PASSWORD ATTACKS

This is a basic lab where you’ll get an overview of 3 password attack tools.

These concepts will be applied in the comprehensive scenario lab.

During this lab, understand the basic functioning of password attack tools with the help of
common use case scenarios.

JOHN THE RIPPER

https://medium.com/@JAlblas/tryhackme-john-the-ripper-walkthrough-75331d14748c

Apt install john(if not already present)

https://www.md5hashgenerator.com/

 Single crack mode

o create a crack.txt file which will contain the username and the hash value(sha1) of
the password(StEaLtH).
 stealth:d776dd32d662b8efbdf853837269bd725203c579
o john --single --format=raw-sha1 crack.txt
 Dictionary mode
o We provide a list of probabale passwords, which ae hashed and matched with the
hashed password.
o Crack.txt with just the hashed password.
 edba955d0ea15fdef4f61726ef97e5af507430c0

o john --wordlist=/usr/share/wordlists/rockyou.txt --format=raw-

sha1 crack.txt
 crack a linux password
o unshadow /etc/passwd /etc/shadow > output.db
o john output.db
 we can also use the –wordlist tag
 crack a zip file password
o create or use an existing zip file.
o Generate password hash of a zip file
 zip2john file.zip > zip.hashes
o crack the hash
 john zip.hashes
 cracking a password protected zip file
o

o
 o

o
 miscellaneous tasks
o cracking /etc/shadow hashes
 unshadow [path to passwd file] [path to shadow
file] > unshadowed.txt
 unshadow passwd shadow > unshadowed.txt
 john --wordlist=/usr/share/wordlists/rockyou.txt --
format=sha512crypt unshadowed.txt
 https://assume-breach.medium.com/hacking-tutorial-how-to-ssh-to-a-remote-system-with-
a-found-private-key-fbe521bf1efa
 These are the main test case scenarios, we can modify these and create new scenarios if
required.

HYDRA

Go through the following documentation and implement the scenarios.

Use ip address of the Ubuntu vm as the target machine. Don’t do the HTTP page password attacks.

 https://www.hackingarticles.in/a-detailed-guide-on-hydra/

Can also go through

https://medium.com/@jbtechmaven/password-cracking-with-hydra-in-kali-linux-e1ed9de14693

HASHCAT

 Cracking hashes in a txt file using hashcat

 o https://www.101labs.net/comptia-security/lab-30-how-to-crack-passwords-with-
hashcat/
 Implement tasks from the following documentation
o https://thehackerish.com/crack-a-password-techniques-and-hands-on-exercise/]
o https://medium.com/@joshthedev/step-14-cracking-passwords-with-hashcat-
9e4f5aebc74
o https://ethicalhackingguru.com/the-complete-hashcat-tutorial/