Questions tagged [password-cracking]
for questions relating to the cracking of passwords and the practices to mitigate against passwords being cracked.
791
questions
2
votes
2
answers
128
views
Are there any known attacks (technical or social) against enterprises where password resets are scheduled on fixed (known) intervals?
A company I know of has a password policy that requires employees to change passwords (on AD server) every 90 days. The vast majority of its new hires start on the 1st of the month. Thus, several ...
- 21
0
votes
1
answer
122
views
How do maintainers calculate x number of accounts compromised by hack? [closed]
I am always curious by reports in the news of big network sites getting hacked and the report confidently stating a statistic such as "only 10,000 users were affected" or "Microsoft confirms 40,000 ...
- 101
1
vote
1
answer
1k
views
Breaking Wifi password knowing its length of 8 [A-Z] alpha (upper-case) characters using Hashcat
I got the WPA handshake, now it's turn to crack the password using Hashcat. First, I wanted to make a wordlist of passwords [A-Z] the length of 8, but Crunch (the tool in Kali Linux) said it will take ...
- 13
3
votes
2
answers
176
views
Is this (explained in body) a possible attack vector when using haveibeenpwned API?
I'm currently working on understanding and contemplating to implement password strength validation for sign ups in my app, to include checking haveibeenpwned if entered password is compromised ...
- 133
0
votes
1
answer
433
views
Very beginner question about JtR
I Have lost my zip file password and I tried to recover it with Windows 10, using John the Ripper 1.9.0 Jumbo.
Things I know from this password:
9 to 11 characters
Alphabetics A B E F and a b e f (...
- 1
1
vote
0
answers
587
views
Recovery of files from a zip containing a directory (unencrypted) and 3 files (encrypred - ZipCrypto Deflate), possibe use of bkcrack?
I have a zip file, Example.zip consisting of a directory Example and three files *.dat. I can see the names of all 3 files. The dat files are encrypted (ZipCrypto Deflate). I'm interested to know if I ...
- 111
2
votes
1
answer
3k
views
Crack windows excel password
I have many password protected microsoft excel worksheet and I need to be able to edit it. I have forgotten the password, and I know that I can edit the file and take out the password check, but I ...
- 21
2
votes
1
answer
549
views
Why do PDFs contain password hashes?
Reading this question about extracting PDF password hashes to feed into john the ripper has me wondering why password hashes are in a PDF in the first place? Shouldn't it be using the supplied ...
- 58.8k
4
votes
1
answer
13k
views
PMKID found , but it should be WPA handshake
i was trying to get access in wifi network but i came to something that i need to ask afteraireplay-ng –0 20 –a [router bssid] –c [client bssid] wlan0mon i expect
WPA handshake
in right top ...
- 41
0
votes
1
answer
193
views
What vulnerabilities would this type of "password manager" have?
When I was searching for a password manager to use I stumbled upon the concept of Master Password which instead of encrypting and saving your passwords, generates them by using your master password ...
user233399
-1
votes
2
answers
712
views
How secure is a 24 character mysql password?
I recently set up my WordPress blog and I changed the password of its mysql database to a 24 character randomly generated password. I have a few questions about the database:
Is my database name ...
- 143
1
vote
3
answers
6k
views
If my password is not on rockyou.txt does it mean that is a good password?
I have been wondering if all my online and wifi passwords are complex enough.
So to test this I was checking if the password was already present on the rockyou.txt wordlist.
If the password is not ...
- 275
0
votes
2
answers
278
views
Is chain hashing algorithms the ultimate solution for hashing passwords?
Let's say I my password is a simple password, 123456
Then if the database was exposed, if the password was:
-- stored in plain text -> cracked
-- stored it hashed with no salt -> prone to rainbow ...
2
votes
2
answers
808
views
Can you help me with some misconceptions about bcrypt and salting?
I researched password hashing and cracking and I have some misconceptions:
First rule of thumb to create a strong password is to use 10+ combination of digits/upper/lower/symbols to prevent brute ...
0
votes
1
answer
1k
views
JtR Password hash not recognized
I am attempting to encrypt some passwords by hand to use in a project with JtR. Unfortunately, the program is having difficulty recognizing the hash types of the passwords after hashing them.
...
- 11
2
votes
2
answers
253
views
What wrong with this system to proactively check if customers' passwords have been found in a breach?
Let's say that during account creation, I already prohibit passwords known to be reused from breaches of other sites, like if it's in the Have I Been Pwned list. But breaches happen all the time, so ...
- 121
3
votes
3
answers
526
views
Have gotten a blackmail email with a password of mine - what to do? [duplicate]
I've gotten the following email today (the password has been changed; and the Greek characters are reproduced verbatim):
Your ρasswοrd is REPLACED. Ι kηow α lot more τhngs about you τhaη τhαt.
...
- 449
2
votes
1
answer
1k
views
Why does pwdump7 retrieve LM hashes even though they're disabled?
I'm currently undergoing a penetration testing certification, where I'm asked to :
Set up a fully-patched Windows 10 Pro VM (done)
Retrieve local password hashes from the SAM database using pwdump7
...
- 123
1
vote
2
answers
1k
views
How to properly calculate password entropy
I am very confused with calculating password entropy i know that the formula is E = log2(RL).
where E is password entropy, R is the range of available characters, and L is the password length.
but ...
- 39
0
votes
1
answer
247
views
How to approach Web App? [closed]
I'm doing testing on the app, if we take only login url as a starting point.
How to expand my horizons?
I want to make my surface wider, really kinda stuck on this one.
3
votes
1
answer
144
views
What advantages does it have if a password manager locks the DB automatically on locking the computer? Disadvantages of turning it off?
When I unlock my PC the password manager (any type) needs the password again to unlock it's DB containing passwords. I was wondering what the benefit is in that, as my computer is locked anyway.
...
- 33
1
vote
1
answer
973
views
John the ripper - ecryptfs - sample not cracked: 0 password hashes cracked
I tried to use john the ripper on the sample :
ecryptfs_sample_metadata.tar (password is 'openwall')
Which I downloaded from here:
https://openwall.info/wiki/john/sample-non-hashes
If i try
sudo ...
- 11
-1
votes
1
answer
1k
views
wifi cracking using a network adapter which doesn't support packet injection
I'm trying to crack my wifi (WPA-CCMP) password to test its strength and security, I'm using the commview for wifi and aircrack-ng software on windows 10. I've three laptops, Windows 10 (64bit) with ...
- 3
2
votes
1
answer
998
views
Security of PIN that spells out words?
Description
PayPal suggests that generating a PIN by spelling words (on a numeric pad, e.g., [ABC] = 2) is a good method for security and memorability, e.g., B-L-U-E-C-O-W = 2583269.
My knowledge ...
- 123
34
votes
5
answers
7k
views
Does it matter if a brute force search for a password returns a collision and not the password?
Assume the following very basic hashing algorithm.
h(k) = k mod 17
Let's say we create a password 12345 for a website that uses this very basic hashing algorithm. That would yield the hash of 3.
...
- 2,341
2
votes
1
answer
339
views
PDF User Password always give access to the Owner Password, even when encrypted with AES-128
I've been messing around with qpdf, and noticed something that seems huge: that a document's Owner Password is essentially useless, as it can be easily unset, and therefore that only the User Password ...
- 989
0
votes
1
answer
130
views
How to determine the type [duplicate]
Today I discover a encryption method
Which
0 = 35
1 = 34
2 = 37
3 = 36
4 = 31
5 = 30
6 = 33
7 = 32
8 = 3d
9 = 3c
It's the encode of number 1 to 0 for the method
Can you please help me to ...
- 11
1
vote
3
answers
447
views
How can wireless password cracking be detected?
Our team was hired for a red team engagement for a client. A part of the engagement is attempting to crack the WiFi passwords of their office APs. However, we obviously want to stay undetected. What ...
- 885
0
votes
1
answer
1k
views
Cracking less than 4 letter linux password using john
I am trying to crack a less than 4 character Linux password using john. I unshadowed my password into file.txt I use the following command:
john -incremental file.txt
the output is:
0g 0:00:00:04 ...
- 17
0
votes
1
answer
3k
views
Generate every alphanumerical combination in crunch within 8-20 characters in length
I want to generate combinations in sequential range of the length 8-20 with the following characters:
abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ1234567890!@#$%^&*()~`";.,/[]-=
How ...
- 3
0
votes
0
answers
215
views
Issue using John The Ripper
First things first, I'm a newbie so, bear with me...
I created a word list with a combination of a possible password for a certain user using Crunch (it's the dictionary output) and need to use John ...
user226855
0
votes
0
answers
296
views
How to crack rar file with protected pass with only the AES-256 key?
I have rar with protected pass.But I have the AES-256 key can I crack it and if I can. how?
- 1
1
vote
1
answer
8k
views
How to recover lost zip file password?
I have a folder with very important files on my computer and I zipped it with a password for security reasons. Unfortunately, I'm not able to recover the password. Usually, I always use the same kind ...
- 111
0
votes
0
answers
4k
views
Unable to start hashcat in mode 13600 WinZip : Separator Unmatched
I have a zip file containing a JPEG image of size 3.5 MB, encrypted with AES-256. I used WinZip for the creation of the zip file. In order to create the hash of the zip file, I used John The Ripper's ...
- 101
3
votes
0
answers
2k
views
How to "unprotect" malicious workbook without knowing password
Right now I'm looking at an office document (most likely rtf based on it exploiting equation editor) that opens just fine when you double click it, but on further examination in a hex editor and in ...
- 133
0
votes
4
answers
895
views
Password hashing that is resistant to ASIC-assisted cracking without risking DoS of server
Previously, authentication systems stored passwords in cleartext. This made it trivial for an attacker to log in to an account if he had access to a leaked password file.
Later, passwords were hashed ...
- 342
0
votes
0
answers
100
views
Storing safely files in the cloud - what is the current state of the art encrpytion method for it?
What is considered as safe method to store files in the cloud currently and in the future (quantums) so that no potential hacker could open the file? Which current encryption methods to use for it to ...
- 483
3
votes
1
answer
391
views
If my protonmail password is compromised, does that potentially mean that my whole account is, permanently?
My (limited) understanding is that my password is used to encrypt the keys which are used to encrypt my mail messages on protonmail's servers. Does that mean that knowledge of my password could ...
- 31
5
votes
4
answers
44k
views
How do I crack an id_rsa encrypted private key with john the ripper?
I am trying to crack a password protected id_rsa, with john the ripper. But it doesn't find the correct password for some reason.
I have create a new user and generated a new id_rsa with ssh-keygen (...
- 161
1
vote
2
answers
313
views
Approximately how much entropy/security is lost by typing passphrase words using a number pad?
For context, the coldcard hardware wallet has a number pad as input. In order to maintain my sanity, I'd like to input an alphanumeric passphrase using a single keypress for each letter or number.
...
- 207
2
votes
0
answers
29
views
How can I crack WPA2 hash with some limitations? [duplicate]
I want to crack an 8 character password, but I know this password doesn't contain more than 4 symbols, 4 uppercase letters, 4 lowercase letters and 4 numbers, and it contains at least 2 symbols, 2 ...
- 21
18
votes
3
answers
5k
views
Does revealing part of your hash give an attacker advantage when attacking your password? [duplicate]
This question was prompted by a recent visit to a certain site that provides (apparently for GDPR reasons) a table with all of your data, including part of your hashed password. I understand this ...
- 191
2
votes
1
answer
719
views
Is better to have as password a sentence or first letter of the sentence?
Which is better master KeePass password to prevent any type of bruteforce between theses two type of password :
Complete sentence invented by user like : I like cheeseburger,
tomatoes and fries ! :)
...
- 274
6
votes
2
answers
5k
views
Crack passwords hashed with PHP?
Is this the right way to crack a password hashed with PHP?
I used the password_hash function to hash a password (PHP version 7.3).
Then I created a word list using a Python script. It's around 1GB in ...
- 175
-2
votes
1
answer
302
views
Is there a way to hack your Facebook account back? [closed]
I think that from title it's pretty obvious what I'm trying to do. My Facebook account has been hacked, as it's using e-mail from whom I've forgotten password I can't get it back. I'm not using this e-...
- 97
-1
votes
1
answer
875
views
Calculating Time for a Attack on Password Hashes [closed]
Suppose I have a database containing hashes. Hashes are obtained from password developed from randomly chosen set of 94 characters such that each password size is of 8 characters. So we have 94^8 ...
- 97
17
votes
10
answers
15k
views
Crack hashed passwords using a known password
I'm a dev trying to deploy a new dashboard I've written at work, the old one is a mess of hacked together libraries and only about half of the codebase is still even in use (dead code everywhere that ...
- 341
1
vote
1
answer
3k
views
John the Ripper Custom Dynamic Hash Function Usage
I have created a custom dynamic hash function comprised of a series of different existing hash functions chained together. I'll spare you the exact details because it's for a class assignment.
I've ...
- 11
1
vote
3
answers
404
views
If no one knows a password, is there a reason to change it?
Scenario: A high level access account on a single machine, where the account is created by the system/application with a secure password, without exposing the password to a human or to any other ...
- 723
0
votes
0
answers
63
views
How long shall a password be to resist a botnet brute force? [duplicate]
Imagine that I'm an evil genius, and I had the brilliant idea of creating a botnet for brute forcing passwords. Or I'm just the owner of the Echelon, and I have a farm of distributed servers around ...
