🔐Password Attacks
Various techniques and tools to attack passwords.
Last updated
Was this helpful?
Various techniques and tools to attack passwords.
Last updated
Was this helpful?
Password when stored must be encrypted a Cryptographic Hashing Algorithm (one-way encryption algorithm) is used to protect from reading by malicious users.
guessing process where attacker hash the gussed pass and compare it to the hashing value optianed from the breached DB.
Will go through every single Capital/small letter + Number + Symbol combination until it finds the password, always successful given enough time.
Support Bruteforce+Dictionary attacks agianst Passwords DB+ parallelization.
support nearly 100 Encryption formats
Assuming we got from breached Linux system:
/etc/passwd -> users accounts info.
/etc/shadow -> actual hashed passwords.
we would like to bruteforce certain users with John
1- John needs both info in the same file (unshadow comes with it):
2- use this to pick a certain user to crack(pure BruteForce):
3- show the cracked password:
Dictionary of common passwords to test.
make sure your password is secure when it's long (preventing BruteForce) + random (preventing Dictionary), check out this online testing tool:
Mangling Words: variation on 'cat' could be: cat12, caT, CAT, c@t ...etc. another thing that Cracking tools provide.
to use dictionary attacks in John:
-rules: to apply mangling. -users= : may also be used to provide list of users. • By not providing a custome worldlist you will use the defualt one.
will find your passwords in : /usr/share/seclists/Passwords/leak
Really Great explaination of what's a Rainbow Table.
ophcrack: to crack Windowds Authentication Passwords, tool avilabe for all major OS.
Another tool is RainbowCrack Create a Rainbow Table:
1 10: from a to j. table index: 0 1000 is the length of the chain (how many times we hash ->reduce)
assuming you want to crack a .docx extract the hash first then crack it:
office2john.pyis a python script used to extract crackable information from the Microsoft Office .docx file.
Another tool that can carry out all the 3 prev. mentioned attacks to crack passwords.
