What is Password Cracking?
Published by Mike McNelis on August 15, 2023
In a secure password-based authentication system, the actual password isn’t stored to avoid easy access by hackers or malicious insiders. Instead, these systems store a password hash, which is generated by processing the password and a random value (called a salt) through a hash function. Hash functions are designed to be one-way, making it difficult to reverse-engineer the original password from the hash.
Password cracking involves extracting passwords from their hashes. This process can be done through various methods:
- Dictionary Attack: This method uses common passwords and their variations to quickly crack many passwords.
- Brute-Force Attack: This method tries every possible combination of characters to eventually crack the password, though it can be time-consuming.
- Hybrid Attack: A combination of dictionary and brute-force attacks, starting with a dictionary attack and moving to brute-force if needed.
Several tools are available for password cracking:
John the Ripper
John the Ripper is an open-source tool that can crack a variety of password types across different operating systems. It also supports additional features in its pro version.
Brutus
Brutus is a versatile remote online password-cracking tool for Windows, supporting various authentication types and offering customization options, despite not being updated in recent years.
Wfuzz
Wfuzz specializes in web application password cracking through brute-force attacks. It also detects hidden resources and injection vulnerabilities.
THC Hydra
THC Hydra is an online tool that uses brute-force attacks to crack passwords. It supports many network protocols and is easily extensible with new modules.
Hashcat
Hashcat is a widely-used password cracker that supports over 300 different types of hashes. It allows for simultaneous cracking across multiple devices and includes features for performance optimization.
L0phtCrack
L0phtCrack focuses on cracking Windows passwords using both dictionary and brute-force attacks. It also offers scheduled password security scans.
Aircrack-ng
Aircrack-ng is used to crack Wi-Fi passwords by analyzing encrypted packets and applying various cracking algorithms. It’s available for Linux and Windows.
Medusa
Medusa is a command-line tool designed for fast, parallel brute-forcing of various protocols. It can target multiple usernames or email addresses simultaneously.
RainbowCrack
RainbowCrack simplifies password cracking using precomputed tables of password/hash pairs. It supports various hash types and is available for Windows and Linux.
OphCrack
OphCrack is a free tool for cracking Windows passwords using rainbow tables. It’s popular for its ease of use and compatibility with multiple operating systems.
Tips for Creating Secure Passwords
To protect against these cracking methods, use long, random, and unique passwords. Avoid using common words, personal information, or predictable patterns. Incorporate a mix of characters, numbers, and special symbols to increase complexity.
