Questions tagged [password-cracking]

for questions relating to the cracking of passwords and the practices to mitigate against passwords being cracked.

Filter by
Sorted by
Tagged with
2
votes
2answers
179 views

How safe is this scenario security wise

In a project I am working on, I needed to write some cron job scripts, which purpose is, to access some external API's, which have information that shouldn't be accessible by the public. The external ...
0
votes
1answer
42 views

Is there a way to customize the authentication mechanism on an Android Device?

Android comes with authentication mechanisms like the lockscreen pattern. Is there a way to customize those patterns (e.g. adding nodes, changing colors, modifying the ruleset)? Or can I even ...
1
vote
2answers
272 views

Check the “security” of a password [closed]

I'm trying to find a tool to validate the security of a password and I've come across cracklib or libcrack2 (on Debian), which seems to be used a lot for the task and appears to do exactly what I ...
0
votes
1answer
2k views

John the Ripper Character Lists

How is it possible to use or prioritize umlauted characters - ä ö ü ß Ä Ö Ü - whilst brute forcing. I'm not using any wordlist, only dozens of CPU threads via the following command : ./john --fork=...
0
votes
1answer
426 views

Why is the password hashes in my database the exact same for all my users? [closed]

The hash is 1a469f2c34699d2b4ac3343fe6020a, all of my users passwords have this password hash when i looked in the database. So if I would try to crack a users password how am I supposed to do that if ...
1
vote
2answers
166 views

Protecting Passwords Using Short Hash Length

Does anybody use deliberately short hash lengths for passwords to increase the chance of false positive collisions in the event of a brute force attack on the database? When trying to decide on a ...
1
vote
0answers
4k views

John the Ripper doesn't use my wordlist file properly

When I use JtR to crack an encrypted zip file I have, it seems like JtR doesn't go through the wordlist I have ... I do the following steps: $ brew install john-jumbo $ export PATH=$PATH:/usr/local/...
11
votes
4answers
4k views

What's the best length for randomly generated passwords? (Security vs. compatibility)

It's generally recommend to use a unique password for each online service, a random password generator to create them and a password manager to store them. I've started to replace all my online ...
2
votes
1answer
942 views

JtR with Excel 2013

I need to recover a PW for an Excel 2013 workbook. I am using Kali. When I try to run the workbook or any individual tab through Office2John, I get "Invalid OLE file". So I renamed to .zip, extracted ...
1
vote
2answers
86 views

How (un)safe is it to protect an admin page with a simple query-string password? [duplicate]

I have a very simple admin web page that simply displays feedback messages left by users of my mobile app. The messages are sent from the app to a web server, and to view the messages one needs to ...
2
votes
1answer
392 views

Are there bruteforce programs that use letters of other languages? Arabic? Greek?

I came across a site that had the password strength meter. I tried using 'password' and the meter did not like my password. Then I happened to try 'password' but I used the arabic translation for 'a' ...
-1
votes
1answer
625 views

How do I find out how long a password is for a 7zip aes 256 encryption? [closed]

I lost password to a 7zip, nothing important in it. But i'll still like to access it. I heard there is a way to find out how long the password is, but I dont know how.
0
votes
3answers
267 views

how to protect from LM hash cracking

I have read that modifying the NoLMHash value in the registry can prevent LM hashing, but I still can dump the hash after doing this. What does this key do? How can I prevent LM password hash dumping ...
0
votes
1answer
4k views

John the ripper not displaying cracked password [closed]

When using john to crack Windows LM hashes it says it has cracked the passwords but does not display anything. See image below. https://imgur.com/SnltTPK
4
votes
2answers
809 views

When hashing, do longer messages have a higher chance of collisions?

While discussing maximum password lengths, a poster made this comment: The longer the allowed input, the easier to supply an input that could cause a hash collision To explain (since the lack of ...
4
votes
1answer
7k views

Hash list for practicing password cracking

I am looking for resources like a hash cracking competition, but offline. More like a practice list of specifically crafted "passwords" hashed for the purpose of testing various cracking techniques. ...
3
votes
3answers
183 views

Password Hashing Flaw

Disclaimer: I know about the dangers of rolling your own auth, this example is intended to be used in a demo for various hashing methods. I wrote this Node.js func to run server side to reinforce ...
1
vote
1answer
386 views

Passwords - extended dictionary vs dictionary attacks

Taking inspiration from Diceware and the other passphrase generators, I took a dictionary of 20k English words and used a script to generate typos of them, resulting in 7M "words", giving 22.7 bits of ...
1
vote
3answers
114 views

Password hashes with large internal state

scrypt was designed to use a lot of memory, and if all that memory wasn't used it would be some orders of magnitude slower to compute. Either way, it counters custom hardware attacks, where there ...
0
votes
1answer
968 views

John the Ripper MaxLen

From the documentation MaxLen = LENGTH Maximum password length to try. The default is 8 (or CHARSET_LENGTH as defined in src/params.h at compile time). I've compiled it to support up to 62 ...
3
votes
1answer
162 views

Is there a convenient way for a CS representative to verify the caller's id without compromising security (too much)?

As of now, we're accomplishing this by hashing, salting and storing the first three characters of the customers' passwords in one table and hashing, salting, and storing the full password in another ...
0
votes
1answer
199 views

Will I jeopardize security if I store the first three characters (hashed) in a separate table?

In order for a customer service representative to identify a customer, they'd like to ask the customer for the three first characters of her password. The minimum length of the password is currently ...
2
votes
1answer
426 views

Is there a well-researched and user-friendly solution to the password problem? [closed]

The Password Problem has been spoken on many times, but most places I've seen offer terrible solutions such as modifying a dictionary word, changing your password requirements to include special ...
6
votes
2answers
7k views

Cracking MD4 hash

I'm doing some hacking exercices and I have to gain access to a site's database so I can delete all records. The way of getting into the administrator panel is through a password (no username). I've ...
1
vote
1answer
162 views

Do I need high password security if I also require a Client Certificate for validation?

Due to an ongoing discussion in my office, I was wondering if anyone had any comments on whether password hashing security needs to be very strong if client certificate validation is also required for ...
-2
votes
3answers
2k views

Is it useful to hash the password before sending to server for authentication? [duplicate]

In the design of a backend database, the password field suppose to be hashed using bcrypt. There are two approaches backend only: password = bcrypt(plain_passsword) frontend + backend = password = ...
0
votes
0answers
43 views

Should I use a Password manager or just use different passwords? [duplicate]

Reading this article on the BBC titled: Password guru regrets past advice It advises that people now use Password Managers: It recommended that organisations abandoned a policy of pushing their ...
1
vote
2answers
142 views

Securing data after laptop is lost or stolen

We have laptops encrypted and password protected. The scenario we're struggling is if user lose or report stolen laptop. Disabling workstation in AD and doing the rest standard procedures does not ...
-1
votes
1answer
5k views

How To Crack The PDF Password? [duplicate]

I need to edit and merge some pdf files which are asking pasword. How can I crack the password?
3
votes
4answers
847 views

Should I vary the length of my completely-random passwords for the best security?

I use LastPass comprehensively, and for each new site/password I almost always have it generate a random password of the same number of characters, allowing letters, numbers, and symbols (except when ...
0
votes
2answers
124 views

I have the password “data/hash”, next what?

In theory, passwords should not be stored in plain text and also it should be avoided to store them as a simple hash, something like md5(password). Is recommended to store the output of the function ...
2
votes
2answers
270 views

Proof of Work as password hash a good idea?

Our users log in with username/password, and have a cookie that allows them to remain logged in. Our users are expected to run updated versions of JS. Assuming someone snags our database at some ...
0
votes
1answer
357 views

Does a RAM Disk Actually Help When Password Cracking a Small Hash

I've been reading up on RAM Disks and their roles in various uses. The role one no one talks much about is password cracking. I pulled the below quote from here "It's also important to know that hard ...
3
votes
2answers
3k views

Should I use rainbow tables or bruteforce (NTLM)?

As part of security testing, I will receive around 150 to 200 Active Directory password hashes from Windows Server 2012 R2 (using NTLM?). I have found NTLM rainbow tables (1,5 TB total), that covers ...
19
votes
5answers
7k views

Someone is trying to access my mail account, what safe actions can I take?

Intro I have a free mail account on this (german) website. If I type my password wrong I get, once successfully logged in, a message telling me about my failed log-in attempt. Problem Recently I ...
1
vote
1answer
123 views

Does the length of Salt data influence how hard or easy it would be to crack/match a hashed password?

Does any guidelines or best practices exist when it come to choose the length of the Salt data. Does it matter in the effort a hack has to put to match the dictionary (or rainbow) table with the ...
0
votes
3answers
113 views

Are Salt strings stored by application? [duplicate]

1) As storing passwords in plain text in databases are not secure and so is not a good practice. password stored in db = "abcde" (plain text) 2) To avoid this, passwords are stored after being hashed ...
5
votes
3answers
1k views

What are human weaknesses at generating a password which shall be random? [closed]

Assuming I know a person who made-up a password with the goal that it should be random because he will use it for a important service. I would like to figure out how I can increase my chance to guess ...
0
votes
1answer
156 views

How to recover account with an old phone number?

Over the last few years many online portals, email and social networks have linked user accounts with mobile numbers that can be used for account recovery, this way was pretty cool and secure as well. ...
1
vote
1answer
145 views

When is a password “secure enough”? [closed]

Suppose you have a lock on your door with a keypad 0-9. A person can enter a digit combination of maximum 10 characters. They get three attempts before the door is locked for 1 hour. If you had that ...
2
votes
5answers
335 views

Cryptography: Encrypting with password without storing it

I'm working on a desktop application where we handle sensitive data and we want to encrypt local files with a password that we ask the user when he opens the application. On most similar project, we ...
5
votes
1answer
747 views

How many known time/result combinations does it take to guess a HOTP/TOTP secret?

I thought about "recovering", "determining", "guessing", "calculating" or "reproducing" the HOTP/TOTP secrets when only the outcome (6-digit code + time) is known. In case we can view the live ...
1
vote
1answer
2k views

How many passwords per second can a typical computer check? [closed]

I wanna know how many passwords per second my computer can check this is for brute force attacks. I looked everywhere and on this website and the computer listed on here are nothing similar to the one ...
1
vote
1answer
132 views

Password manager or two -actor authentication

For the critical services, is it safer to have different complex passwords and a password manager or the same password for every service and a two-factor authentication? The password manager is risky ...
2
votes
1answer
530 views

What does ssh-keygen's -a option really mean?

I discovered the newer OpenSSH format for storing SSH private keys (ssh-keygen -o) uses bcrypt to generate the symmetric key to encrypt the private key. I understand that the -a option is used to ...
1
vote
0answers
438 views

test SSH private key from STDIN

I recently re-encrypted my SSH private key to use the new OpenSSH format with lots of KDF rounds (-o -a 200) (takes about 2 seconds to run on my CPU). Unfortunately, I mistyped my passphrase in ...
1
vote
1answer
185 views

Changing Structure of SAM database to disable LM usage

SAM database normally holds LM and NTLM hashes of local computer. Recently we applied configurations for disabling NTLMv1 usage in enterprise network . After that we mitigated LM hash usage on SMB ...
-1
votes
1answer
109 views

Are there any sources on how common the most frequently used passwords are? [closed]

For example, I'm trying to work what percentage of passwords are within the top 500 most common passwords.
0
votes
1answer
80 views

Decline right password on first time

I was thinking about password security and thought about a possible way to slow down brute force attacks. The imaginary login process should simply decline passwords one or two times, even when they ...
5
votes
2answers
2k views

How to brute-force a somewhat remembered aescrypt password?

I have a file I encrypted with AES via aescrypt about 5 years ago. I remember a lot of things about the password with several prefixes and suffixes. I have experience as a programmer but not with ...