10 popular tools which are used to crack passwords
The most popular method for user authentication is passwords. Because they are relatively simple for developers to implement and the logic behind them makes sense to people, passwords are extremely popular. Passwords, though, can also result in security flaws.
Password crackers are tools that take credential information that has been compromised in a hack or other data breach and extract passwords from it.
For a walkthrough of some fundamental cracking techniques, please see our article How to Crack a Password.
Instead, authentication systems keep a hash of the password, which is produced by passing the password and a salt—a random number—through a hash function. Given that hash functions are one-way by design, it is very challenging to ascertain the input that results in a particular output. Comparing two password hashes—the one that is stored and the one that was provided by the user—is almost as good as comparing actual passwords because hash functions are also deterministic, which means that the same input results in the same output.
Password extraction from the corresponding password hash is referred to as password cracking. Several methods exist for achieving this:
Dual certifications for pen testing
Discover the resources and methods that cybercriminals use to ethically hack your company.
Cracking passwords is what?
The user's actual password is not kept on file by a well-designed password-based authentication system.
Instead, authentication systems keep a hash of the password, which is produced by passing the password and a salt—a random number—through a hash function. Given that hash functions are one-way by design, it is very challenging to ascertain the input that results in a particular output. Comparing two password hashes—the one that is stored and the one that was provided by the user—is almost as good as comparing actual passwords because hash functions are also deterministic, which means that the same input results in the same output.
Password extraction from the corresponding password hash is referred to as password cracking. Several methods exist for achieving this:
Dictionary attack:
The majority of people use simple, weak passwords. A password cracker can quickly learn a large number of passwords by making a list of words and adding a few permutations, such as replacing $ with s.
There are only so many possible passwords of a given length in a brute-force guessing attack. Even though it takes time, a brute-force attack (testing all possible password combinations) ensures that the attacker will eventually succeed in cracking the password.
Hybrid attack:
These two strategies are combined in a hybrid attack. It begins by determining whether a password can be cracked using a dictionary attack, and if not, it switches to a brute-force attack.These kinds of attacks can all be carried out by hackers thanks to the majority of password-cracking or password-finder tools. In this article, some of the most popular tools for cracking passwords are described.
For a variety of different password types, John the Ripper offers password cracking services. Beyond OS passwords, it also covers widely used web applications (like WordPress), compressed archives, and document files (such as Microsoft Office files, PDFs, and more).
The tool also comes in a pro version, which has better features and native packages for the intended operating systems. Additionally, Openwall GNU/*/Linux, which includes John the Ripper, is available for download.
1. Hashcat
One of the most well-known and frequently employed password crackers is called Hashcat. Every operating system supports it, and it supports more than 300 different kinds of hashes.
With the ability to crack multiple passwords simultaneously on multiple devices and the support for a distributed hash-cracking system via overlays, Hashcat enables highly parallelized password cracking. Temperature monitoring and integrated performance tuning optimize cracking.
Download Hashcat here.
2. John the Ripper
A well-known free open-source password-cracking program for Linux, Unix, and Mac OS X is called John the Ripper. There is also a Windows version accessible.
Download John the Ripper here.
3. Brutus
One of the most widely used remote online password-cracking tools is called Brutus. It asserts to be the best and fastest password-cracking tool available. The only platform this tool is compatible with is Windows, and it is free. It was first made available in October 2000.Several different authentication types are supported by Brutus, including:
- HTTP (basic authentication)
- HTTP (HTML Form/CGI)
- POP3
- FTP
- SMB
- Telnet
- IMAP
- NNTP
- NetBus
Custom protocols
Additionally, it has the ability to support multi-stage authentication protocols and can simultaneously attack up to sixty different targets. It also gives the option to import and resume an attack.
There haven't been any updates to Brutus in a while. However, it is a popular tool for online password-cracking attacks due to its support for a wide range of authentication protocols and the ability to add custom modules.
Visit this page to access the Brutus password finder.
4. Wfuzz
Wfuzz is a web application password-cracking tool similar to Brutus that uses a brute-force guessing attack to try to crack passwords. It can also be used to locate resources that are hidden, such as scripts, servlets, and directories. Additionally, Wfuzz can find application injection vulnerabilities like SQL injection, XSS injection, and LDAP injection.- multiple instances of injection across various directories
- Headers, authentication data output in colored HTML posts, and brute-force authentication
- Support for proxies, SOCK, and multiple proxies
- HTTP password brute-force in multiple threads using GET or POST requests
- The lag in response to requests
- fuzzing cookies
5. THC Hydra
A brute-force password-guessing attack is used by the online password-cracking tool THC Hydra to attempt to ascertain user credentials. It is offered for OS X, Linux, Free BSD, Solaris, and Windows.Download THC Hydra here.
You can help with the development of the tool if you are a developer.
6. Medusa
An online password-cracking tool akin to THC Hydra is called Medusa. It calls itself a quick parallel, modular, and brute-forcing login tool. It works with a variety of protocols, including HTTP, FTP, CVS, AFP, IMAP, MS SQL, MYSQL, NCP, NNTP, POP3, PostgreSQL, pcAnywhere, login, SMB, rsh, SMTP, SNMP, SSH, SVN, VNC, VmAuthd, and Telnet.
Since Medusa is a command-line tool, command-line proficiency is required in order to use it. The speed of password cracking is based on network connectivity. It can test 2,000 passwords per minute on a local system.
Additionally, Medusa supports parallelized assaults. It is possible to define a list of usernames or email addresses to test during an attack in addition to a word list of passwords to try.
More details can be found here.
7. RainbowCrack
All password cracking involves a trade-off between time and memory. The password-cracking process can be reduced to a table lookup if an attacker has precomputed a table of password/hash pairs and stored them as a "rainbow table." Passwords are now salted in response to this threat because hashing each password with a different, random value necessitates using more rainbow tables than usual.
A password-cracking tool called RainbowCrack is made to function with rainbow tables. Rainbow tables can be created from scratch or used that have already been downloaded from the internet. Rainbow tables for the LANMAN, NTLM, MD5, and SHA1 password systems are available for free download from RainbowCrack.
Download these rainbow tables.
There are also a few paid rainbow tables available, which you can purchase from this page.
The Windows and Linux versions of this tool are both accessible.
Click here to get RainbowCrack.
8. OphCrack
For Windows, OphCrack is a free password-cracking tool based on rainbow tables. The most widely used Windows password-cracking tool is also compatible with Linux and Mac operating systems. It can decipher NTLM and LM hashes. Free rainbow tables are also accessible for cracking Windows XP, Vista, and 7.
OphCrack also offers a live CD to make cracking easier. OphCrack's Live CD can be used to decrypt Windows-based passwords. This program is free to use.
Click here to get OphCrack.
Here you can download both free and paid rainbow tables for OphCrack.
9. L0phtCrack
OphCrack's substitute is L0phtCrack. It tries to decipher hashed Windows passwords. It employs Windows workstations, network servers, primary domain controllers, and Active Directory for password cracking. In order to generate and guess passwords, it also employs dictionary and brute-force attacks. Symantec bought it, and Symantec discontinued it in 2006. Later, L0pht developers acquired it once more, and in 2009 they released L0phtCrack.
Additionally, L0phtCrack has the capacity to scan standard password security scans. Daily, weekly, or monthly audits can be set, and the scanning will begin at the appointed time.
Find out more about L0phtCrack here.
10. Aircrack-ng
A Wi-Fi password-cracking tool called Aircrack-ng can break WEP or WPA/WPA2 PSK passwords. It examines wireless encrypted packets and then utilizes dictionary attacks, the PTW, FMS, and other cracking algorithms to attempt to decrypt passwords. Both Linux and Windows systems can use it. There is also an Aircrack live CD available.
Here you can find tutorials for Aircrack-ng.
Go here to download Aircrack-ng.
How to make a password that is difficult to guess
We've provided a list of 10 password-cracking tools in this article. These tools use various password-cracking algorithms to attempt to crack passwords. The majority of password-cracking tools are free to use. Therefore, you should always attempt to have a strong password that is challenging to guess. You can use these suggestions as you create passwords.
It is more difficult to crack a password the longer it is: The most crucial element is the length of the password. With increasing password length, a brute force password guessing attack becomes exponentially more difficult. A ten-character password takes hundreds of years to crack compared to a randomly generated seven-character one.
Use letters, numbers, and special characters together at all times: Because crackers must try a wider range of possibilities for each character of the password, using a variety of characters increases the difficulty of brute-force password guessing. Include numbers and special characters throughout the password, not just at the end or as letter substitutions (like @ for a).
Password variety is important because bots are used in credential stuffing attacks to check whether passwords taken from one online account are also used for others. If the same login information is used, a bank account could be compromised by a data breach at a small business. For every online account, use a lengthy, unpredictable, and one-time password.
What not to do when choosing a password
Cybercriminals and password cracker creators are aware of all the "geniuses" that people employ when coming up with their passwords. Several typical password errors that need to be avoided include:
Dictionary attacks are used to quickly test all of the dictionary's words as well as common permutations, to use a word from the dictionary.
Utilizing private information Dictionary words include terms like pet's name, relative's name, birthplace, favorite sport, and so forth. Even if they weren't, there are tools to take this data from social media and use it to create a wordlist for an attack.
Using patterns: Some of the most popular passwords in use today include 1111111, 12345678, qwerty, and asdfgh. They are also on every wordlist used by password crackers.
Character substitutions: Well-known character substitutions include 4 for A and $ for S. Dictionary attacks automatically check for these substitutions.
Only including required numbers and special characters at the end: The majority of people only include the necessary numbers and special characters at the end of the password. Password crackers are equipped with these patterns.
Using common passwords: Organizations like Splashdata release lists of the most popular passwords each year.
They compile these lists by deciphering compromised passwords in the same manner that an attacker would. Never use any of the passwords or similar ones that are on these lists.
Choosing a password that is anything other than long, random, and unique. To securely create and store passwords for online accounts, use a password manager.
.png)
Comments
Google+
To turn on Google+ comments:
Learn More