In this lesson,
we will explore password attacks.
Password attacks are methods used by attackers
to crack or recover a password.
There are several types of password attacks,
including brute force attacks,
dictionary attacks,
spraying attacks,
and hybrid attacks.
First, we have brute force attacks.
A brute force attack
involves trying every possible combination of characters
until the correct password is found.
For example, an attacker might start with A,
then B, then C
all the way through Z,
and then AA, AB, AC
and so on and so forth.
This type of attack is very thorough,
but can be very time-consuming
and computationally expensive,
especially for long and complex passwords.
On the other hand,
if someone is simply using a four-digit pin,
it will only take you about a minute or two
to conduct a brute force attack against this.
This is only about 10,000 possible combinations
going from 0000 to 9999.
And most password cracking software
can crack between 500 to 1000 keys per second
on most modern laptops,
making a four-digit pin extremely insecure
against any offline brute force attack.
Brute force attacks can be mitigated
through increasing password complexity,
increasing password length,
limiting the number of login attempts,
and using multifactor authentication,
and using CAPTCHAS
to prevent online password cracking attempts.
Second, we have a dictionary attack.
A dictionary attack involves using a list
or a dictionary of commonly used passwords
and trying them all.
When it was first introduced decades ago,
dictionary attack actually use real dictionary words
to attempt to crack the password,
but in more recent years,
these tools rely on a hacker's dictionary instead.
For example, in a regular dictionary,
you might find the word written as password, all lowercase,
or password, all uppercase,
or password with a capital P.
But in modern hacker dictionaries,
the word password may appear as those three options
or as one with letters being changed out for numbers
and symbols,
like P
@ symbol,
dollar sign, dollar sign,
lower case W,
zero,
R-D,
or something similar.
When you see the word written
with these kind of symbolic and numerical substitutions,
we call this "Leet Speak",
which is the slang way of talking about
the way former Elite hackers
used to write out their usernames
by adding these special characters and numbers
inside of an otherwise normal looking dictionary word.
Dictionary attacks can be very effective against users
who use common easy-to-guess passwords,
but less effective against complex, unique passwords,
unless they do actually exist within the hacker dictionary,
like most forms are the words password,
administrator, admin, and the word root.
Dictionary attacks can be mitigated
by using the same techniques as brute force attacks,
such as increasing password complexity,
increasing password length,
limiting the number of login attempts,
and using multifactor authentication,
as well as CAPTCHAS
to prevent online password cracking attempts.
Third, we have the password spraying.
Password spraying is a form of brute force attacks
that involves trying a small number
of commonly used passwords
against a large number of users or accounts.
For example, an attacker might try password one
against every account in a company's email system
to see if anyone is using this weak password
to try and protect their email accounts login.
A password spraying attack can be effective
because it avoids account lockups that can occur
after a certain number of failed login attempts
against a single account.
Password spraying relies on the fact that
in a large group of users,
there's a good chance
that at least a few of them
are going to use very commonly known and weak passwords.
Password spraying attacks can be mitigated
by using unique passwords
and, of course,
implementing multi-factor authentication techniques.
Finally, we have a hybrid attack.
And a hybrid attack
simply combines elements of a brute force
and dictionary attack
by starting out a dictionary of commonly used passwords,
but also including variations like adding numbers
or special characters to the ends of the passwords.
This variation can be included in the dictionary itself,
which would make it a dictionary attack
or they can be created dynamically
by your password cracking software
in a true hybrid attack.
For example, an attacker might have discovered
during reconnaissance
that the company requires that everyone uses a password
that contains a eight-character dictionary word
and then append a six-digit random number to the end of it.
So if my dictionary word was fabulous,
and my randomly assigned number was 617238
then my new password would be set as fabulous61238.
So if you know that everyone's password follows this format,
you can use a dictionary based attack
to find the first word like fabulous
and then use a brute force attack
to try every combination from fabulous000001
to fabulous999999
until the correct password is found as fabulous617238.
In this short demonstration,
I will walk you through
how to use the John the Ripper password cracking tool.
John the Ripper, commonly just referred to as John,
is a popular password cracking tool
that has gained a reputation for speed and versatility.
It's primarily used to identify weak Unix passwords
though it supports hashes of many other platforms as well.
Now let's walk through a quick demonstration
of how to use John.
Before starting,
let's ensure John is installed on your system.
On Linux, you can often use it with the "sudo
apt-get install john".
Now I'm using Kali Linux, so it's already pre-installed,
but I'm just going to run through the command really quick
for those of you who doesn't have Kali Linux.
All right.
Password in for sudo, elevated privileges.
Okay, we see John is already installed
and I have the latest version now.
Again, if you didn't have it,
it would've installed it for you there.
Next, let's create a simple file with a MD5 hash
for John the Ripper to crack.
Remember using MD5 for hashing is not recommended
for any actual security purposes due to its vulnerabilities.
This demonstration is for educational purposes only.
Now, if you're going to store passwords,
always use a strong cryptographic hashing algorithm
like SHA-256 combined with a salt.
Now, salting and hashes
involve adding a random string of characters,
also known as a salt
to protect the password before hashing it.
Now, this enhances the security
by preventing any dictionary text
or hashing table lookups like we're about to perform here.
Now let's create this file.
I'm going to use the Echo command
so I'm going to use the "echo -n".
I'm going to put in the word password
and I'm going to make sure I get the md5sum of it.
So I'm going to use a pipe command.
And then one thing to note about
when you use the md5sum command,
it's going to add this hyphen at the end.
So I'm going to use the alt command
to remove that particular character
and then add it to the mypassword.txt file.
I have this command already pre-formatted,
so I'm just going to click enter.
Now, let's look and see this particular file.
Okay, we see we have our MD5 hash.
Next we're going to run a command to get John cracking.
We're going to use the "john --format
=Raw-md5"
and then we're going to specify the particular file
that we're going to use.
And I'm going to use mypassword.txt
or you can use whatever name you have.
Here's that command for you.
Now I'm going to go ahead and click enter.
And we see that was very quick.
And you see highlighted in the orange, the password,
that's the actual password,
showing that it was easily cracked.
And if you note,
right before it said it proceeded with the word list,
meaning that password was already in the list
of all the different hashes,
more so specifically the MD5 hash lookup table.
So all they did was just find the hash for password
and just print it out for me.
And again, that's why it's critical
to make sure that you're using strong passwords
and nothing that's easily and commonly used
because something like John the Ripper
could easily find it in a second.
Something to note,
if you are on the command
and miss the output for some reason,
the hash will not be attempted to be cracked again
and will instead be stored in the /.john/john.pot file,
which is usually under user's home directory.
So really quick, let me show you that.
So we see that MD5 hash is stored in here.
So again, it won't crack it again.
You see how it now states
that there's no password hashes left to be cracked.
That's because it's already cracked
and it's in that particular file.
So if you have this issue,
that's where you need to look.
And if you want to run it again,
you can just simply clear that file
or just delete the file entirely
and then it will create another one
after you run that new John the Ripper command.
So remember, brute force attacks
are used to try all of the possible combinations
for a password in order to crack it,
but they can be very time-consuming and expensive to conduct
from a computational perspective.
A dictionary attack
will use a list of commonly used passwords
from a text file known as a dictionary
to attempt to guess the password.
A password spraying attack
attempts to try the same few passwords
against a lot of different accounts
to try and prevent
locking out of any individual user account
during the online password cracking attempt.
And a hybrid attack
is used to combine the benefits of a dictionary
and brute force attack to find longer, stronger,
and more complex passwords
in less time than a brute force attack could do on it
and so on.
To protect against these attacks,
your organization should require the use of a unique,
long, and complex password,
such as using password managers
to help manage your user's passwords on the network.
Also, to really prevent password attacks
from being successful,
you should enable multi-factor authentication
whenever possible,
since it adds an additional layer of security
by requiring a second factor of authentication to be used
in addition to just a password.