#password-cracking — Public Fediverse posts

Stop Guessing, Start Measuring: The Cold Math of the Passphrase Transition

1,644 words, 9 minutes read time.

The Structural Collapse of the Legacy Password

The traditional eight-character alphanumeric password is a broken line of defense that offers nothing more than a false sense of security. For decades, users have been instructed to construct complex strings filled with uppercase letters, numbers, and obscure symbols, under the mistaken belief that this fragmentation creates an impenetrable barrier. The contemporary threat landscape has rendered these legacy methodologies entirely obsolete, as attackers no longer rely on manual guessing but on automated, high-velocity cryptographic assaults that exploit the inherent predictability of human patterns. To survive in this environment, enterprise architecture must shift toward the passphrase, a credential strategy rooted in length rather than fragmented complexity. This analytical deep dive will demonstrate that information entropy heavily favors length over a constrained character pool, proving that longer strings fundamentally break the mathematical models used by modern cracking tools. Furthermore, an examination of hardware acceleration will reveal how easily graphics processing units dismantle complex but short passwords through sheer processing volume. The analysis will also expose the human failure point, showing how predictable character substitutions actually aid automated dictionary attacks rather than hindering them. Finally, this post will outline the institutional shift led by regulatory frameworks that officially mandates the transition to high-entropy passphrases as a baseline security requirement.

Why Entropy Defeats Arbitrary Complexity

The security of any credential rests entirely on its mathematical entropy, which measures the total number of possible combinations an attacker must search through to guarantee a successful breach. Legacy security policies focused intensely on expanding the character pool by forcing users to mix uppercase letters, lowercase letters, numbers, and symbols, assuming this diversity would stall an attack. This logic fails because the total search space scales linearly when adding character types, but scales exponentially when increasing the overall length of the string. An eight-character password drawing from an expanded pool of ninety-four possible characters yields a search space that modern computing clusters can exhaust in a matter of hours. Conversely, a twenty-character passphrase composed exclusively of standard lowercase letters draws from a smaller pool of twenty-six characters, yet its sheer length creates a computational search space that is astronomically larger. The exponential power of length completely dwarfs the linear additions of complexity, making the long string mathematically superior in every measurable metric. Security is a game of resource depletion, and forcing an attacker to calculate permutations across a massive length consumes their time and computational power far more effectively than a short, complex puzzle. Relying on symbols to protect a short credential is a fundamental misunderstanding of cryptographic reality.

How Modern Computing Power Obliterates Standard Credentials

The rise of massive hardware acceleration has turned password cracking into an industrialized, automated process that operates at a scale most organizations fail to comprehend. Modern threat actors do not target live login portals where rate-limiting defenses exist; they exfiltrate hashed credential databases and conduct offline attacks using specialized graphics processing unit clusters. A single consumer-grade graphics card can execute billions of cryptographic hash calculations every second, and when multiple cards are parallelized, the throughput becomes devastatingly efficient. Legacy hashing algorithms that were once considered robust offer minimal resistance against this level of raw processing power when the target credential is short. A complex, eight-character password is reduced to a minor computational speed bump when confronted by an array capable of cycling through trillions of permutations in a single afternoon. Passphrases alter this dynamic entirely by forcing the attack automation to scale up its calculations to a point that becomes financially and logistically unviable for the adversary. When a credential possesses sufficient length, the time required to exhaust the mathematical possibilities extends from hours into decades, effectively neutralizing the advantage of hardware acceleration. Organizations that continue to permit short, complex credentials are explicitly ignoring the reality of modern computing capability and leaving their infrastructure vulnerable to rapid automated compromise.

The Illusion of Security in Character Substitution

Human psychology is inherently predictable, and when users are forced to create complex strings that defy natural memory retention, they invariably take shortcuts that automated attack tools are specifically designed to exploit. The common practice of replacing a letter with a lookalike number or symbol does not create randomness; it merely creates a predictable pattern that mirrors basic human behavior. Automated dictionary attacks do not guess randomly across the entire character space from the first second; they utilize highly sophisticated rule sets that automatically apply common substitutions to known words. This means an obfuscated password is often broken just as quickly as its plain-text counterpart because the underlying structure remains entirely unoriginal. Furthermore, forcing users to memorize these fragmented, unnatural strings leads directly to credential reuse across multiple platforms, creating a systemic risk where a single third-party breach compromises the entire enterprise. Passphrases solve this fundamental human vulnerability by leveraging words arranged in a sequence that is easy for a human to remember but entirely disjointed to an algorithm. By aligning credential policy with the way the human brain naturally retains information, organizations eliminate the need for dangerous substitutions and drastic reuse, creating a security model that functions in reality rather than only on paper.

Aligning Enterprise Standards with High-Entropy Passphrases

The transition from short, complex passwords to long passphrases is no longer a matter of structural debate; it is a formalized directive established by major global cybersecurity frameworks. The National Institute of Standards and Technology explicitly overhauled its digital identity guidelines to eliminate the legacy requirements for arbitrary character complexity and forced periodic expiration. Modern compliance frameworks recognize that frequent password changes and complex character mandates directly degrade security by encouraging predictable patterns and user fatigue. The updated standards heavily prioritize credential length, explicitly advising organizations to configure their identity providers to accept long strings while screening out known compromised entries. Implementing this architecture requires a deliberate reconfiguration of active directory environments, single sign-on platforms, and enterprise identity management systems to support minimum lengths of at least fifteen to twenty characters. Legacy applications that artificially restrict input length must be systematically updated or replaced, as they represent a critical vulnerability that prevents the enforcement of modern entropy standards. Failing to align enterprise architecture with these updated frameworks is a failure of technical oversight that leaves an organization legally and operationally exposed when a breach occurs.

The Definite Verdict on Credential Architecture

The data dictates a clear and uncompromising conclusion regarding enterprise credential policy. The legacy framework of short, complex passwords has utterly failed to withstand the realities of modern computing power, automated attack methodologies, and predictable human psychology. Information entropy proves that string length is the primary factor in resisting cryptographic attacks, while hardware acceleration has turned the cracking of short credentials into a trivial task. Human-generated substitutions offer zero protection against sophisticated dictionary rule sets, serving only to complicate user experience while leaving the underlying data vulnerable to exploitation. True security requires a complete rejection of outdated complexity mandates in favor of long, high-entropy passphrases that leverage exponential mathematical growth to exhaust attacker resources. Enterprise infrastructure must adapt immediately to these established standards to mitigate the threat of automated compromise and align with modern regulatory frameworks.

Enterprise identity architecture must be updated to enforce minimum lengths of fifteen to twenty characters to resist automated exploitation.

Information entropy mathematically favors credential length over character set complexity, creating exponentially larger search spaces.

Modern graphics processing unit clusters can rapidly exhaust short, complex credentials through high-velocity offline cracking.

Predictable human character substitutions fail to deceive modern automated dictionary attacks and encourage dangerous credential reuse.

Global security frameworks have officially shifted toward prioritizing length and eliminating arbitrary complexity mandates.

Audit Your Network: Secure Your Enterprise Infrastructure With High-Entropy Passphrases

Stop relying on an obsolete defense strategy that invites catastrophe. Audit your identity providers immediately, systematically dismantle the arbitrary complexity rules that compromise your user base, and configure your active directory to enforce a strict minimum threshold of fifteen or more characters. The transition to high-entropy passphrases is not an operational preference; it is an immediate cryptographic necessity to shield your enterprise from automated exploitation.

D. Bryan King

Sources

• NIST Special Publication 800-63B: Digital Identity Guidelines – Authentication and Lifecycle Management
• CISA: Protecting Against Brute Force Attacks
• CISA: Cyber Threats and Advisory Library
• MITRE ATT&CK: Brute Force Techniques (T1110)
• MITRE ATT&CK: Password Cracking (T1110.002)
• MITRE ATT&CK: Password Spraying (T1110.003)
• MITRE ATT&CK: Password Guessing (T1110.001)
• MITRE ATT&CK: Credential Stuffing (T1110.004)
• MITRE ATT&CK: Credentials from Password Stores (T1555)
• IEEE Xplore: Computational Metrics of Password Entropy
• IEEE Xplore: Analysis of Password Cracking Dynamics Using GPUs
• IEEE Xplore: Human Behavior Patterns in Alphanumeric Character Substitutions
• IEEE Xplore: Performance Optimization of Offline Dictionary Attacks
• OWASP: Password Creation Requirements Control Guidelines
• OWASP Top 10: Identification and Authentication Failures
• OWASP: Comprehensive Guide to Brute Force Attacks
• OWASP: Mechanics of Automated Credential Stuffing
• SANS Institute: The Mathematics of Length vs. Complexity
• SANS Institute: Defending Against Modern GPU Password Cracking Clusters
• SANS Institute: Rethinking Enterprise Password Expiration Policies
• SANS Institute: Implementation Strategies for High-Entropy Passphrases
• ENISA: Guidelines for Secure Password and Authentication Schemes
• Australian Cyber Security Centre (ACSC): Password Governance and Policies
• UK National Cyber Security Centre (NCSC): Password Policy Re-thought
• UK NCSC: Using Three Random Words for Strong Passphrases
• NIST Computer Security Resource Center: SP 800-63B Structural Reference
• BSI Germany: IT-Grundschutz Standards for Authentication
• ACM Digital Library: Analysis of Leaked Password Datasets and Substitution Rules
• ACM Digital Library: Guessing Human Passwords via Probabilistic Context-Free Grammars
• ACM Digital Library: The Security of Length-Based Passphrase Configurations
• ISO/IEC 27002: Information Security, Cybersecurity, and Privacy Protection Controls
• PCI DSS: Document Library for Identity and Access

Disclaimer:

The views and opinions expressed in this post are solely those of the author. The information provided is based on personal research, experience, and understanding of the subject matter at the time of writing. Readers should consult relevant experts or authorities for specific guidance related to their unique situations.

Related Posts

Rate this:

Question about #RainbowTable and #PasswordCracking What is the preferred format today? RT2, RTC, RT (RT1?) and with what tools, rcrack?

I'd like to convert all the https://infocon.org/ rainbow tables into whatever the best format is so everyone that downloads them doesn't have to keep duplicating work.
#InfoSec #InfoCon #hacking

Question about #RainbowTable and #PasswordCracking What is the preferred format today? RT2, RTC, RT (RT1?) and with what tools, rcrack?

I'd like to convert all the https://infocon.org/ rainbow tables into whatever the best format is so everyone that downloads them doesn't have to keep duplicating work.
#InfoSec #InfoCon #hacking

The Register: 60% of MD5 password hashes are crackable in under an hour. “Using a dataset of more than 231 million unique passwords sourced from dark web leaks – including 38 million added since its previous study – and hashing them with MD5, researchers at security firm Kaspersky found that, using a single Nvidia RTX 5090 graphics card, 60 percent of passwords could be cracked in less than an […]

The Register: 60% of MD5 password hashes are crackable in under an hour. “Using a dataset of more than 231 million unique passwords sourced from dark web leaks – including 38 million added since its previous study – and hashing them with MD5, researchers at security firm Kaspersky found that, using a single Nvidia RTX 5090 graphics card, 60 percent of passwords could be cracked in less than an […]

MD5 Password Hashes Cracked in Under an Hour

In a shocking test, Kaspersky researchers cracked 60% of 231 million MD5 password hashes in under an hour using just one high-powered graphics card, revealing the alarming vulnerability of even the most seemingly secure passwords. This unsettling experiment highlights the urgent need for stronger password protection.

https://osintsights.com/md5-password-hashes-cracked-in-under-an-hour?utm_source=mastodon&utm_medium=social

#PasswordCracking #Md5 #EmergingThreats #Kaspersky #Nvidia

@DziadekMick

Your password is weak, regardless of length and complexity, if:

1️⃣ You use it for more than one account.

If not,

2️⃣ The password itself, and/or its cryptographic hash, is present in one or more typically used password dictionaries (used to "crack" passwords).

3️⃣ They determined that some other account on their server was using the exact same password (possibly by comparing hashes).

4️⃣ You've entered it on a fake (phishing) website, or someone saw you typing it, or your app/browser is compromised, or the operating system you use is compromised.

5️⃣ Their server was hacked (or a rogue employee copied and sold account database) while they refuse to inform you (yet).

6️⃣ The password is relatively short and a mechanism to mitigate repeated guesses (or brute force) attacks does not exist (such as definitely applies to encrypted, password protected, files).

This list may be incomplete.

Note: while it may be easy to tell whether it's weak, there's no way of knowing whether a given password is strong. Your best bet: a randomly generated password that's as long as possible - and unique for each account used.

"Strength" increases if you check and confirm that it is not present in dictionaries containing known passwords.

#Passwords #PasswordManager #HashCat #John #PasswordCracking

GPU Price Doesn't Dictate Password Cracking Success

You don't need to break the bank on cutting-edge AI hardware to crack weak passwords - a recent study found that a $30,000 GPU doesn't outperform readily available consumer cards, proving that attackers can succeed with everyday tech.

https://osintsights.com/gpu-price-doesnt-dictate-password-cracking-success?utm_source=mastodon&utm_medium=social

#PasswordCracking #BruteForce #WeakCredentials #EmergingThreats #AiHardware

If you are:

• "abusing" hashcat --stdout or other cracking tools (or bulk string-generation tools) using GNU parallel, and

• you're producing highly duplicate output per process, and

• you need to do low-memory, best-effort dedupe in parallel, per process prior to passing the aggregated output to a final dedupe

... the dedupe tool included in CynosurePrime's rling repo:
https://github.com/Cynosureprime/rling

... really does the trick! Just do:

[parallel stuff] '[cmd] | dedupe' | final-process-thing

Thanks, @Waffle_Real !

#PasswordCracking

If you are:

• "abusing" hashcat --stdout or other cracking tools (or bulk string-generation tools) using GNU parallel, and

• you're producing highly duplicate output per process, and

• you need to do low-memory, best-effort dedupe in parallel, per process prior to passing the aggregated output to a final dedupe

... the dedupe tool included in CynosurePrime's rling repo:
https://github.com/Cynosureprime/rling

... really does the trick! Just do:

[parallel stuff] '[cmd] | dedupe' | final-process-thing

Thanks, @Waffle_Real !

#PasswordCracking

🔑 Password Security Tools – Awareness & Defense Guide 🛡️

Weak or reused passwords remain one of the biggest security risks. Security researchers and penetration testers use password auditing tools (in labs and authorized tests only) to identify vulnerabilities and help organizations enforce stronger authentication.

💡 Commonly Used Tools (Ethical Context Only):
1️⃣ John the Ripper – Classic password auditing tool for multiple formats.
2️⃣ Hashcat – GPU-powered password recovery tool, extremely fast.
3️⃣ Hydra – Network login password tester (SSH, FTP, RDP, HTTP, etc.).
4️⃣ Medusa – Parallel, modular password tester.
5️⃣ Cain & Abel (Legacy) – Windows password recovery & testing suite.

🛡️ Defense Strategies:
✔️ Enforce strong password policies (length, complexity, uniqueness).
✔️ Require Multi-Factor Authentication (MFA/2FA).
✔️ Regularly audit credentials and remove old accounts.
✔️ Use password managers to reduce reuse.
✔️ Monitor for credential leaks in threat intelligence feeds.

🌟 Why It Matters:
Password cracking tools highlight the danger of weak credentials. By understanding them, defenders can build stronger authentication systems and prevent breaches.

⚠️ Disclaimer:
This content is for educational and awareness purposes only. Password cracking tools should only be used in authorized environments with explicit permission. Unauthorized use is illegal and unethical.

#CyberSecurity #PasswordSecurity #InfoSec #EthicalHacking #PenTesting #BlueTeam #PasswordCracking #SecurityAwareness #EthicalTech #Authentication

🔑 Password Security Tools – Awareness & Defense Guide 🛡️

Weak or reused passwords remain one of the biggest security risks. Security researchers and penetration testers use password auditing tools (in labs and authorized tests only) to identify vulnerabilities and help organizations enforce stronger authentication.

💡 Commonly Used Tools (Ethical Context Only):
1️⃣ John the Ripper – Classic password auditing tool for multiple formats.
2️⃣ Hashcat – GPU-powered password recovery tool, extremely fast.
3️⃣ Hydra – Network login password tester (SSH, FTP, RDP, HTTP, etc.).
4️⃣ Medusa – Parallel, modular password tester.
5️⃣ Cain & Abel (Legacy) – Windows password recovery & testing suite.

🛡️ Defense Strategies:
✔️ Enforce strong password policies (length, complexity, uniqueness).
✔️ Require Multi-Factor Authentication (MFA/2FA).
✔️ Regularly audit credentials and remove old accounts.
✔️ Use password managers to reduce reuse.
✔️ Monitor for credential leaks in threat intelligence feeds.

🌟 Why It Matters:
Password cracking tools highlight the danger of weak credentials. By understanding them, defenders can build stronger authentication systems and prevent breaches.

⚠️ Disclaimer:
This content is for educational and awareness purposes only. Password cracking tools should only be used in authorized environments with explicit permission. Unauthorized use is illegal and unethical.

#CyberSecurity #PasswordSecurity #InfoSec #EthicalHacking #PenTesting #BlueTeam #PasswordCracking #SecurityAwareness #EthicalTech #Authentication

So atom, main developer of @hashcat, used the "rapid prototyping in Python" plugin of the new "assimilation bridge" in the new hashcat 7¹, with some success in our DEF CON password CTF win this past weekend (hosted by @jabbercracky).

Afterwards, atom realized it would make a good case study for how to use the new feature, so he wrote it up:

https://hashcat.net/forum/thread-13346.html

If you do exploration of mystery hash types (either for CTFs, or in the real world) ... this approach should absolutely be in your toolbox.

¹Note that some work was done during the contest to make the Python bridge plugin better for these use cases; next minor release of 7 will have it, or grab hashcat.net/beta/ or the latest GitHub main branch.

#PasswordCracking #HashCracking
#hashcat #hashcat7

So atom, main developer of @hashcat, used the "rapid prototyping in Python" plugin of the new "assimilation bridge" in the new hashcat 7¹, with some success in our DEF CON password CTF win this past weekend (hosted by @jabbercracky).

Afterwards, atom realized it would make a good case study for how to use the new feature, so he wrote it up:

https://hashcat.net/forum/thread-13346.html

If you do exploration of mystery hash types (either for CTFs, or in the real world) ... this approach should absolutely be in your toolbox.

¹Note that some work was done during the contest to make the Python bridge plugin better for these use cases; next minor release of 7 will have it, or grab hashcat.net/beta/ or the latest GitHub main branch.

#PasswordCracking #HashCracking
#hashcat #hashcat7

July 15th 1991: 34 years ago I published the first “modern” password cracker…

…or, rather, smeared its development over a few months in response to requests from Unix systems administrators all over the globe – on the Internet and/or several other networks. It was a spark that still glows, but also helped inform the way Infosec developed as a discipline, notably arguments about full disclosure.

Gosh I feel old.

https://www.youtube.com/watch?v=BrxJlp_3utk

#computerHistory #crack #passwordCracking

16 Billion Passwords Stolen From 320 Million+ Computers Leaked Online https://gbhackers.com/16-billion-passwords-stolen-from-320-million-computers-leaked-online/ #CyberSecurityNews #PasswordCracking #cybersecurity #FACEBOOK #Google #Apple

16 Billion Passwords Stolen From 320 Million+ Computers Leaked Online https://gbhackers.com/16-billion-passwords-stolen-from-320-million-computers-leaked-online/ #CyberSecurityNews #PasswordCracking #cybersecurity #FACEBOOK #Google #Apple

Super cool write-up from the winning team of the CrackTheCon #passwordCracking contest.

https://hashmob.net/writeups/HashMob.net%20-%20CrackTheCon%202025%20write-up.pdf

Super cool write-up from the winning team of the CrackTheCon #passwordCracking contest.

https://hashmob.net/writeups/HashMob.net%20-%20CrackTheCon%202025%20write-up.pdf

Well, this cracking attack is going to take 5.5 days on 2x 4090s.

#PasswordCracking #hashcat

Well, this cracking attack is going to take 5.5 days on 2x 4090s.

#PasswordCracking #hashcat

🚨 Oh no! GNU Screen has "security issues"—quick, everyone panic! Meanwhile, the tech wizards are too busy inventing new buzzwords and password-cracking supertools that sound like rejected Marvel villains to actually fix anything. 🙄🔧
https://www.openwall.com/lists/oss-security/2025/05/12/1 #GNUScreen #Security #Issues #Panic #TechBuzzwords #PasswordCracking #MarvelVillains #HackerNews #ngated

🚨 Oh no! GNU Screen has "security issues"—quick, everyone panic! Meanwhile, the tech wizards are too busy inventing new buzzwords and password-cracking supertools that sound like rejected Marvel villains to actually fix anything. 🙄🔧
https://www.openwall.com/lists/oss-security/2025/05/12/1 #GNUScreen #Security #Issues #Panic #TechBuzzwords #PasswordCracking #MarvelVillains #HackerNews #ngated

TIL if you generate and store all even faintly possible IPv4 IPs - 0.0.0.0 through 255.255.255.255 - as ASCII strings ... it takes about 58GB.

This is a #HaveIBeenPwned subtoot. 😜

#PasswordCracking

TIL if you generate and store all even faintly possible IPv4 IPs - 0.0.0.0 through 255.255.255.255 - as ASCII strings ... it takes about 58GB.

This is a #HaveIBeenPwned subtoot. 😜

#PasswordCracking

Password crackers:

If you're still mashing up all of your wordlists into a single monolithic file for deduplication purposes ... let me suggest an option that scales better, simply by approaching the problem differently:

Deduplicate each new source as it arrives, and then add it to a repository, by removing all strings already in your repository ...and then preserve it as a separate file! (You might call this the "sort once, deduplicate often" method.)

https://blog.techsolvency.com/2025/04/managing-unique-wordlists-password-cracking.html

The key benefit: the memory usage required is a factor of the size of the new file alone, rather than of the entire corpus.

Also useful for other medium-sized "dedupe a recurring stream of new sets of strings over time" use cases.

(And if you're not doing this anymore, now you have a reference to share with the folks who still are!)

#PasswordCracking

Password crackers:

If you're still mashing up all of your wordlists into a single monolithic file for deduplication purposes ... let me suggest an option that scales better, simply by approaching the problem differently:

Deduplicate each new source as it arrives, and then add it to a repository, by removing all strings already in your repository ...and then preserve it as a separate file! (You might call this the "sort once, deduplicate often" method.)

https://blog.techsolvency.com/2025/04/managing-unique-wordlists-password-cracking.html

The key benefit: the memory usage required is a factor of the size of the new file alone, rather than of the entire corpus.

Also useful for other medium-sized "dedupe a recurring stream of new sets of strings over time" use cases.

(And if you're not doing this anymore, now you have a reference to share with the folks who still are!)

#PasswordCracking

Top #hashcat tip:

Want per-position duplication in your rules to leverage your GPU?

It's not available in a single op, but you can emulate it by incrementally duplicating the first N chars, and then incrementally deleting the position and frequency of the redundant characters

#password #passwordcracking #pentest #redteam

Top #hashcat tip:

Want per-position duplication in your rules to leverage your GPU?

It's not available in a single op, but you can emulate it by incrementally duplicating the first N chars, and then incrementally deleting the position and frequency of the redundant characters

#password #passwordcracking #pentest #redteam

hello everyone.
in today's article we examine cewl cheat sheet in detail:

i wish everyone a good reading:
https://denizhalil.com/2025/01/27/cewl-cheat-sheet/

#cewl #customwordlist #ethicalhacking #informationsecurity #kalilinux #passwordcracking #penetrationtesting #securitytools

If you need to sort and dedupe a ton of strings/records, Cynosure Prime member blazer has released rlite, a 'lite' version of rling. I helped debug early versions. A nice balance of performant and simple, but with useful knobs like frequency counting, writing dupes to another file, etc.

(And heavy on the 'performant' - multi-threaded sort + dedupe time for 1.4B records in a 16GB file is 45 seconds on 48 EPYC 7642 cores, and uses 26GB of RAM)

https://github.com/Cynosureprime/rlite

#PasswordCracking

If you need to sort and dedupe a ton of strings/records, Cynosure Prime member blazer has released rlite, a 'lite' version of rling. I helped debug early versions. A nice balance of performant and simple, but with useful knobs like frequency counting, writing dupes to another file, etc.

(And heavy on the 'performant' - multi-threaded sort + dedupe time for 1.4B records in a 16GB file is 45 seconds on 48 EPYC 7642 cores, and uses 26GB of RAM)

https://github.com/Cynosureprime/rlite

#PasswordCracking

Next time password cracking comes up conversationally and someone says "And can't you can just use rainbow tables" ... send them this.

https://hashcat.net/faq/rainbowtables

tl;dr They are only worthwhile in a very specific (and rare) set of circumstances.

#PasswordCracking #RainbowTables

Next time password cracking comes up conversationally and someone says "And can't you can just use rainbow tables" ... send them this.

https://hashcat.net/faq/rainbowtables

tl;dr They are only worthwhile in a very specific (and rare) set of circumstances.

#PasswordCracking #RainbowTables

Today's traditional UNIX crypt / descrypt / hashcat -m 1500 trivia.

if you see a descrypt crack ending in \x8a ... no you didn't.

These actually end in \x0a -- descrypt drops all high bits, turning \x8a into \x0a!

#PasswordCracking

Today's traditional UNIX crypt / descrypt / hashcat -m 1500 trivia.

if you see a descrypt crack ending in \x8a ... no you didn't.

These actually end in \x0a -- descrypt drops all high bits, turning \x8a into \x0a!

#PasswordCracking

Password cracking tip:

Grow your ability to understand the math of your attack space.

One nice way to practice this: for a given attack, use Wolfram Alpha (or a calculator, etc.) to roughly confirm the math of your tool's ETA for your attack.

If they don't match, check your assumptions, your setup, or your understanding until they do.

In this example, the total number of guesses scheduled for this attack will take these two GPUs, running at the hashrate shown, a little under 46 days to complete.

https://wolframalpha.com/input?i=%281408965009*47622827%29+%2F+%2816989*1000000*60*60*24%29

Practicing this estimation until you can do it very "back of the napkin" / order of magnitude in your head is valuable, just as it is with any "large numbers" effort / industry / exercise.

#PasswordCracking #hashcat

Password cracking tip:

Grow your ability to understand the math of your attack space.

One nice way to practice this: for a given attack, use Wolfram Alpha (or a calculator, etc.) to roughly confirm the math of your tool's ETA for your attack.

If they don't match, check your assumptions, your setup, or your understanding until they do.

In this example, the total number of guesses scheduled for this attack will take these two GPUs, running at the hashrate shown, a little under 46 days to complete.

https://wolframalpha.com/input?i=%281408965009*47622827%29+%2F+%2816989*1000000*60*60*24%29

Practicing this estimation until you can do it very "back of the napkin" / order of magnitude in your head is valuable, just as it is with any "large numbers" effort / industry / exercise.

#PasswordCracking #hashcat

So ... due to an early obsession with historical BSD hashes ... I have significantly more bcrypt hashrate-per-watt cracking capacity than most solo shops. For bcrypt cost 12, it's about 34Kh/s straight wordlist -- the equivalent of about 17 4090s -- at only 1100W (these old Bitcoin FPGAs are very efficient for bcrypt specifically). And this capacity is intermittently idle, which is kinda a shame.

I haven't really put it out there as something I can help with if needed (outside of the Hashcat team). So ... feel free to ping me if you need bcrypts cracked/audited!

(Reasonable rates, but note that I do have a pretty firmly high bar for provenance / proof of authorization)

(Rat's nest of USB has been cleaned up a bit 😅)

#bcrypt #PasswordCracking #hashing

So ... due to an early obsession with historical BSD hashes ... I have significantly more bcrypt hashrate-per-watt cracking capacity than most solo shops. For bcrypt cost 12, it's about 34Kh/s straight wordlist -- the equivalent of about 17 4090s -- at only 1100W (these old Bitcoin FPGAs are very efficient for bcrypt specifically). And this capacity is intermittently idle, which is kinda a shame.

I haven't really put it out there as something I can help with if needed (outside of the Hashcat team). So ... feel free to ping me if you need bcrypts cracked/audited!

(Reasonable rates, but note that I do have a pretty firmly high bar for provenance / proof of authorization)

(Rat's nest of USB has been cleaned up a bit 😅)

#bcrypt #PasswordCracking #hashing

Team #Hashcat is pleased to present our much anticipated write-up for this year's #CrackMeIfYouCan contest at #Defcon32

📕 Read it here:
https://raw.githubusercontent.com/hashcat/team-hashcat/8a72d338660cc6d8f4f8014bd8e3236f8c59cd6e/CMIYC2024/CMIYC2024TeamHashcatWriteup.pdf

#password #passwordcracking #redteam #ctf #defcon #hacking #infosec #cybersecurity

Team #Hashcat is pleased to present our much anticipated write-up for this year's #CrackMeIfYouCan contest at #Defcon32

📕 Read it here:
https://raw.githubusercontent.com/hashcat/team-hashcat/8a72d338660cc6d8f4f8014bd8e3236f8c59cd6e/CMIYC2024/CMIYC2024TeamHashcatWriteup.pdf

#password #passwordcracking #redteam #ctf #defcon #hacking #infosec #cybersecurity

When a target hashlist has a significantly lower percentage of cracks than expected, I've started calling the remaining/missing cracks "dark matter".

Some potential causes of cracking "dark matter":

• Site changed methodologies later: switched to a nested hash, added a pepper, HSM, true encryption layer, etc.

• High number of automatically random-ish passwords: defaults, resets, bots, randomized on account lock, etc.

• Complexity requirements higher than expected: high minimum length, etc.

• Attacker (me) is missing key info: language, encoding, demographics, etc.

What could other causes be?

#Hashing #PasswordCracking

When a target hashlist has a significantly lower percentage of cracks than expected, I've started calling the remaining/missing cracks "dark matter".

Some potential causes of cracking "dark matter":

• Site changed methodologies later: switched to a nested hash, added a pepper, HSM, true encryption layer, etc.

• High number of automatically random-ish passwords: defaults, resets, bots, randomized on account lock, etc.

• Complexity requirements higher than expected: high minimum length, etc.

• Attacker (me) is missing key info: language, encoding, demographics, etc.

What could other causes be?

#Hashing #PasswordCracking

One example why to use strong #passwords for users who use file sharing over #SMB even when the file transfers are #encrypted.
If the SMB traffic is captured/eavesdropped, then the attacker can try to crack the user password.
The attacker is able to extract challenge/response values from the Session Setup and then use #passwordcracking tools such as #hashcat

If the attack is successful, the attacker will gain not only the access to the user account, but it is also possible to decrypt the captured SMB file transfers. There is lack of perfect forward secrecy in this encryption.

For more details and practical examples, see this blog post:

https://malwarelab.eu/posts/tryhackme-smb-decryption/

#networktrafficanalysis #networktraffic #encryption #netntlmv2 #netntlm #ntlm #windows #fileshare #pentesting #cybersecurity #hardening #password #cracking #offensivesecurity #offsec #blueteam #purpleteam

One example why to use strong #passwords for users who use file sharing over #SMB even when the file transfers are #encrypted.
If the SMB traffic is captured/eavesdropped, then the attacker can try to crack the user password.
The attacker is able to extract challenge/response values from the Session Setup and then use #passwordcracking tools such as #hashcat

If the attack is successful, the attacker will gain not only the access to the user account, but it is also possible to decrypt the captured SMB file transfers. There is lack of perfect forward secrecy in this encryption.

For more details and practical examples, see this blog post:

https://malwarelab.eu/posts/tryhackme-smb-decryption/

#networktrafficanalysis #networktraffic #encryption #netntlmv2 #netntlm #ntlm #windows #fileshare #pentesting #cybersecurity #hardening #password #cracking #offensivesecurity #offsec #blueteam #purpleteam

@tomshardware The only RTX A6000 hashcat benchmark I could find was from v6.1.1 @ 121.5GH/s, but still, that's enough poke to exhaust a full key space 10-char NTLM in 38 days.

#passwordcracking

No, NCSC¹, passphrases of only three (or even four) random words are not sufficient - unless the user knows that the password hashing method is a "slow" one (bad for the attacker). Which is rarely guaranteed.

1025 combinations -- six words from a pool of 20K words, or five words from a pool of 100K words -- should be considered the minimum.

¹https://www.ncsc.gov.uk/collection/top-tips-for-staying-secure-online/three-random-words

#Passphrases
#PasswordCracking

No, NCSC¹, passphrases of only three (or even four) random words are not sufficient - unless the user knows that the password hashing method is a "slow" one (bad for the attacker). Which is rarely guaranteed.

1025 combinations -- six words from a pool of 20K words, or five words from a pool of 100K words -- should be considered the minimum.

¹https://www.ncsc.gov.uk/collection/top-tips-for-staying-secure-online/three-random-words

#Passphrases
#PasswordCracking