How Passwords are Cracked - # - Part 2

Password hashes can be stolen in many ways.

For example, via sequel injection attacks on a website that extracts the hashes from the database, a sequel injection attack happens when a website does not validate the input of the data it receives.

And because of that, you can send direct. Queries to the database and ask it.

Would you mind very much just giving me your password hashes in the worst case scenario and here, what you can see here is a website that has a collection of hash domes from compromised websites.

You can see LinkedIn E harmony, the dating website.

These are the hashing algorithms.

They use MD five, not very good, should not have used it.

SHA1 also not acceptable.

So you can see even big sites doing it wrong.

And they've got analysis here, so we can check that out, go down here and you can see here, based on this analysis, you feed into your cracking process.

You can see here, there's a significant amount of the use of the word, LinkedIn.

So you would feed that into your rule.

And the rest of this sort of information, like the lenght, the character sets, used character set, frequency, etc, that all goes in back into your re cracking of the hash.

Hashes can also be extracted from operating systems.

If you have local access to the drive, you can do that by mounting the hard drive in another operating system or using a live CD as long as it can Mount in the file system.

And here we are, the example of windows we've got LM hashes, we've got NT hash NTLM hashes for the passwords of these users here and in.

These are stored in something called the security account manager or Sam, which is essentially just a file.

And those hashes can be extracted with various tools as an example of one PW dump seven.

And you can see it here, literally dumping the usernames and hashes, and the hashes are then put into cracking tools, which I'm going to show you in a second.

Because offline attacks are not interacting with the crypto system.

They can't defend themselves.

Hashes can't defend themselves.

They're just a bunch of characters in a file.

So the attack can be many, many, many times faster than online attacks.

So think about in the region of 100 billion guesses per second.

Maybe 100 trillion guesses per second, with super multi GPU crackers.

Like the one you can see here and it's this speed, which enables brute force hybrid and custom attacks that we have gone through to work with moderately complex password.

In Keli, you'll see that there are actually lots of cracking tools we get into here.

Password attacks got a hash cap, John, the ripper off crack there's word lists or dictionaries there.

And there's other tools beside these as well.

Let me introduce you to hash cat.

So we need some hashes in order to crack first.

So I've downloaded some public hashes from one of the old crack sites that I've just chosen at random.

And this is a failure hashes dot TXT.

So I'll just count that so you can see it so there you go.

And see all of the hashes there.

Stop that for a minute.

So we want to crack these and work out what the password is for each of these hashes.

Sometimes you won't know what sort of hash or key to radiation combination that you have.

So you can try using hash ID with a hash and see what sort of results you get.

And we can see here that this is possibly a number of different hashes, but I actually know that this is MD five.

We're going to use a word list or dictionary attack as part of a kind of hybrid attack.

So here's our dictionary.

This is what this looks like.

So you lots of common words that people use for passwords, you can see, it's not actually that big.

Now here's a command we're going to use hash cat.

The -M is a talent. That is MD five.

Those are the hashes.

That's the word list.

And that's just simply the output file.

Let's give it a go.

Let's see what we get.

So the word list as successfully, correct? 22,000.

Out of 500 odd thousand hashes, it was about 4%.

And that was literally in a few seconds with a dictionary attack.

And here we are, same command, but with minus a 1, 1, 4 hashcat is a combination attack, press S for status.

We can see it cracking more files.

Quit that remember this file here.

This is how we can potentially add rules so we can take our dictionary with our input words and then change them to other words.

So here, this would do nothing. If we had that as a rule, that'd be lower case.

We can append characters, you can duplicate the word password password.

So I've got a rules file here.

So I've just had this who got some appending of characters at the end.

We've got F for duplicate word, reversed and colon for do nothing.

So let's save that.

And we append to the end here, our dash dash rules, and then our rules file.

Let's give that a go.

And you can see in literally just a few seconds, we went from 22,000 to 23,000.

So that gives you a flavor of the sort of process that you go through when you're doing password cracking.

And because these were MD five, these are much, much faster to crack and they would be if they'd use their key stretching function. 

You can even try decrypting online.

And there are a number of sites that can enable you to do that.

Check out this link.

It provides a bunch of sites that enable you to do that.

The big one is actually crack station.net and online cracking is actually very viable because it's fast and easy to hire for short periods of time, massively powerful servers.

For example, with AWS, Amazon, you can rent these for short periods of time to crack passwords.

Which is what people do.

It's a time cost exercise, but if the right hash key deviation function, key length and password has been chosen, then it's unlikely to be crack even with all the power.

But sometimes you don't always have to crack the hash.

You can capture it and relay it in a relay attack.

If you're a man in the middle, instead of cracking it, you just forward it on.

After you have captured it, enabling your access to the destination famously windows LM, or NTLM hashes can be relayed due to an authentication floor, which can be done with metasploit in kali.