Introduction to Encryption, Hashes and Cracking
We can perform basic password cracking with a simple example.
Let’s assume that we gained access to a SHA-256 password hash.
There are various ways we could have gained access to this hash,
but either way we can use sha256sum
to hash various passwords and examine the results.
In this case, we will hash the string “secret”.
We’ll use echo -n to strip the newline from our string
(which would have been added to our string, modifying the hash).
then hash “secret” again,
and finally hash the string “secret1”.
In this example, we hashed “secret” twice
to show that the resulting output hash is always the same.
Notice that the hashes for the “secret” and “secret1”
are completely different even though the input strings are similar.
Also note that the hash for “secret1” matches our captured hash.
This means that we have determined the plaintext password, secret1,
associated with that hash.
Very cool.
However, this is a very simple and awkward way to crack password hashes.
Fortunately there are much better tools available.
Hashcat and John the Ripper are two of the most popular password cracking tools.
In general, JtR is more of a CPU-based cracking tool,
which also supports GPUs,
while Hashcat is mainly a GPU-based cracking tool that also supports CPUs.
JtR can be run without any additional drivers
using only CPUs for password cracking.
Hashcat requires OpenCL or CUDA for the GPU cracking process.
For most algorithms, a GPU is much faster than a CPU
since modern GPUs contain thousands of cores,
each of which can share part of the workload.
However, some slow hashing algorithms (like bcrypt) work better on CPUs.
It’s important to become familiar with different tools
since they don’t support the same algorithms.
We’ll examine both tools in this Topic.
Before we begin cracking passwords,
let’s calculate the cracking time of various hash representations.
The cracking time can be calculated by dividing the keyspace with the hash rate.
The keyspace consists of the character set to the power of the amount of characters
or length of the original information (password).
For example, if we use the lower-case Latin alphabet,
upper case alphabet,
and the numbers from 0 to 9,
we have a character set of 62 possible variations for every character.
If we are faced with a five-character password,
we are facing 62 to the power of five possible passwords
containing these five characters.
Since it’s important to be able to calculate this,
let’s use a terminal to calculate the keyspace for a five-character password.
We’ll echo our character set to wc with -c to count every character.
We will again specify -n for the echo command to strip the newline character.
We can then use python3 for the calculation,
with -c to execute the calculation and print to display the result.
For a five-character password and the specified character set,
we have a keyspace of over 900 million.
This number determines how many unique variations
can be generated for a five-character password with this character set.
Now that we have the keyspace in the context of this example,
we also need the hash rate to calculate the cracking time.
The hash rate is a measure of how many hash calculations
can be performed in a second.
To find the hash rate, we can use Hashcat’s benchmark mode
to determine the hash rates for various hash algorithms
on our particular hardware.
We’ll benchmark a CPU by running it in a Kali VM without any GPUs attached.
We’ll use hashcat with -b to initiate benchmark mode.
On a local Kali system and with different hardware, the results will vary.
The benchmark displays hash rates for all supported modes of Hashcat.
For now, we are only interested in MD5,
SHA1,
and SHA-256.
The values of the hash rates are in Mega Hashes per second
in which 1 equals 1 million hashes per second.
A comparison of our CPU with typical GPU hashrates is shown in this table.
We’ll calculate the cracking time for SHA256
with our previously determined keyspace.
Therefore, we can again use Python to calculate CPU cracking times in seconds.
And GPU cracking times.
The output shows that we can calculate all possible hashes
for this keyspace in under one second with a GPU,
and in approximately eight seconds on a CPU.
Let’s use the same character set
but with an increased password length of 8 and 10
to get a better understanding for how cracking time scales
versus password length.
For this, we’ll use the GPU hash rate for SHA-256 for our calculations.
The output shows that when converted from seconds,
it will take a GPU approximately 6.5 hours to attempt all possible combinations
for an eight-character password,
and approximately 2.8 years for a ten-character password.
Note that increasing password length
increases cracking duration by exponential time,
while increasing password complexity only increases cracking duration
by polynomial time.
This implies that a password policy encouraging longer passwords
is more robust against cracking,
compared to a password policy that encourages more-complex passwords.
In this section, we discussed encryption and hashing,
and we benchmarked various hash algorithms on a CPU and a GPU.
Finally, we familiarized ourselves with the process of calculating cracking time.