Questions tagged [password-cracking]
for questions relating to the cracking of passwords and the practices to mitigate against passwords being cracked.
791
questions
1
vote
0
answers
286
views
Can ophcrack crack credential files?
I have obtained some credential files from another pc and would like to decrypt them. These are the ones found under local/roaming profile in Appdata folder
C:\Users\%USER%\Appdata\Microsoft\...
- 151
1
vote
1
answer
178
views
Where to offer money for cracking check [duplicate]
I made a software and I would like to distribute it as a demo that can be registered. I would like to know if there is a site where I can offer some reward for some one try to crack my software and ...
- 153
14
votes
1
answer
103k
views
Forgot password to 7-Zip archive
I think I already know the answer to this question, but I thought I'd ask the experts anyway.
A few months back, I created a password-protected 7-Zip archive which housed the source code of a simple ...
- 343
1
vote
1
answer
2k
views
Problems with l0phtcrack
I recently wrote a website for my company and have been asked to Pen test it as well as the server. Have run SQL map and no vulnerabilities there, however I want to check if my hash and things are ...
- 161
4
votes
2
answers
3k
views
Pattern based password cracking
I need to select a project for this semester. I'm a second year uni student in Ethical Hacking and Countermeasures. My idea was to see if using some kind of pattern based password cracking can be more ...
- 1,447
1
vote
1
answer
2k
views
WPA/PSK Dictionaries
I have been reading some articles on WPA/PSK encryption and one said that the hash is calculated like this:
Key = PBKDF2(passphrase, ssid, 4096, 256)
Where PBKDF2 is a standardized method to derive ...
- 113
2
votes
2
answers
2k
views
What is the ultimate goal of hacking a webserver? [closed]
Recently I noticed a lot of traffic generated by automated bots that were checking for vulnerabilities in my web server. They were mainly looking for ways to hack into plesk/wordpress which I don't ...
- 139
0
votes
1
answer
12k
views
Hydra cannot connect to http-post-form
I don't get the correct results and I'm not sure what I'm doing wrong:
$ ./hydra -l admin -x 3:9:a http://localhost http-post-form "/admin/login:j_username=^USER^&j_password=^PASS^:failed&...
1
vote
3
answers
10k
views
Cracking passwords after a pattern with John
So I am trying to find out how easy it is to crack a password using some great Linux tools.
We all know about John as a password cracker and how great it is. But how about specifying a pattern.
Let'...
- 195
5
votes
3
answers
10k
views
Rainbow Tables: What is the Reduction Used for?
This is a follow up from this answer.
The answer is very good, and it put me to thinking and doing some research. I have found another good explanation on this site.
At some point, the author says:
...
- 4,257
3
votes
1
answer
2k
views
How do I convert from this weird John/Asleap format to lc (for HashCat)?
I'm trying to setup a system for pen-testing. I'm using the FreeRadius-WPE patch to collect Challenges/Requests from people who connect to my spoofed AP instead of the actual network. Here is the ...
- 256
-1
votes
3
answers
1k
views
help me about salting passwords
Eve has just discovered and decrypted the file that associates each userid
with its 32-bit random salt value, and she has also discovered and decrypted the password file, which contains the salted-and-...
2
votes
1
answer
8k
views
Brute force password cracking with a GPU
How are GPU's provisioned for password cracking? Do all, if not most cracking programs have special GPU aware software or do they just function at the basic driver or API level of the device?
Can it ...
- 21
5
votes
1
answer
21k
views
John the ripper passwd file format with salt not working
I'm trying test password strength in one of our e-commerce sites. I'm using john the ripper to brute-force a password file. The algorithm used by PHP is:
$hash = md5($salt . $pass)
No other ...
- 61
0
votes
1
answer
1k
views
How difficult is it to crack salt portion of hash
I write mobile application and I need to authenticate users against server. Server's side is written in php. I can't use cookies to store SID (Session ID), so I decided to send it at every request ...
- 123
2
votes
3
answers
1k
views
Password Security and ocl-Hashcat-plus
I recently read the Ars Technical Article about new features in ocl-Hashcat-plus. In light of questions like:
Long Passwords: How are they more secure?
and
XKCD #936: Short complex password, or ...
- 121
25
votes
2
answers
18k
views
How does WiFi password cracking work?
Let's say I have a wireless network that is password protected.
What procedures can an intruder take to gain access to my wireless network, or at least be able to decipher the packets I am sending ...
- 1,134
2
votes
2
answers
899
views
Can AES-256 encrypted data be changed?
I have a file that supposedly contains AES-256 encrypted data. The file was created using a proprietary program that claims to use AES-256.
I have tested decrypting the file with an open source ...
- 21
-2
votes
1
answer
428
views
Can Cain&Able Crack SSL? [closed]
I have been messing around with Cain and Able and used APR on another computer (also mine) to get a hashed version of my username and password for my yahoo e-mail account, but I seem to be lost as to ...
- 27
5
votes
2
answers
3k
views
Would a massive blacklist of guessable passwords be useful? [duplicate]
Suggestions to make a good password all focus on creating a string that a computer (or more likely, a network of computers with multiple GPUs) can not guess. Putting a password meter for when users ...
- 1,259
11
votes
2
answers
62k
views
If hashing is one way, why can we decrypt MD5 hashes?
I have read some times that hashing is a one way function, that is you can make the hash of a message, but you can't recover the original message from the hash, just check its integrity.
However, if ...
user15194
-2
votes
2
answers
2k
views
Can the U.S. goverment crack encryption? [closed]
Does USA government have the sufficient processing power to crack keys in matter of seconds? Let say 2048-bit RSA, for example.
Since the RSA algorithm was developed by USA government (NSA?), I ...
- 371
4
votes
2
answers
18k
views
What exactly is 'single' mode in John the Ripper doing?
I'm testing out John the Ripper (1.7.9 Jumbo 7) on a file containing MD5 hashes without any usernames. I've been experimenting with different rules and configurations – I am currently using a wordlist ...
- 107
4
votes
1
answer
2k
views
RSA vs PBKDF2 for password storage (theoretical)
I know this is not the right way to store passwords, but I'm asking this from a theoretical perspective:
Suppose a web site's passwords were encrypted with RSA asymmetric encryption and the private ...
- 2,272
-1
votes
1
answer
5k
views
How long does it take to crack a 100-letter long winrar password? [closed]
i´m interested in how long time it would take for a super computer dedicated to crack
to crack a 100-letter long winrar password. The password contains Lowercase, Uppercase, Digits, ...
- 13
3
votes
1
answer
1k
views
What is the entropy of just 1 Diceware passphrase like my passphrase?
A 5-word Diceware passphrase gives an entropy of 7776^5 = 3E19 = 19 Bans (or ~64 bits). Apparently monster cracking systems can currently guess passphrases for MD5 at a rate of 180 billion/sec (2E11). ...
- 525
-5
votes
1
answer
329
views
How can I crack ArrayOS password [closed]
I have some Array Load Balance device that the user password hash like:
user "array" "XXXXXXXXXVkjTX9a1kYtNo".
How can I crack the password or find out the algorithm of the hash?
- 1
-14
votes
1
answer
3k
views
Can a cracked antivrus software do the job? [closed]
Some of my friends say that their cracked antivirus software updates regularly, and does the job as same as a legitimate software would do. Is this possible? How do they bypass the activation key ...
- 259
7
votes
4
answers
3k
views
Password list generation
I've found during a lot of recent pen-tests that companies will use passwords like
c0mp4ny@b(
for a company called "company abc"
Is there any quick and easy way to generate a list of ...
- 11.5k
2
votes
3
answers
61k
views
How long will it take to crack a 10-15 character winrar password? [closed]
Ok, long story short, I'm currious how long it would take an agency to crack a 10-15 character winrar password. The file names in the archive are also scrambled including a word at the start and ...
- 61
3
votes
1
answer
19k
views
How long it will take to crack a RAR password?
I wonder how long it will take to crack 16 character alphanumeric WinRAR password for a mini supercomputer. As far as I know graphic cards are preferred over CPUs to crack passwords nowadays. If we ...
- 415
2
votes
2
answers
1k
views
7zip AES encrypted archive, padding oracle attack
I created an encrypted but forgot the password. When I attempted a pattern based brute force it said it had over a 100 trillion passwords to check. And to my knowledge that could take a few years. ...
- 121
35
votes
2
answers
43k
views
Why are GPUs so good at cracking passwords?
What is it about GPUs that lets them crack passwords so quickly?
It seems like the driving force behind adopting good key-derivation functions for passwords (bcrpyt, PBKDF2, scrypt) instead of ...
- 455
3
votes
1
answer
3k
views
Pointers for john the ripper rulesets
I've been pouring over the JtR ruleset documentation and making little progress. I understand how to use it to make various permutations from a given wordlist, that's fine. However, I'm trying to ...
- 133
1
vote
2
answers
2k
views
Password Protected Zip: if attacker had one file, can use it to decrypt all files?
Consider a folder containing the following files:
(file1.txt, file2.doc, file3.pdf) all zipped and password protected, if attacker had one of these file, can use it for decrypting all without knowing ...
- 1,357
5
votes
3
answers
1k
views
Tools helps: First time cracking passwords
I am trying to crack passwords on two Windows member servers (2003 and 2008). There is no Active Directory. Each user seems to use the same password across servers, workstations, etc. I have access to ...
- 159
6
votes
5
answers
96k
views
Cracking CISCO ASA Passwords
I've got a copy of a Cisco ASA config and i want to crack the following example passwords
I've got the following lines in the config
ASA Version 8.4(2)
!
hostname ciscoasa
enable ...
- 11.5k
8
votes
3
answers
8k
views
File security when encrypting files directly with the openssl command / and what about SHA1 hashing password first?
I've been using this command to encrypt files for a while now:
openssl aes-256-cbc -a -salt -in secrets.txt -out secrets.txt.enc
Then I type in a password.
Can someone tell me, roughly speaking, ...
- 273
14
votes
3
answers
20k
views
Cracking MS-CACHE v2 hashes using GPU
As most people here will know, Windows caches domain/AD credentials in a format known as MS-Cache v2. Obviously, these would be excellent passwords to gain during a penetration test when local access ...
- 11.5k
7
votes
7
answers
12k
views
Is it possible to detect password length from hash? Does doubling your password add more security?
Assuming a service doesn't store a plain text password, am I right in saying that the answer to this question depends on the service? On a bad service, the hash length is related to the password ...
- 1,151
56
votes
5
answers
405k
views
How to recover a lost zip file password?
I have some files I was given by my teacher at University, I could chase him up, but I may as well try getting blood from a stone, his response rate isn't great and I completed my degree a year ago!
...
- 681