> For the complete documentation index, see [llms.txt](https://mo-ela.gitbook.io/shifrablog/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://mo-ela.gitbook.io/shifrablog/pentesting/ejpt/password-attacks.md).
# 🔐Password Attacks
Various techniques and tools to attack passwords.
Password when stored must be encrypted a Cryptographic Hashing Algorithm (one-way encryption algorithm) is used to protect from reading by malicious users.
## Password Cracking
> guessing process where attacker hash the gussed pass and compare it to the hashing value optianed from the breached DB.
### 💪BruteForce Attack
Will go through every single Capital/small letter + Number + Symbol combination until it finds the password, **always successful** given **enough time**.
{% embed url="" %}
#### John the Ripper:
> Support Bruteforce+Dictionary attacks agianst Passwords DB+ parallelization.
support nearly 100 Encryption formats
```
jhon --list=formates
```
Assuming we got from breached Linux system:
* /etc/passwd -> users accounts info.
* /etc/shadow -> actual hashed passwords.
we would like to bruteforce certain users with John
1- John needs both info in the same file (**unshadow** comes with it):
```
unshadow passwd.txt shadow.txt > crackme.txt
```
2- use this to pick a certain user to crack(pure BruteForce):
```
john -incremental -users:
```
3- show the cracked password:
```
john --show
```
### 📖Dictionary Attack
> Dictionary of common passwords to test.
make sure your password is secure when it's long (preventing BruteForce) + random (preventing Dictionary), check out this online testing tool:
{% embed url="" %}
**Mangling Words:** variation on 'cat' could be: cat12, caT, CAT, c\@t ...etc. \
another thing that Cracking tools provide.
#### John the Ripper:
to use dictionary attacks in John:
```
john -wordlist= -rules
john crack_me.txt
```
> -rules: to apply mangling.\
> -users= : may also be used to provide list of users.\
> • By not providing a custome worldlist you will use the defualt one.
#### Some helpful Password Dictionaries:
* [SecList](https://github.com/danielmiessler/SecLists)
```
apt -y install seclists
```
> will find your passwords in :\
> /usr/share/seclists/Passwords/leak
### 🌈 Rainbow Tables
[Really Great explaination of what's a Rainbow Table.](https://security.stackexchange.com/questions/379/what-are-rainbow-tables-and-how-are-they-used#answer-172061)
[ophcrack:](https://ophcrack.sourceforge.io/) to crack Windowds Authentication Passwords, tool avilabe for all major OS.
{% embed url="" %}
Another tool is [RainbowCrack ](https://project-rainbowcrack.com/index.htm)Create a Rainbow Table:
```
rtgen
rtgen sha256 loweralpha-numeric 1 10 0 1000 4000 0
```
> 1 10: from a to j.\
> table index: 0\
> 1000 is the length of the chain (how many times we hash ->reduce)
#### Crackin Pss protected MS Office files:
assuming you want to crack a .docx extract the hash first then crack it:
```
/usr/share/john/office2john.py MS_Word_Document.docx > hash
```
> `office2john.py`is a python script used to extract crackable information from the Microsoft Office .docx file.
```
john --wordlist=
```
## 
HashCat
> Another tool that can carry out all the 3 prev. mentioned attacks to crack passwords.
{% content-ref url="/pages/-MglMyGvJlZTsBSfJIT8" %}
[🐱👤Hashcat](/shifrablog/tools/hashcat.md)
{% endcontent-ref %}