Passwords are the most popular method of user authentication. Because the logic behind passwords makes sense to people and is relatively simple to implement by developers, they’re very popular.
Passwords can also lead to security flaws. Password crackers can steal credential data and extract passwords.
This article will cover the following topics
What is Password Cracking?
Very simply, Password Cracking is the act of cracking passwords from the password hash.
A password-based authentication system that is well designed doesn’t keep a user’s password. It would be too easy for hackers or malicious insiders to gain access to all user accounts.
Instead, authentication systems store a password hash. This is created by sending the password and a random value called salt through a hash function. Hash functions are one-way. This means it is difficult to identify the input that produces a given result. Because hash functions can be deterministic, meaning that the same input can produce the same output, comparing two password hashes is nearly as easy as comparing actual passwords.
Types of Cybersecurity attacks that try to crack passwords.
1) Brute Force Attack
This type of attack entails the hacker trying to guess the password using every possible combination.
Limitations on the number of attempts that can be made are determined by how many characters and how long each position is to be attempted (or by how much data if Unicode passwords are being used).
Although the time required to complete the task is longer, there is a greater chance of covering all possible clear text values. It’s like a combination lock that requires three numbers to work in sequence. One must try every combination, e.g., 1-2-3, 1-4-2, etc.
Brute force attacks may not attempt all possible options in sequential order. A brute force attack that is more advanced can lead to certain assumptions, such as complexity rules. An uppercase first character is more likely than a lower case.
2) Dictionary Attack
A method of estimating the password based on precompiled lists. This attack only allows for testing options that are likely to work and does not allow for all possible outcomes.
The possible combinations/dictionary are based upon some possible values. They do not consider remote possibilities. It could be based on a limited amount of information about the target (family members’ names, birthdays, etc.). To determine the most popular patterns, the dictionary uses patterns and combinations from a large number of users. It is more likely that the dictionary will contain real words than random strings of characters.
Because the dictionary attack can only be executed once, the execution time of the attack is shorter. The coverage is smaller, and good passwords may not be included on the list.
3) Rainbow table
This is a precomputed table that can be used to reverse cryptographic hash functions. It is most commonly used to crack password hashes. This method is useful for recovering plaintext passwords and debit card numbers. You can limit the length of your file to a certain number of characters. The space and time trade-off’s practical example uses less time in/for computing and more storage capacity than the brute force attack, which computes a hash at each attempt. However, it takes more time to process and requires less storage than table lookup with hash entry.
Top 11 Password Cracker Tools.
1) Hashcat
Hashcat is one of the most widely used password crackers. It’s available on all operating systems and supports more than 300 types of hashes.
Hashcat allows highly-parallelized password cracking. It can crack multiple passwords on multiple devices simultaneously and supports a distributed hash cracking system via overlays. Cracking is optimized by integrated performance tuning and temperature monitoring.
2) Brutus
Brutus is one of the most popular remote online tools for password cracking. Brutus claims it is the fastest and most flexible password cracking tool. It’s free and only works with Windows.
Brutus supports HTTP for Basic Authentication. Pop3, Telnet. HTTP (HTML Form/CGI), HTTP, FTP, SMB. Other types include NetBus. IMAP. NNTP. You can also create your own types of authentication. This tool supports multi-stage authentication engines. It can also connect with 60 targets simultaneously. It also has a Load and Resume. These features allow one to halt the attack at any time and resume when they wish.
Brutus has not been updated in years but is still widely used today.
3) John the Ripper
John the Ripper is a popular open-source password cracking program for Linux, Unix, and Mac OS X. There is also a Windows version.
John the Ripper offers password cracking services for many different types of passwords. It can crack passwords for common web apps, such as WordPress, compressed archives, documents (Microsoft Office files and PDFs), and many other types of passwords.
The tool also comes with a pro version that offers more features and native packages to target operating systems. Openwall GNU/*/Linux, which comes with John the Ripper, can also be downloaded.
4) RainbowCrack
RainbowCrack is a hash cracker tool that uses a large-scale, time-memory trading-off process to crack passwords faster than traditional brute force tools. A time and memory trade-off is a method of computing where all plain text (and hash pairs) are calculated using a selected hash algorithm. The rainbow table stores the results. This can take a lot of time, but it can crack passwords faster than brute force tools once the table is complete.
You don’t have to be able to create rainbow tablets (rainbow) on your own. RainbowCrack’s creators have succeeded in creating rainbow tables (LM), rainbow tables (NTLM), rainbow tables (MD5), and rainbow tables (SHA 1).
These tables can be obtained for free by anyone.
This tool can be used on both Windows and Linux systems.
5) Wfuzz
Wfuzz, a web application password-cracking tool similar to Brutus, attempts to crack passwords using a brute force guessing attack. It can also be used for hidden resources such as directories, scripts, and servlets. Wfuzz can identify injection vulnerabilities in applications such as SQL injections, XSS injections, and LDAP injections.
The Wfuzz password cracker tool has the following key features:
- Multiple injections in different directories
- colored HTML output
- Post headers and authentication data brute forcing
- Multiple proxy support: SOCK and proxy support
- Multi-threading
- HTTP password brute force via GET and POST requests
- Time delay between requests
- Cookie fuzzing
6) Medusa
Medusa is an online password-cracking program. It is a fast, modular, and efficient login brute-forcing program. It supports HTTP, FTP and CVS, and many more.
Medusa can be used as a command-line tool. You will need to have some command-line knowledge. Network connectivity is a key factor in password cracking speed. It can test up to 2,000 passwords per second on a local network.
Medusa also supports parallelized attacks. You can create a wordlist with passwords that you want to use, as well as a list of email addresses or usernames to be tested during an attack.
7) THC Hydra
Hydra is one of the most popular tools for cracking logins on Linux and Windows. It can be used for Solaris, FreeBSD/OpenBSD, QNX (Blackberry 10), as well as macOS. It supports many protocols, including AFP, HTTP-FORM-GET, and HTTP-GET. HTTP-FORM-POST, HTTP-HEAD, HTTP-PROXY, and many more.
Hydra is installed by default on Kali Linux. It comes with both graphical and command-line versions. The brute-forcing method can be used to crack one or more usernames/passwords.
Hydra is the only tool that supports multiple protocols and parallel connections.
8) OphCrack
Ophcrack is a free and open-source brute-forcing tool used to crack Windows passwords. It cracks Windows passwords using LM hashes and rainbow tables.
It can usually crack Windows passwords in just a few minutes. Ophcrack includes rainbow tables that can crack passwords of less than 14 characters. These tables contain only alphanumeric characters. You can also download other rainbow tables.
9) L0phtCrack
OphCrack’s alternative is L0phtCrack. It attempts to crack Windows passwords using hashes. It uses Windows workstations as well as primary domain controllers, network servers, Active Directory, and primary domain controllers to crack passwords. It uses brute-force and dictionary attacks to generate and guess passwords. Symantec acquired it, and it was discontinued in 2006. It was subsequently re-acquired by L0pht developers and relaunched in 2009.
L0phtCrack can also run routine password security scans. You can schedule daily, weekly, or monthly audits, and it will begin scanning at the time you set.
10) Aircrack-ng
This popular brute force password cracker for WiFi is free. This tool includes a WEP/WPA/WPA2-PSK hacker and analysis tools that allow you to attack WiFi 802.11. Aircrack-ng is compatible with any NIC that supports raw monitoring mode.
To guess the password, it basically uses dictionary attacks to attack a wireless network. The dictionary of passwords is key to the success of this attack. The more efficient and effective the password dictionary, the greater the chance it will crack the password.
In addition to being compatible with Windows and Linux OS, It can also be ported to work on iOS and Android platforms.
11) CrackStation
CrackStation is an online password cracking service that’s free. This is a variant of the Dictionary Attack. It contains both dictionary words as well as passwords taken from public password dumps. This service cracks password hashed using precomputed lookup tables that include over 15-billion entries taken from different online resources.
Its popular features include
- Cracking password hash
- Supports LM, NTLM, md2, md4, md5, md5(md5_hex), md5-half, sha1, sha224, sha256, sha384, sha512 and many more.
- Uses Look-up Table with +15 Billion entries
- Only works with ‘non-salted hashes’
Security Tips to reduce your passwords risks.
- Use a strong passphrase
- When you aren’t using the systems, log out
- Don’t reuse passwords
- Use a password manager
- Complex passwords with longer passwords are more secure
- Rotate passwords
- You can use a Privileged Access Management product
- Multi-factor authentication or at least 2FA is recommended.
- Audit activity
- Ask for help!
What to avoid while selecting passwords.
Cybercriminals and password cracker engineers know all the clever tricks people use to create passwords. Here are some common password errors to avoid:
- Using dictionary words: Dictionary attacks can be used to quickly test all words in the dictionary and common permutations.
- Personal information: Names of pets, relatives, birthplaces, favorite sports, and so forth are all examples of dictionary words. Even if they weren’t, there are tools that allow you to pull this information from social media and create a wordlist.
- Using patterns: Some of the most popular passwords are 1111111 and 12345678. These passwords are also included in every password cracker’s wordlist.
- Using substitutions of characters: Well-known substitutions such as 4 for A or $ for S are automatically tested by Dictionary Attacks.
- Use special characters and numbers only at the ends: Most people place their special characters and numbers at the end of their passwords. These patterns are used by password crackers.
- Common passwords: Companies like Splashdata publish lists every year of the most frequently used passwords. These lists are created by hacking passwords that have been compromised, much like an attacker would. These passwords, or any similar ones, should never be used.
- Not using a random password: Passwords must be long, unique, and random. To securely create and store passwords online, use a password manager.
Conclusion
These are only a few of the many password cracking tools that are available. As you can see, it is easy to crack passwords. It is important to make it as difficult as possible for cybercriminals and ensure that passwords are not the only security measure protecting your environment for critical applications and systems.
Hope you liked this article on Top 11 Password Cracker Tools for 2021
Are you interested in kickstarting your career in Cybersecurity no matter your educational background or experience? Click Here to find out how.
