‫Password hashes are one of the most important findings of the penetration tests we have seen how to
‫use these hashes without cracking.
‫Remember the past the hash lectures?
‫All other mechanisms, except India Lim or LMA authentication, we need to crack the passwords to be
‫able to use them.
‫Password cracking is the process of recovering passwords from data that have been stored in or transmitted
‫by a computer system.
‫A common approach is try to guess repeatedly for the password and check them against an available cryptographic
‫hash of the password.
‫But we can talk about three basic types of password cracking here.
‫There's, of course, the one that everybody knows brute force attacks.
‫They work by calculating every possible combination that could make up a password and testing it to
‫see if it's the right one.
‫As a password length increases, the amount of time to find the correct password increases exponentially.
‫As you see, the possibility to find a password using a brute force attack is theoretically 100 percent,
‫but cracking the password can take many years, depending on the password complexity.
‫To make the possible value set smaller, it's probably better to use this method if we know something
‫which will reduce the number of tries, such as the length of the password.
‫Now, since users tend to use known words in dictionary attack, we can use previously prepared dictionaries
‫to find the passwords.
‫It's the smarter method as opposed to the brute force attacks and reduce the number of tries dramatically.
‫But in this case, finding the password is not guaranteed.
‫You can find the password only if it's not complicated enough.
‫And of course, it's a good approach to prepare SECTOR-SPECIFIC or company specific dictionaries to
‫increase the chance.
‫A rainbow table is a listing of all possible plain text permutations of encrypted passwords specific
‫to a given hash algorithm.
‫The password cracker compares the rainbow tables, pre compiled list of potential hashes to hashed passwords
‫in the database.
‫The rainbow table associated plain text possibilities with each of those hashes, which the attacker
‫can then exploit to access the network as an authenticated user.
‫Rainbow tables make password cracking much faster than the earlier method.
‫Such as brute force cracking and dictionary attacks, depending on the particular software, rainbow
‫tables can be used to crack 14 character alphanumeric passwords in about 160 seconds.
‫However, the approach uses a lot of RAM due to the large amount of data and such a table.