Wifi Password Hashes | Cracking password hashes using Crunch & Hashcat

Want to get started with password cracking and not sure where to begin? In this post, we’ll explore how to get started with it.

Most systems don’t store passwords on them. Instead, they store hashes of passwords and when authentication takes place, the password is hashed and if the hashes match authentication is successful. Password hashes can be stored in different ways depending on the encryption used. Hash cracking usually consists of taking a wordlist, hashing each word and comparing it against the hash you’re trying to crack. This is a variation of a dictionary attack because wordlists often are composed of not just dictionary words but also passwords from public password dumps. This type of cracking becomes difficult when hashes are salted. A hash function is a ONE WAY FUNCTION (You cannot turn the transformed input back to the way it was) which transforms a string of character into a fixed-length series of characters and numbers. Salt is a SERIES OF RANDOM CHARACTERS which are appended to the string before applying a hash function to it. The reason for this is to prevent dictionary attacks. The tools we are going to use to demonstrate cracking password hash in this post is called HASHCAT & CRUNCH. Hashcat and Crunch are great tools because they are free, fast, and can do both wordlist style attacks and brute force attacks. A brute force attack is where the program will cycle through every possible character combination until it has found a match.

hashcat:

Hashcat is the world's fastest and most advanced password recovery utility, supporting five unique modes of attack for over 160 highly-optimized hashing algorithms. Hashcat currently supports CPU's, GPU's other hardware-accelerators on Linux, Windows and OSX, and has facilities to help enable distributed password cracking. Hashcat is capable of reverse engineering information and converting readable information into scrambled coding, which is used to crack password representations. An external file stores a list that can be used in force attacks, and users can configure the number of threads before executing them according to their lowest priority. The program supports hex-salt in addition to hex-charset files, and over 90 algorithms can currently be implemented in an attempt to optimize performance. It was created to be able to hack the most complex of passwords, targeting multiple aspects of coding simultaneously. The current version of the program is regarded as advanced with potential for further development. The program can use ‘brute force’ in direct cracking, apply preconfigured dictionaries, or use rainbow tables in user attempts to gain access to sensitive information. It had a proprietary code base until 2015 but is now released as free software.

Features of hashcat:

1.Dictionary attack

A dictionary attack uses a targeted technique of successively trying all the words in an exhaustive list called a dictionary (from a pre-arranged list of values).

2. Brute Force Attack

In contrast with a brute force attack, where a large proportion key space is searched systematically, a dictionary attack tries only those possibilities which are most likely to succeed, typically derived from a list of words, for example, a dictionary (hence the phrase dictionary attack).

3. Hybrid Attack

It works like a dictionary attack, but adds some numbers and symbols to the words from the dictionary and tries to crack the password.

4. Syllable Attack

It is the combination of both brute force attack and the dictionary attack.

5. Rule-Based Attack

This attack is used when the attacker gets some information about the password.

CRUNCH:

A wordlist is a text document in which we have or create the list of password that is used worldwide or the continuous set of all words or numbers, we use those wordlists to crack passwords using dictionary attacks. Crunch is a word list generator and an easy to use tool for generating a custom made password list used for brute force password cracking. It uses permutations and combinations to generate all possible combinations of the supplied character set(charset). The crunch comes as a standard tool in Kali Linux. This post shows you how easy it is to generate a password list containing all combinations of 26 letters of the alphabet. Custom wordlists are very important for executing successful brute force attacks. Creating a custom wordlist using Crunch on Kali/Win/OSX which hackers use for brute force attacks. We can add all the information we have into our wordlist.

Some features of crunch:

1. Crunch generates wordlists in both combination and permutation ways.

2. It can break up output by a number of lines or file size.

3. Now has resume support.

4. Pattern now supports number and symbols.

5. Pattern now supports upper and lower case characters separately.

6. Adds a status report when generating multiple files.

7. New -l option for literal support of @,%^

8. New -d option to limit duplicate. characters see man file for details.

9. Now has Unicode support.

Crunch Options:

-b: the maximum size of the wordlist (requires -o START)

-c: numbers of lines to write to the wordlist (requires -o START)

-d: limit the number of duplicate characters

-e: stop generating words at a certain string

-f: specify a list of character sets from the charset.lst file

-i: invert the order of characters in the wordlist

-l: allows the literal interpretation of @,%^ when using -t

-o : the output wordlist file

-p: print permutations without repeating characters (cannot be used with -s)

-q: Like the -p option except it reads the strings from a specified file

-r: resume a previous session (cannot be used with -s)

-s: specify a particular string to begin the wordlist with

-t: set a specific pattern of @,%^

-z: compress the output wordlist file, accompanied by -o

Note: Play with hashcat & crunch for some time & you will know how different parameters can save you a lot of time while penetration testing. If the password is longer than 8 characters & salted, it will take forever to crack. So, be clever & choose the right combination of different parameters. See crunch option for more details.

To setup, we’ll need password hash, hashcat, and crunch. So let’s get started.

Facebook - Syarz Asterisk
Twitter - Syarz Asterisk

Instagram - Syarz Asterisk