase) Contains exactly ...
1
vote
1answer
1k views

Using crunch, but using words like chars

I would like to generate a wordlist that contains words and 2 digit numbers. I want crunch to shuffle them like 15password15, password15, 15password... Is there any way I can do that with crunch or ...
2
votes
2answers
976 views

Is it still possible to run an online dictionary attack from a single machine, without anonymisation?

This question concerns dictionary attacks conducted: Over the Internet, using programs like THC Hydra Via protocols such as HTTP, FTP and SMTP I believe I'm right in thinking that: a) due to the ...
0
votes
1answer
2k views

How can hackers get 1 billion passwords per second?

So I'm interested in Brute Force attacks and I have made them with Python 3 and C++. However, those only reached a max of about 20 million passwords per second. I know for a fact that 1 billion ...
1
vote
0answers
174 views

Using hydra on a website that has the same response for both a wrong and correct password

I got my hands on an old-ish residential gateway with SIP support and two analog phone connections. I want to use it for it's SIP support to use analog phones with my SIP provider. I didn't know the ...
5
votes
2answers
2k views

How much faster does a GPU or FPGA crack an RSA key compared to a CPU?

Are there any significant speed up in time on cracking an RSA key (either brute-force or factoring with general number field sieve) using a GPA or FPGA compared to a CPU? If there is a speed advantage,...
1
vote
1answer
228 views

Can we know what hacker has come up to so far in his attempt?

I have discovered 'accidentally' while searching in my command history, that some one has issued these : passwd w cat /proc/cpuinfo free -m uptime w perl v.py python v.py chmod +x * ./a 94.10 and ...
7
votes
4answers
3k views

Is there a way to check lists of cracked passwords without revealing my password?

I want check if my various passwords are in lists of cracked passwords, but I don't want to type the passwords online. For example, I'd rather scroll through an ordered list of passwords that have ...
-2
votes
1answer
2k views

Sample Capture Files to Test Password Cracking [closed]

I was wondering if there are sample .cap files that can be downloaded to test password cracking with aircrack or or other tools for my homelab. Thanks!
2
votes
3answers
132 views

Passwords in one file or separate?

I have a program that hashes some passwords and saves them to .txt files, I'm not using databases for storage. My questions is, is it considered more secure to save hashed passwords in one file or to ...
5
votes
1answer
1k views

Should I be worried about brute-forcing passwords that encrypts AES?

I am building an application that needs to locally store sensitive data, that is encrypted using the SHA-256 of a password provided by the user. It uses AES for encryption. I am worried that some ...
5
votes
6answers
807 views

Is a password really necessary? [closed]

For the purposes of security, is there any difference in having a 50 character randomly-generated secret username accompanied by a 50 character randomly-generated secret password, versus a 100 ...
2
votes
1answer
201 views

GUI exe BruteForce login test

Hi I have created a login page Below. I want to test the security of my exe I do not want to use a captcha or timeout on my exe. Are there any applications specifically designed for bruteforcing .exe ...
2
votes
1answer
80 views

Get total, not unique, number of cracked passwords from John the Rippers output?

I am giving John the Ripper a file that may contain duplicate hashes, and get output like this: 2g 0:00:00:01 1.600g/s 3.200p/s 3.200c/s 70227C/s 123456789..abc123 Which represents the total number ...
0
votes
1answer
1k views

Generate password list with specific keywords and length

I need to generate a list of passwords to try penetrating into a wi-fi network. I have a pretty big list of keywords and I want to use them to generate as many possible passwords as possible, which ...
10
votes
1answer
2k views

PRTK with 7Zip AES-256 encryption

I've been running Access Data Password Recovery Toolkit (PRTK) on a bunch of encrypted archives (all zip files, I think they were encrypted with 7Zip AES-256) for a while and haven't had any hits. I ...
11
votes
2answers
5k views

Mathematically, how long would it take to crack a bcrypt password hash?

So I'm currently using bcrypt to hash passwords with a randomly generated salt (as seen in the pip bcrypt module), with 12 rounds. I have been looking around, but I cannot find a detailed and clear ...
90
votes
10answers
13k views

Is there a threshold for a password so long it doesn't get any more secure or even becomes insecure?

I always hear "A long password is good, a longer password is better". But is there such a thing as a "Password is so long it is becoming unsafe" or "Password is long enough, making it longer won't ...
0
votes
1answer
101 views

How to Remotely Retrieve Password Hash from Computer

Just for fun, I wanted to see if I could remotely extract the password hash of my own user account on my own Mac. Assume that the device is running either the latest version of macOS Sierra (10.12.6) ...