Everybody welcome to the first video in the module.
We're going to be talking about what password cracking is.
Now we've mentioned a little bit in different videos and briefly in different modules but we're going
to take a little bit more of a stab at this.
So a password cracking is the art of taking a password hash and learning the plain text of it just as
simple as that.
There's a few tools out there such as John the Ripper and hash cat that allow you to crack passwords.
There's quite a few more that we're not going to go over in this course but feel Feel free to look out
and expand your knowledge on different types because you might find that one thing is good for another.
While some other application is is best use for what you're trying to do.
Now password cracking really just bases itself down on time complexity.
So how long does it take to crack the complexity of the hash.
Now there are two types of plastic cracking.
There are dictionaries brute force and rainbow tables.
Now rainbow tables have a video in and of itself.
So I'm going to leave that one out of this video but we're going to go over dictionary and brute force
so a dictionary dictionary based attacks load a file that contains a set of plain text passwords on
each line.
And this is also known as a wordless.
So from from here on forward when I say I'm talking about a word list it is a giant list of passwords
in plain text.
Now how this process works is that the password cracker rule that you've provided a hash and it will
go through every password in the word list and then ink or hash the value based on the hashing algorithm
that you have identified your hash as.
And then it will go ahead and compare the hashes one by one until it finds the correct hash.
Now the problem with this is that it's not guaranteed to find the plain text hash and there's a few
steps you can do such as mutate the word list or generate your own per assessment.
So such things like cool are Munch or I'm sorry crunch are different tools that you can use to mutate
a word list or even generate your own based on a Web site.
So that's always a good thing to always have on the back your hand.
And a lot of times you don't want to generate your own word listen keep track of every passing you've
cracked for your organization and keep that in one master word list.
That way you can always run your password hashes do that first just see if there's anything quick right
off the top.
You never know you might find plaintext passwords dump them into your work list.
Always have a good shot.
Next step is brute force.
So this takes every combination of a letter digit symbol doesn't matter for a specific length and what
it does is it starts from one character goes to every single character every single symbol then it goes
through the IT use starts at the beginning of the first character again and then the next and then it
adds another character the ending goes to all the possible combinations and it will continue to do that
until it eventually gets to every possible combination up to the character amount that you are sitting
at.
And every time it changes the string that it's looking at it has to rehash this is very intensive very
memory intensive.
But the good news is you're guaranteed to find the plain text of any password brute forcing it.
But there is a downside.
So the downside to brute forcing is depending on the complexity of the hash the password length the
bracket the cracking process can take months years or even thousands or a hundred thousands of years
to crack.
So yes well realistically you could get the end you could get the plain text of the password it is guaranteed
but you'd have to leave the system running for one hundred thousand years with the current computing
power we have we just can't make that happen in a reasonable amount of time.
So brute forcing unless it's between four to five characters maybe pushing six with some special characters
you might be sitting at two four five weeks but you'll eventually get it and with a lot of companies
moving from eight to 12 characters at a minimum brute forcing it's just not as feasible as it once was
unless you plan on spending thousands of dollars or hundreds of thousands of dollars on a W SGP use
just to try to crack passwords if that's the case then it might be worth it in your case but for a normal
red team that's just not in the feasible budget or even for a contractor.
Now for dictionaries The problem is is you're not really guaranteed to find the password if the plain
text of that hash is not actually in the word list you're boned that's it you're done.
So they all have their drawbacks but they all have their uses on a red team.