Cracking Hashes/How-To's And What-Nots

1. Intro

Ive seen a few requests for people to crack hashes, and some people aren't doing it right, just leaving a hash is not enough to help us help you.
This tutorial will walk threw the basics and try and help you out in your future of hashing.

2. Hashes

It is common practice for most web programmers to secure passwords by storing the encrypted value of the password in a database, because if they don't they risk a major security flaw which can harm their customers and themselves.

Hashes are also known as Cryptography, in a way.
Some hashes can decode on purpose, while others you need to brute force.
An example of encryption that allows decoding is Base64.

2.1 Need-To-Know's about Hashes

Widely used Hash Types include:

MD5 | SHA-1 | SHA-2

This means these 3 are the ones you need to be looking into when you grab a hash.

Quote:Type | Word Size| Collision |

MD5 | 32 | | Yes |
SHA-1 | 32 | Yes |
SHA-2 | 64 | No |

2.1.1 Hash Collisions

From the graph I made above you can see MD5 and SHA-1 have Hash Collisions. This means that more then 1 value can equal the same hash value.

This is common sense seeing as MD5 and SHA-1 are both 32 Characters long, and there is a limit of how many 32 random characters you can make, I mean it isnt infinite. So their aught to be a Collision at some point.

Code:

H(a) = H(b) H representing the hash function.

3 Hash Decrypt Sites

many sites host services where you can md5 encode whatever you want, but at the same time this service saves both values for later.
So be aware when you use these services your md5 input and output will be saved in their database for their "md5 decode" service.

A list of Hash Decrypt Sites you can use.

- http://www.cmd5.com/english.aspx (457,354,352,282)
- http://www.md5crack.com
- http://www.hashchecker.com
- http://md5cracker.tk/ (MD5 Search engine by searches a total of 14 on-line crackers.)
- http://www.md5decrypter.com (5,889,729)
- http://www.md5oogle.com
- http://md5-db.com (The database is approximately 70gb)
- http://md5.rednoize.com (56,502,235)
- http://gdataonline.com/seekhash.php (3,251,106)
- http://www.tmto.org/?category=main&page=search_md5 (306.000.000.000)
- http://www.milw0rm.com/cracker/insert.php (Milw0rm Cracker db)
- http://blacklight.gotdns.org/cracker/crack.php (2,456,288)
- http://www.shell-storm.org/md5 ( The data base currently contains 169582 passwords )
- http://md5.xpzone.de (Need Account)
- http://passcracking.com/ (Register to increase your priority)
- http://www.xmd5.org

4 Brute Forcing

Most secure CMS's (Content Management Systems) use Salts and different algorithms.
an example is

Quote:Common: md5($password);
PHP-Fusion: md5(md5($password));
VBulliten: md5(md5($password).$salt);
MyBB: md5(md5($salt).$password); Knowing the Hash + Hash Algorithm is needed when requesting help on cracking a hash.

Recommended Brute Forcing Programs
HashCat
http://hashcat.net/hashcat/



HashCat = Linux
HashCat GUI = Windows.
PasswordsPro
http://www.insidepro.com/eng/passwordspro.shtml



4.1 WordLists

To brute force passwords its common sense you need a list of words.
Depending on the site of your CPU it all depends on how much space you want to use.
You can look at all the different word lists here
http://hashcrack.blogspot.com/p/wordlist-downloads.html
http://www.net-comber.com/wordurls.html

OR Download the wordlists I used in the HashCat video above.
NamesNumbers - 4MB - 4000800 Wo

Quote:Really useful list, it provides top 200 popular male and female names followed by numbers.

Jacob
Jacob0
Jacob1
Jacob2
....
Jacob1000
28GB Wordlist - 28GB - 4103549326 Words

Quote:I Opened this up and it looked pretty useless as well as a waist of time to look threw. Around 28GB of just 6-7 characters long with special characters, letters, and numbers. Like ()D@WFOWI.

wordlist1 - 107MB - 9657365 Words

Quote:This file contains alot of number combination's as well as common passwords. This has gotten me afew cracks in the past.

UrbanDictionarySlangA-Z - 26KB - 3087 Words

Quote:I took the time and copying and pasting the top popular A-Z Urban Dictionary words, because some people use slang terms like friend and cumdumpster as a password.

Other 126GB word-list

Thank you (zer0wr0m)

READMORE

Common Types Of Password Cracking And Their Countermeasures

Social Engineering:

Social engineering is when a hacker takes advantage of trusting human beings to get information from them. For example, if the hacker was trying to get the password for a co-workers computer, he could call the co-worker pretending to be from the IT department. Social Engineering is used for different purposes.

Countermeasure:

If somebody tries to get login information or any other sensitive information from you, ask them some questions. Try to find whether the one who is trying to get the info is legit or not.

Shoulder surfing:

This method doesn’t need the usage of hacking knowledge. The hacker would simply attempt to look over your shoulder as you type in your password.

Countermeasure:

Make sure nobody’s looking when you type your login info.

Dumpster Driving:

In this the hacker would simply try to find any slips of paper in which you have written the password.

Countermeasure:

Do not write your passwords or login information anywhere. If you write, keep them somewhere safe.

Guessing:

If yours is a weak password, a hacker could simple guess it by using the information he knows about you.

Guessable passwords:

1. Blank (None). (Most of the websites do not allow blank passwords)

2.The word "password" "passcode" "admin" and their derivatives.

3. The username or login name.

4. The names of their loved ones.

5. Their birthplace or date of birth.

6. A dictionary word in any language.

7. Automobile license plate number.

8. A row of letters in a standard keyboard layout.
Example: asdfghjkl or qwertyuiop etc.

Countermeasure:

Use passwords that are not easily guessable and not found in any dictionary.

Dictionary Attacks:

A dictionary attack is when a text file full of commonly used passwords, or a list of every word from the dictionary is used against a password database. Strong passwords usually aren’t vulnerable to this kind of attack.

Countermeasure:

Use the passwords that are not found in dictionary in any language.

Brute-force Attacks:

Brute-force attacks can crack any password. Brute-force attacks try every possible combination of letters, numbers, and special characters until the right password is found. Brute-force attacks can take a long time. The speed is determined by the speed of the computer running the cracking program and the complexity of the password.

Countermeasure:

Use a password that is complex and long. Brute-force attack may take hundreds, even thousands of years to crack complex and long passwords.

Rainbow Tables:

A Rainbow table is a huge pre-computed list of hashes for every possible combination of characters. A password hash is a password that has gone through a mathematical algorithm (such as md5) that transformed it into something which is not recognizable. A hash is a one way encryption so once a password is hashed there is no way to get the original string from the hashed string. A very common hashing algorithm used as security to store passwords in website databases is MD5. It is almost like a dictionary attack, the only difference is, in rainbow tables attack hashed characters are used as passwords whereas in dictionary attack normal characters are used as passwords. ‘hello’ in md5 is 5d41402abc4b2a76b9719d911017c592

Countermeasure:

Choose a password that is long and complex. Creating tables for passwords that are long takes a very long time and a lot of resources

Phishing:

Many hackers and internet security experts say that Phishing is the most easiest and popular way to get the account details. In a Phishing attack the hacker sends a fake Facebook or any other webpage link to the victim which the hacker has created or downloaded and uploaded it to any free hosting sites like http://www.100mb.com or any free webhost. The hacker sends the fake login page link through E-mail or while chatting, etc. When the victim enters the login details, the victim is redirected to the original login page and the hacker gets the victim's login details.

Countermeasure:

Phishing attacks are very easy to avoid. When you are asked to put your personal information into a website, look up into the URL bar. If for example you are supposed to be on facebook.com and in the URL bar it says something like facebook.something.com or something, the you should know it’s fake.

RATing and Keylogging:

In keylogging or RATing the hacker sends a keylogger server or RAT server to the victim. The keylogger records every key stroke of the victim. When the victim is typing the account details, the keylogger records and sends it to the hacker.

Countermeasures:

It is better to use on-screen keyboards or virtual keyboards while tying the login info or personal info. Install the latest anti-virus software and keep them updated.


Thank you (zer0w0rm)

READMORE