%20(1).jpg)
What is password cracking?
The process of recovering passwords from a computer or from data that a computer transmits is known as password cracking. This doesn't need to be a complicated technique. The process of breaking a password also involves a brute-force approach that examines every conceivable combination.
How to password cracking guide
If the password is kept in plaintext, the attacker can access every account information by hacking the database. The majority of passwords are currently, however, kept in key derivation function (KDF) storage. This produces a "hash" by taking a password and passing it through a one-way encryption cipher. The password's hash version is kept on the server.
How to work password cracking attacks
Using a GPU or botnet makes it simple to repeatedly attempt various hashed passwords. Due to the fact that most password hash mechanisms employ key stretching algorithms, a brute-force assault requires more resources and time.
If your password employs salting or key stretching, some methods of password cracking become noticeably more challenging. Unfortunately, there are still some services that keep passwords on their servers in an unencrypted or inadequately secured form.
How to create a strong password?
Top-8 password cracking techniques used by hackers
Naturally, hackers prefer to utilize the simplest password-cracking technique that is currently available. The approach used most frequently is phishing, which is detailed below. Targeting a person is the best option as long as they are the weakest component of any security system. There are plenty additional password cracking methods to attempt if that doesn't work.
Despite being a relatively common method of account protection, passwords aren't always the most secure solution. This is particularly true if the person generates a weak password, uses it again, and saves an unencrypted copy of it online. Because of this, the majority of the cracking methods below are rendered worthless when a password manager, biometric information (which has drawbacks as well), or adding a second factor is used.
A typical attempt to crack a password looks like this:
- Get the password hashes
- get the hashes ready for the chosen cracking tool
- Choose a cracking methodology
- Run the cracking tool
- Evaluate the results
- If needed, tweak the attack
- Go to Step 2
Let's now talk about the most widely used password cracking methods. These are frequently used in conjunction for increased impact.
Types of password hacking
1. Phishing
The most common method of tricking a user into clicking on a link or email attachment that contains malware is phishing. Sending an email that appears urgent and official and urges the recipient to respond quickly is typically the way to do this. Ultimately, either password-extracting software is automatically installed or the victim enters his account information into a fake website.
We'll examine a handful of the most popular phishing techniques, each of which is designed for a certain circumstance:
- Spear phishing Prior to the attack, the target tries to collect as much personal information as possible about that person.
- Whaling targets senior executives and makes use of company-specific content, such as a letter from a shareholder or a customer complaint.
- Voice phishing entails a user receiving a phony message from a bank or other organization urging him to call the helpline and submit his account information.
2. Malware
As you've seen, malware is frequently used into phishing techniques as well. However, if the user is sufficiently gullible (which he typically is), it can function without the "social engineering" component. Keyloggers and screen scrapers are two of the most prevalent malware types for obtaining passwords. As their titles suggest, the former uploads the screenshots while the latter transmits the hacker every keystroke you make.
Password stealing virus might also come in other forms. Even while downloading so-called "grayware," a backdoor trojan might provide the user complete access to their computer. These programs, often known as potentially undesirable programs, typically install themselves after selecting the incorrect "Download" button on a website. While the majority may show advertisements or sell your web usage information, some may install considerably more harmful malware.
3. Social engineering
Phishing is a form of social engineering plan that depends on the gullibility of the target audience and may or may not use sophisticated software or hardware to crack passwords.
Social engineering has been revolutionized by technology. Hackers posed as a business owner in 2019 using speech technology and AI, tricking the CEO into sending $243,000 in cash. This attack proved that voice impersonation is no longer the future and that video imitation will become widespread far sooner than you might expect.
In order to obtain as much personal information as possible, the attacker typically contacts the victim pretending to be a representative of some institution. Additionally, there's a risk that, by pretending to be a Google or bank representative, the password or credit card information might be obtained straight away. Social engineering, in contrast to other methods, can be carried out offline by calling or even by physically meeting the victim.
4. Brute force attack
Password hackers can use a brute force assault as a last option if all other methods have failed. Essentially, it is trying every combination until you win the jackpot. However, password cracking tools let you change the attack and drastically cut down on the amount of time it takes to check every possible combination. Once again, the weak links here are the user and his behaviors.
When an attacker successfully uses brute force to crack a password, he assumes the password has already been used and tries the same set of login information on other online services. Credential stuffing is a practice that has become quite common in the wake of data breaches.
5. Dictionary attack
A brute force attack type called a dictionary attack is frequently combined with other brute force attack types. It automatically verifies that the password is not a common phrase like "iloveyou" by using the dictionary. Passwords from other compromised accounts might potentially be added by the attacker. A dictionary attack has a significantly higher likelihood of being effective in such a situation.
Such attacks would swiftly degrade to a straightforward brute force attack if users chose secure passwords that comprise more than one word. The best option is to create a random set of symbols if you use a password manager. If not, a lengthy phrase with at least five words is still excellent. Just remember to use it for each account.
6. Spidering
In addition to brute force and dictionary assaults, spidering is another method for breaking passwords. It entails acquiring information on the victim, which is typically a business, with the assumption that some of that information is used for password development. Making a list of words that can be used to quickly guess the password is the aim.
One can find the following information by looking at the business' website, social media accounts, and other sources:
- Founder name – Mark Zuckerberg
- Founder DOB – 1984 05 14
- Founder’s sister – Randi
- Founder’s other sister – Donna
- Company name – Facebook
- Headquarters – Menlo Park
- Company mission – Give people the means to establish ties with one another and their communities.
All that's left to do is upload it to a reliable password-cracking program and enjoy the rewards.
7. Guessing
Although guessing is not the most widely used password cracking method, it is related to the aforementioned commercial spidering. In certain cases, the attacker only needs to test some of the most widely used passphrases and doesn't even need to obtain any information about the victim. We strongly advise changing your passwords right away if you can remember ever using one or more of the terrible ones on the list below.
Some of the most common passwords worldwide:
123456
123456789
qwerty
password
12345
qwerty123
1q2w3e
12345678
111111
1234567890
Even though fewer individuals are using default or easy-to-remember passwords like "password," "qwerty," or "123456," many still enjoy short and simple phrases. These frequently contain the names of current or former pets, lovers, ex-pets, or terms connected to the service itself, such as its name (lowercase).
8. Rainbow table attack
Obtaining the password as a hash is one of the initial steps in password cracking, as was previously explained. Next, you make a database of popular passwords and their hashed equivalents, and you check to see whether the password you're trying to break matches any of the entries. In order to increase their effectiveness, skilled hackers typically use a rainbow table that includes leaked and previously cracked passwords.
Most frequently, rainbow tables contain all potential passwords, making them incredibly large and requiring hundreds of GBs. However, because much of the information is already present and can be compared to the desired hash-password, they speed up the assault itself. Fortunately, most users can defend themselves against such assaults by using big salts and key stretching, particularly when combining the two.
Two users with the same password will have different hashes if the salt is large enough, let's say 128 bits. This implies that it will take a very long time to generate tables for all salts. The key stretching slows down hashing and reduces the number of attacks an attacker can launch in a given amount of time.
Password cracking tools
Without the appropriate tools, no password cracking can begin. Some computational assistance is more than welcome when you have to make an estimate out of billions of possible combinations. Every tool, like usual, has benefits and drawbacks.
Here is a list of the most widely used password cracking tools, in no particular order.
1. John the Ripper
John the Ripper is a free, open-source, command-based password cracking program that is listed on several prominent lists of password cracking tools. It is available for Linux and macOS users, whereas Hash Suite, created by a contributor, is available for Windows and Android users.
Numerous encryption and hash types are supported by John the Ripper. Among them are:
Unix, macOS, and Windows user passwords
Web applications
Database servers
Network traffic captures
Encrypted private keys
Disks and filesystems
Archives
Documents
Additionally, there is a Pro edition with additional functionality and native OS packages. Word lists for password cracking are available for purchase, although free alternatives are also accessible.
2. Cain and Abel
Another well-liked program for password cracking is Cain & Abel, which has approximately 2 million downloads from its official source. But unlike John the Ripper, it makes use of GUI, instantly making it more user-friendly. This, combined with the fact that it runs on Windows, only serves to make Cain & Abel a preferred tool for novices, otherwise known as script kids.
This is a versatile tool with the ability to do a wide range of tasks. When used as a packet analyzer, Cain & Abel may also record VoIP calls, examine route protocols, look for wireless networks, and collect MAC addresses. This program will provide a dictionary or brute force attack option if you already know the hash. Asterisk-covered passwords can also be seen using Cain & Abel.
3. Ophcrack
Rainbow table attacks are the focus of the free and open-source password cracking program Ophcrack. More specifically, it decrypts LM and NTLM hashes, the former of which applies to Windows XP and previous OSs and the latter to Windows Vista and 7. NTLM is also somewhat accessible on Linux and freeBSD. Both of these hash formats are unsafe; a fast computer can break an NTLM hash in less than 3 hours.
Ophcrack used a rainbow table that contains letters, numbers, and uppercase characters to crack an 8-symbol password in about six seconds, as shown in the screenshot above. That contains even more variables than a typical password does.
This utility includes free rainbow tables for Windows XP, Vista, and 7, as well as a functionality for easy password brute force attacks. There are versions of Ophcrack for Windows, macOS, and Linux.
4. THC Hydra
The strength of THC Hydra may not lie in the number of heads it may possibly produce, but rather in the vast array of protocols it appears to be supporting. This free software can be used to crack network login passwords for a variety of protocols, including Cisco AAA, FTP, HTTP-Proxy, IMAP, MySQL, Oracle SID, SMTP, SOCKS5, SSH, and Telnet.
Using wordlists created by other tools as well as brute force and dictionary attacks are some of the techniques accessible with THC Hydra. The multi-threaded combination testing used by this password cracker is what gives it its reputation for speed. Even many protocols can be checked simultaneously. On Linux, macOS, and Windows, THC Hydra is accessible.
5. Hashcat
Hashcat is a free open-source program that works with Windows, macOS, and Linux and bills itself as the quickest password breaker in the world. It provides a variety of methods, ranging from straightforward brute force attacks to hybrid masks with wordlists.
Hashcat is capable of using both your CPU and GPU simultaneously. This speeds up the process of simultaneously breaking numerous hashes. But the sheer number of supported hash types is what makes this tool really ubiquitous. Hashcat can decrypt a wide range of hashes, including MD5, SHA3-512, ChaCha20, PBKDF2, Kerberos 5, 1Password, LastPass, KeePass, and many others. Indeed, it supports more than 300 different hash types.
However, you must first know the password hash in order to start cracking. Here are a few of the most widely used devices for obtaining hash:
- Mimikatz. Mimikatz, a password audit and recovery tool, can also be used to retrieve malicious hashes. In fact, it might as well extract PIN numbers or plaintext passwords.
- Wireshark. You may carry out packet sniffing with Wireshark. It is a renowned packet analyzer used by organizations in industry and government in addition to hackers.
- Metasploit. This methodology for penetration testing is well-liked. Hackers can access password hashes using Metasploit, which was created for security specialists.
How to create a strong password?
No matter how good your memory or password manager is, using a bad password will result in unfavorable outcomes. Password cracking tools, which were covered in this post, may break weak passwords in a matter of days, if not hours. Because of this, we feel compelled to reiterate some of the essential advice for creating a strong passphrase:
- Length. As is frequently the case, length is crucial.
- Combine letters, numbers, and special characters. As a result, there are now far more conceivable combinations.
- Do not re-use. Even if your password is strong in theory, re-using it will leave you vulnerable.
- Avoid easy-to-guess phrases. A word that is on your license plate, your pet's collar, or the dictionary is a big NO.
Check out our article on how to establish a strong password if you want to learn more about creating secure passwords. Additionally, you can use our password generator to help you create secure passwords.
Cybernews pro tip
By using a password manager like NordPass, you won't have to worry about setting many strong passwords if you lack the confidence to do so. Military-grade encryption and unbreakable passwords are used by NordPass.
Create secure passwords using NordPass.
Is password cracking illegal?
There isn't a simple solution to this. To begin with, every password-cracking tool mentioned above is completely legal. That's because they are essential for identifying vulnerabilities and can support password recovery. These tools also aid law enforcement in the fight against crime. Password cracking can therefore benefit both good and harmful causes, as is typically the case.
Password cracking as a practice depends on two variables. First, the hacker lacks permission to access that specific data. The second objective is to misappropriate, destroy, or steal the data. Even if just one of these circumstances applies, a hacker will likely be punished with anything from a fine to many years in jail.
In conclusion, cracking is forbidden if there is no bug bounty, no agreement to conduct a penetration test, and no request for assistance in recovering a forgotten password.
Bottom line
Cracking passwords is simpler than most users believe. There are several free tools available, and some of them are simple enough for new crackers. There are several password breaking methods to attempt as well. Password cracking is developing every day, starting with a straightforward brute force attack and progressing to sophisticated algorithms that combine many techniques.
Password hacking technique guide
Using a strong password is your best line of defense against password cracking. Even the fastest computer won't be able to break your account in this lifetime if you use enough symbols and unique letters. The best option is to utilize a trusted password manager because it is doubtful that you will remember several strong passwords. A finger or face ID will protect your data, at least in the near future, as two-factor authentication is still a pain in the back for hackers.
