Questions tagged [password-cracking]
for questions relating to the cracking of passwords and the practices to mitigate against passwords being cracked.
791
questions
1
vote
2
answers
3k
views
Is User Account Login Related to BitLocker Encryption Key
When I enabled BitLocker on my system-drive, I wasn't asked to select an unlock-method. I didn't have to enter any new passwords/keys. I only selected a few options for the encryption, and the process ...
- 151
1
vote
1
answer
350
views
JohnTheRipper Advanced Mask
I have problem to construct advanced mask to crack hash of 7zip file.
The password have 16 chars where are all lower, upper, decimal and !@#$%-_=+:
Main information is that any char can't duplicate ...
- 113
3
votes
1
answer
326
views
Can having certain restrictions/rules make passcodes less secure?
Say I have a phone whose security is corporately managed, and this management demands that I use a 6 digit passcode to lock the phone. So far, so reasonable. This gives an attacker a possibility of 1,...
- 163
0
votes
0
answers
187
views
Logged in with a hacker's email address
I have an active account at ebay-kleinanzeigen.de (like Craigslist in the US).
Today I got a valid email from them that my email address was changed.
On my mac, I opened up my ebay-kleinanzeigen ...
- 101
0
votes
1
answer
390
views
I don't know how to identify the method behind the hash [closed]
I found online an web app that is vulnerable to blind sql injection, I manage to get in users table and I looked at my password, in the table was the hased version, this one->57b0fcbe39b9336d, now I ...
- 1
3
votes
2
answers
298
views
How strong is a password consisting of words arbitrarily chosen from the dictionary?
Diceware wants us to actually randomly pick n words from a given set of m=65 words.
Assume a user does not actually use a dice. Instead they take a physical dictionary of m words and "randomly" picks ...
- 5,747
4
votes
3
answers
403
views
Given Diceware, why does the requirement to contain uppercase, numerics & punctuation in passwords still stand?
Example strong diceware password:
widow stout harvey crest zomba zloty butyl
This password will be rejected by most sites, for example by Outlook.com. (Notable exceptions: Gmail, Stackoverflow, ...
- 5,747
2
votes
5
answers
927
views
Can you avoid ever sending a password over the wire?
Let's say I want to secure authentication on a web app or a mobile app or even a machine to machine app.
My first approach to secure the password is to enable HTTPS and some sort of client-side ...
- 31
7
votes
1
answer
818
views
How does MariaDB's ed25519 auth scheme work?
Newer versions of MariaDB (a MySQL database server fork) have a new password based auth scheme called "ed25519". The docs are very sparse regarding how it works and what it does.
https://mariadb.com/...
- 8,434
102
votes
3
answers
20k
views
Why is Sojdlg123aljg a common password?
I was going through the list of top 100K passwords and found Sojdlg123aljg near the top of the list. Does anyone have any idea why this is such a common password?
- 753
0
votes
1
answer
145
views
differentiate correct and incorrect password [closed]
So here it is, I had time to kill, so I used it to hack into my own gmail address with THC Hydra. (very fun I know).
So I checked out some old forums and gradually learned how to do it.
I understood ...
-1
votes
1
answer
391
views
Find Confirmation Code (FindBug.io) [closed]
I have solve half of the problem by decoding a base64 code that reveal the next URL(https://app.findbug.io/app/task/FinDBuG-CTF2019) but now i don't know what to find or where i tried it with ...
- 3
50
votes
7
answers
15k
views
Is this password scheme legit?
I received an invitation for an IT security fair (https://www.it-sa.de/en).
They additionally delivered a password "Kryptonizer". That is a little card to hang on your keychain with the following (...
- 619
0
votes
1
answer
917
views
Guessing speed in offline password cracking [closed]
What is the current speed an offline password cracking attack can be performed in guesses per seconds?
It is for sure heavily influenced by the used hashing-algorithm and the used hardware. But I am ...
- 3
-1
votes
1
answer
94
views
Is it beneficial to know the first char of a wpa2 hash [duplicate]
All I will need to check is AAAAAAAA - AZZZZZZZ.
So I will only have to check the A's but will checking the A's be faster knowing the first char , I can't see why it would be as it would have to ...
- 109
1
vote
1
answer
4k
views
How long to crack an 8 character WPA2 hash if first char is known
I know the first char is A and it's all upper alphanumeric. Is there a way to estimate how long a mid level single GPU using hashcat would take to crack it?
- 109
0
votes
1
answer
145
views
Security of adding letter in front of passphrase [duplicate]
I am wondering about the security of adding a letter in front of a long passphrase to help me have different passphrases for each site I use while not requiring me to remember several different N word ...
- 3
3
votes
1
answer
9k
views
Combined-Dictionary attack with hashcat, for 4 words passphrases?
Reading the new advice on password which seems to spead easily (at least in my workplace), I was wondering how to use hashcat for cracking four-word password hashes?
Say I have this hash ...
- 1,351
0
votes
1
answer
398
views
Is a thousand character password worth the security on my personal accounts? [duplicate]
As for now:
don't care about user experience, meaning that time spent reading, typing, memorizing password.
not thinking about quantum computing attacks.
8 characters good, 24 characters better, ...
- 103
30
votes
6
answers
6k
views
The most secure way to handle someone forgetting to verify their account?
Suppose we send out email verification to new subscribers that where they have to click on a link to verify their account.
Suppose they forget to verify it, and later try to login.
Should the error ...
- 581
1
vote
1
answer
1k
views
Lost RAR password, is there any way to access my data? [closed]
I lost my winrar password of my file. I need to access it. Is it possible? If yes, how?
- 21
5
votes
1
answer
4k
views
BIOS Password vs. BitLocker Pre-boot PIN
I'm attempting to ensure maximum security for my PC. I'm running Windows 10 Pro on a business-class HP notebook.
Unless I'm mistaken, I understand that both a BIOS password and the BitLocker pre-boot ...
- 151
2
votes
1
answer
229
views
Does knowledge of one or more passwords from my password manager help an attacker crack the master password?
I use a keepass password manager with a master password of more than 100 bits. I keep the password file in cloud storage. If an attacker has my password file, it should be difficult for them to ...
- 1,830
56
votes
9
answers
14k
views
Are randomly-generated passwords starting with "a" less secure?
I generated a password recently for a new account and the first three characters were "aa1".
After exhausting all other attacks, a cracker would start brute forcing. On the assumption they'd start ...
- 715
0
votes
1
answer
1k
views
Can't figure out input format for Hashcat salts with odd characters in salt
I have passwords that are stored by:
Generating a random, 36-character "string" in the range of CHAR(1) to CHAR(256)
Appending this to the entered password
Retrieving the SHA512 hash of the result
...
- 111
2
votes
2
answers
873
views
Does the use of a Hardware Security Module improve the security of a password storage?
Basic Assumptions
Let us assume I work for a company, which aims to authenticate users using traditional usernames and passwords. The company currently uses a slow key-derivation function to hash ...
user163495
2
votes
1
answer
163
views
When knowing an individual's plaintext password history, how much information is expected to be gained with a new password? Do we know this?
The premise: Knowing a persons password history should provide information to help when guessing a new password of theirs.
At an extreme end, with a password history of wildcats, wildcats1, then ...
- 715
3
votes
1
answer
1k
views
How long are password hashes stored locally?
Suppose Alice logs into Windows machine M (which is part of an enterprise network managed through Active Directory). My understanding is that M will contact the domain controller to get Alice's ...
- 99.4k
2
votes
1
answer
9k
views
Estimating Password Cracking Speed Based on GPU?
I was wondering if there was a calculator or formula I could use to find a rough estimation of the time it takes to crack hashes based on GPU. I am trying to assess how much performance I would lose/...
- 21
63
votes
1
answer
18k
views
I found a password with hashcat, but it doesn't work
My assignment required me to find the password for a PowerPoint file (97 - 2003, v. 8.0 - v. 11.0).
I used office2john.py to retrieve the hash, and I removed the file name.
The hash is:
$...
- 681
27
votes
4
answers
7k
views
Does putting salt first make it easier for attacker to bruteforce the hash?
Many recommendations for storing passwords recommend hash(salt + password) rather than hash(password + salt).
Doesn't putting the salt first make it much faster for the attacker to bruteforce the ...
user123540
27
votes
3
answers
7k
views
How bad would a partial hash leak be, realistically?
Even though the current recommendation for storing passwords is the usage of a slow key derivation function such as Argon2, scrypt, PBKDF2 or bcrypt1, many websites still use the traditional hash(...
user163495
0
votes
1
answer
448
views
How to make John the Ripper output example hashes for a given hash type?
Is it possible to make John the Ripper output example hashes for a given hash type given by the --format= option?
This is possible using Hashcat, but currently I look in John the Ripper's source code ...
- 1,207
9
votes
1
answer
3k
views
What local resources are used when bruteforcing a remote service?
What pc resources are used when bruteforcing ?
I mean bruteforcing something online, not hashes.
Do you need a good amount a RAM and a good CPU or it's just about the internet speed ?
- 107
3
votes
1
answer
776
views
Crack 8-char password with known number of set bits
At University, I got some CTFs to do for my security lectures.
Basically, I need to crack an 8-character password (96 possible characters). I know that 42 of the 64 bits are set to 1 and I know the ...
- 133
0
votes
1
answer
1k
views
Limiting the number of duplicate character types in crunch
I'm trying to generate a password list of 10 character passwords containing only a combination of 3 - 6 numbers and 3 - 6 uppercase letters.
I see option -d which allows a set limit of duplicates of ...
- 3
0
votes
1
answer
375
views
Generating passwords with rule: the contents within a 10 characters string must maintain a certain ratio of numbers and letters in no particular order
I'm playing around with Kali and am looking to crack my WPA2 default password.
I started generating 10 character passwords with a charset of solely digits and upper alpha lastnight and after 10 mins, ...
- 3
1
vote
1
answer
339
views
Is there any methods available other than brute force and dictionary attacks?
I am curious to know about the wifi attacks. And I have known a little bit about brute force attack and dictionary attack. Is there any other methods available other than these two...?
- 11
1
vote
1
answer
2k
views
Using BITMAIN AntMiner L3+ for cracking password [closed]
I want to use a BITMAIN AntMiner L3+ miner to crack passwords. How can I do that?
Can I install hashcat agent to L3+ ?
- 11
1
vote
1
answer
143
views
Will SIM‐like PIN on website as second password increase security
On SIM cards, which are used in mobile telephony, PIN (and PUK) is used. Unlike a password, they are locked after some incorrect attempts to prevent brute force attack. If wrong PIN is entered 3 times,...
user204771
0
votes
0
answers
25
views
Security risks in confirming the username instead of confirming the username and password combination [duplicate]
Most of the login pages like Google, Outlook and Yahoo! confirm the username first and then ask for a password instead of confirming the username and password combination altogether. Isn't it less ...
2
votes
2
answers
823
views
Is haveibeenpwned (HIBP) free and reliable? [closed]
I have just started to explore HIBP to check whether we can use HIBP in our public facing interfaces.
AS per my read I have 3 options to check out.
Download the password dictionary and implement my ...
- 121
5
votes
1
answer
222
views
Do ciphers and encoding schemes make passwords more secure?
I recently came across a tech professional advising a user to take some plaintext of their choice, run it through one of these ciphers, convert it to Base64, and then use the result as their master ...
- 989
1
vote
1
answer
657
views
Specify Amount of type of character Crunch
I'm sure these questions pop up a lot, but I can't find one that does what I'm looking for.
So, I'm trying to use crunch to generate a wordlist with specific amounts of each type of character, i.e. 2 ...
- 143
0
votes
0
answers
135
views
Convincing client to drop password validation rules
My client wants to include some rules to validate the passwords his clients can choose when creating a new account. Since his company handles sensitive client data, I think I want to convince him to ...
- 101
0
votes
1
answer
886
views
Benchmark Password Cracking Tools
I want to perform a benchmark for the most popular offline password cracking tools (john the ripper and hashcat)?
What metrics or approach should i take about benchmarking in order to determine what ...
21
votes
2
answers
4k
views
Store Credit Card Information in Password Manager?
For convenience purposes I manage my passwords with the password manager Bitwarden on my personal computer and smartphone with autofill function (but with asking for the master password or fingerprint ...
- 385
0
votes
1
answer
548
views
Can't detect hash type even if I have the password?
I can't found the hash type used in a database hosted in a VM.
My hash is c39e02416d974229752c28d7fcefe6e1, and my password is "azerty123456". I noticed that the user table has a column called ...
- 1
5
votes
2
answers
39k
views
hashcat - cracking a salted sha256
Given a SHA256 hash, and a salt, I am trying to crack the hash using hashcat. Every example I've found used a hashfile as input, is there way to provide salt and hash via commandline without the need ...
- 181
3
votes
1
answer
213
views
Could a cracked password run as a command on the attacker's system?
I recently was made aware of 6 passwords that I use becoming compromised in data leaks, and they are now exposed in plain text.
I don't know how attackers go about cracking passwords or how they ...
- 181