Elvis Wiki - User contributions [en]

Password Security, Threats and Measures

2024-12-18T17:37:54Z

HAbdalla:

== Summary ==

This documentation provides an overview of the threats to passwords and the security measures taken against them. Furtheron, this article provides a presentation on how to crack a password with the pentesting tool "John The Ripper".

== Password Security ==

Passwords are the most used authentication method. Therefore, the security of a password is of significant importance. The strenght of a password can be measured through the quality of the password or its entropy. Besides the quality and entropy of a password, factors like personal data or known passwords have to be considered.

The quality of a password is described as the time it takes to crack a password using the trial and error method. Passwords which take longer to crack are considered to be of higher quality.
The entropy of a password is described as the randomness and unpredictability of a password. The entropy of a password can be impacted through factors like the length and character set size.

=== Hashing ===

To minimize security risks, it is not only crucial to choose strong passwords but also to implement effective security measures.

One of the most important ways to securely store passwords is by using cryptographic methods like hashing, which is a core element of modern password security.

Passwords are transformed into a non-reversible, fixed-length string of characters known as hash values using a mathematical algorithm. Cryptographic hash functions must meet certain criteria, such as being one-way (irreversible), collision-resistant, efficient, and deterministic.

While both cryptographic hash functions and PBKDFs (Password-Based Key Derivation Functions) are used to securely process passwords, they operate differently. A cryptographic hash function, such as SHA-256, converts an input into a fixed-length hash value, which is typically computed quickly. In contrast, PBKDFs (e.g., PBKDF2, bcrypt, scrypt) use multiple iterations and additional salt values to deliberately slow down attackers, particularly in brute-force attacks.

=== Salt and Pepper ===

Salting:
Salting is a technique used to enhance password security by adding a random, unique value (the "salt") to a password before hashing it. This protects against attacks like Rainbow-Table attacks, as identical passwords will generate different hash values due to the unique salt. Salting makes it harder for attackers to quickly crack passwords using precomputed tables.

Peppering:
Peppering adds another layer of security by appending a secret, constant value (the "pepper") to the password. Unlike the salt, the pepper is not stored in the database but is kept secret on the server side.

=== Password Managers ===

Password managers can store the passwords, guide the creation and provide security when sharing passwords. Password managers can include aid in the cases of long, complex and important passwords as they store the passwords of the user and provide a certain level of security. These managers often consist of several authentication steps in order to achieve this certain level of security. The functionality can differ as there are different types of managers.

Types of password managers:
* Cloud-Based Password Managers
* Local Password Managers
* Browser-Based Managers
* Enterprise Managers
* Hardware Password Managers

== Vulnerabilities and Threats ==

Passwords are mostly created by humans and are therefore a subject to vulnerabilities. Humans seek simplicity and comfort and they try to create easy to remember passwords. They often use personal information in order to provide a memorable word. Most of them use the same passwords on multiple websites and neither do they change them frequently. Close to two thirds of users do not use special characters in their passwords.

These factors create many vulnerabilities as they make the passwords predictable, of low quality or entropy and therefore easier to crack.

=== Threats ===

These weakly created passwords are often the victim to different threats. Most of these threats require some sort of fraud or deception.

Some of these threats are:
* Phishing
Is trying to gain login credentials by impersonating a person or faking a website.

* Keylogging
Is recording the keystrokes which a user puts in.

==== Attacks ====
These attacks vary and can be successful at compromising the victims password. Different attacks require different computational power, memory and time when cracking passwords.

Some of these attacks are:
* Brute-Force
Systematic testing of every possible combination of characters until the password is found.
* Dictionary Attack
Test passwords from a prepared list of common or frequently used passwords.
* Hybrid Attack
A hybrid attack combines the concepts of dictionary and brute force attacks. It starts with a list of known passwords and expands these with systematic combinations.
* Rainbow-Table Attack
Use of pre-calculated tables containing plaintext passwords and their hashes to quickly crack passwords.
* Social Engineering Attack
Social engineering uses psychological manipulation to trick people into disclosing confidential information or performing unsafe acts.

== Security Measures ==
In order to prevent attackers from gaining unauthorized access, developers have came up with different security measures. These measures can provide further steps of authentication and achieve more security.

These are some security measures which can help to withstand most of the named threats:
* Two-Factor Authentication
This measure requires and additional step of authentication on system access.

* Security Questions
Security questions also require an additional step of authentication by requiring the answer to personal questions.

* Account Policies
Account policies force the user to frequently change the password or to lock the account if the password is entered wrong multiple times.

* Activity Monitoring
The monitoring of suspicious activity like a login attempt of a new devices can alert the user to pay attention to a certain account and maybe change the login credentials.

== Password Cracking Tools ==
These are only some of the cracking tools which can be used to attack a victims account:
* John The Ripper
A widely used open-source password cracking tool that supports various hashing algorithms and can crack passwords using dictionary, brute force and hybrid attacks. John the Ripper (JtR) offers various modes:
The Single Crack Mode uses personal information such as user names
to guess passwords efficiently.
The Wordlist Mode uses prefabricated word lists to test known terms or patterns.
Incremental mode relies on brute force attacks in which all possible character combinations are systematically tried out.
In external mode, users can develop their own methods for cracking passwords.

This tool will be used later in this documentation to present a password cracking process.

* Hashcat
Hashcat is a powerful open-source password cracking tool that runs on Linux, Windows and macOS and supports a variety of hashing algorithms and attack methods including brute force, dictionary, hybrid and mask attacks. Hashcat combines CPU and GPU-based calculations in a single application. A highlight is the ability to create customised rules to flexibly adapt attacks to known vulnerabilities or patterns.

* RainbowCrack
RainbowCrack is a password cracking tool that uses the Rainbow Table technique to crack passwords efficiently, based on the time-memory trade-off concept. It supports common hash algorithms such as LM, NTLM, MD5, SHA1 and SHA256 and uses the reduction function to save memory space.

* OPH Crack
Implements the rainbow table attack.

* Medusa
Medusa is a parallel brute force tool that can attack multiple network protocols (such as SSH, FTP, HTTP) to crack passwords. Thanks to its modular structure, protocols can be flexibly adapted, and parallel processing enables up to 2000 password attempts per minute.

== Requirements ==

* Operating system/Platform: Kali Linux
* Packages: git openwall/john

== Cracking a password ==
The following steps are necessary in order to crack a password. Kali linux is used as the operating system as it provides different cracking tools and more. The used tool for this crack process is "John The Ripper".
* NOTE: Password cracking is unethical. This demonstration serves for educational purposes and should not be recreated.

=== Step 1 ===

Create a .zip password secured archive.

sudo apt-get install zip

sudo nano document.txt

zip -e archive.zip document.txt

You will be prompted to enter a password.
=== Step 2 ===

Now the hash of the password needs to be achieved.

zip2john archive.zip > hash.txt

This command saves the hash of the password which is used to secure the archive.zip archive in a hash.txt file.

=== Step 3 ===

Now the hash can be cracked. The crack is only successful if the password is in the password list that john uses to compare the hashes.

john hash.txt

The passwordlist in this case is the default password list of john. However, different password lists can be used by specifying the file they are saved as.

john --wordlist=/tmp/password-list.txt hash.txt

This way john will try to crack the password with the password-list.txt password list file.
* In the case of a successful attack, john will provide a confirmation message about the successful attack and display the password.

== References ==

* https://www.overleaf.com/project/64fc39ddb97b168fb7bd033d
* https://www.openwall.com/john/
* https://www.kali.org/tools/john/
* https://www.kali.org/
* https://ieeexplore.ieee.org/document/6234434
* https://ieeexplore.ieee.org/document/8936178
* https://doi.org/10.1145/359168.359172
* https://ieeexplore.ieee.org/document/9023888
* https://ieeexplore.ieee.org/document/9609778
* https://ieeexplore.ieee.org/document/8400211
* https://ieeexplore.ieee.org/document/10127057
* https://hashcat.net/hashcat/
* https://ieeexplore.ieee.org/document/8500257
* https://ieeexplore.ieee.org/document/9821858?signout=success

[[Category:Documentation]]

Password Security, Threats and Measures

2024-12-18T17:32:04Z

HAbdalla:

Password Security, Threats and Measures

2024-12-18T17:29:40Z

HAbdalla:

Password Cracking with RainbowCrack

2024-12-18T17:16:40Z

HAbdalla:

== Summary ==

This documentation shows that salted passwords are more secure than unsalted passwords. A practical test was performed using the RainbowCrack tool. Simple passwords were used, both unsalted and salted, and then rainbow tables were created to crack the passwords. The test clearly shows that unsalted passwords were cracked, while salted passwords remained secure.

== Requirements ==

* Hashing tools/websites: To generate the hash values
* RainbowCrack: A tool for creating and using rainbow tables. [http://project-rainbowcrack.com/ RainbowCrack]

== Description ==

=== Step 1 - Installation ===

Installing the RainbowCrack tool: [http://project-rainbowcrack.com/ Download the RainbowCrack tool from here]

After downloading the .zip folder, it must be unpacked. The tool is then ready for use.

=== Step 2 - Choice of password and password hashing ===

Selection of the passwords to be cracked and the algorithm to be used to hash them.

For this practical test, the following passwords were used and hashed using the md5 algorithm.

{| class="wikitable" style="margin:auto"
|+ Used Passwords
|-
! plain text without salt !! hash !! plain text with salt !! hash
|-
| abcde || ab56b4d92b40713acc5af89985d4b786 || abcde1 || 0565a9d4889781545eae12fc99050921
|-
| abc || 900150983cd24fb0d6963f7d28e17f72 || abcwxz || 7bc7789b9e7a66c74c7222a8db097cbd
|-
| abc23 || 3be5ef429769acbb7b9bb73443ea9fee || abc23zyx || da18289e8de951b4a16e3da7ab6e5951
|-
| bc23 || 44af58e2ce5327a8f6a846e43085478c || bc23xyz || f4cdbc7a935c6ee7d283963228c3c44a
|}

=== Step 3 - Creating rainbow table ===

The command to create a rainbow table is "rtgen". This stands for "rainbow table generate".

The Syntax for creating the rainbow table:

[[File:rtgen.png|border|center|750px|Syntax of the rtgen command]]

For this test we create the following rainbow table:

<code>rtgen md5 loweralpha-numeric 1 6 1 2400 100000 0</code>

md5 ... Specifies the hash algorithm to use. In this case, it is the MD5 hashing algorithm.

loweralpha-numeric ... Defines the character set to be used for the passwords.

- loweralpha = Lowercase letters (a-z)

- numeric = Numbers (0-9)

Combined, the set includes all lowercase letters and numbers.

1 ... This is the minimum password length for the generated Rainbow Table.

6 ... This is the maximum password length for the generated Rainbow Table.

1 ... Represents the table index. This is used to distinguish between multiple tables for the same parameters.

2400 ... Specifies the chain length. The chain length determines how many hashes and plaintext combinations will be included in each chain.

100000 ... Indicates the number of chains in the table.

0 ... Used to split a large rainbow table into smaller files.

=== Step 4 - Sorting the rainbow table ===

Once the rainbow table has been created, it needs to be sorted so that it can be used correctly.

The command "rtsort ." sorts the rainbow table.

[[File:rtsort.png||border|center|500px|rtsort command]]

=== Step 5 - RainbowCrack UI ===

Opening of the RainbowCrack user interface for password cracking.

Click on the following file to open the UI:

[[File:uiFile.png||border|center|600px|File to open the UI]]

The UI looks like this:

[[File:ui.png||border|center|550px|The UI]]

=== Step 6 - Adding the hashed passwords ===

Now the hashed passwords can be added.

By clicking on "File" -> "Add Hashes...":

[[File:addHashes.png||border|center|600px|Adding the Hashes]]

[[File:add.png||border|center|600px|Adding the Hashes]]

[[File:added.png||border|center|600px|Hashes added]]

=== Step 7 - Inserting the rainbow table ===

Now the created rainbow table can be inserted:

[[File:insertTable.png||border|center|600px|Insert the rainbow table]]

=== Step 8 - Cracking passwords ===

Now the tool will try to crack the passwords.

[[File:cracked.png||border|center|600px|The cracked passwords]]

The unsalted ones were cracked, the salted ones remained secret.

== Conclusion ==

This experiment clearly shows how effective rainbow tables are at cracking unsalted passwords, and how adding a salt significantly increases security. Unsalted passwords can be cracked quickly using pre-built rainbow tables, while salted passwords resist these attacks because each password is made unique by the individual salt.

== Related ==

[[Password Security, Threats and Measures]]

== References ==

* http://project-rainbowcrack.com/
* http://project-rainbowcrack.com/generate.htm

[[Category:Documentation]]

Password Cracking with RainbowCrack

2024-12-18T16:06:53Z

HAbdalla:

== Summary ==

This documentation shows that salted passwords are more secure than unsalted passwords. A practical test was performed using the RainbowCrack tool. Simple passwords were used, both unsalted and salted, and then rainbow tables were created to crack the passwords. The test clearly shows that unsalted passwords were cracked, while salted passwords remained secure.

== Requirements ==

* Hashing tools/websites: To generate the hash values
* RainbowCrack: A tool for creating and using rainbow tables. [http://project-rainbowcrack.com/ RainbowCrack]

== Description ==

=== Step 1 - Installation ===

Installing the RainbowCrack tool: [http://project-rainbowcrack.com/ Download the RainbowCrack tool from here]

After downloading the .zip folder, it must be unpacked. The tool is then ready for use.

=== Step 2 - Choice of password and password hashing ===

Selection of the passwords to be cracked and the algorithm to be used to hash them.

For this practical test, the following passwords were used and hashed using the md5 algorithm.

{| class="wikitable" style="margin:auto"
|+ Used Passwords
|-
! plain text without salt !! hash !! plain text with salt !! hash
|-
| abcde || ab56b4d92b40713acc5af89985d4b786 || abcde1 || 0565a9d4889781545eae12fc99050921
|-
| abc || 900150983cd24fb0d6963f7d28e17f72 || abcwxz || 7bc7789b9e7a66c74c7222a8db097cbd
|-
| abc23 || 3be5ef429769acbb7b9bb73443ea9fee || abc23zyx || da18289e8de951b4a16e3da7ab6e5951
|-
| bc23 || 44af58e2ce5327a8f6a846e43085478c || bc23xyz || f4cdbc7a935c6ee7d283963228c3c44a
|}

=== Step 3 - Creating rainbow table ===

The command to create a rainbow table is "rtgen". This stands for "rainbow table generate".

The Syntax for creating the rainbow table:

[[File:rtgen.png|border|center|750px|Syntax of the rtgen command]]

For this test we create the following rainbow table:

<code>rtgen md5 loweralpha-numeric 1 6 1 2400 100000 0</code>

md5 ... Specifies the hash algorithm to use. In this case, it is the MD5 hashing algorithm.

loweralpha-numeric ... Defines the character set to be used for the passwords.

- loweralpha = Lowercase letters (a-z)

- numeric = Numbers (0-9)

Combined, the set includes all lowercase letters and numbers.

1 ... This is the minimum password length for the generated Rainbow Table.

6 ... This is the maximum password length for the generated Rainbow Table.

1 ... Represents the table index. This is used to distinguish between multiple tables for the same parameters.

2400 ... Specifies the chain length. The chain length determines how many hashes and plaintext combinations will be included in each chain.

100000 ... Indicates the number of chains in the table.

0 ... Used to split a large rainbow table into smaller files.

=== Step 4 - Sorting the rainbow table ===

Once the rainbow table has been created, it needs to be sorted so that it can be used correctly.

The command "rtsort ." sorts the rainbow table.

[[File:rtsort.png||border|center|500px|rtsort command]]

=== Step 5 - RainbowCrack UI ===

Opening of the RainbowCrack user interface for password cracking.

Click on the following file to open the UI:

[[File:uiFile.png||border|center|600px|File to open the UI]]

The UI looks like this:

[[File:ui.png||border|center|550px|The UI]]

=== Step 6 - Adding the hashed passwords ===

Now the hashed passwords can be added.

By clicking on "File" -> "Add Hashes...":

[[File:addHashes.png||border|center|600px|Adding the Hashes]]

[[File:add.png||border|center|600px|Adding the Hashes]]

[[File:added.png||border|center|600px|Hashes added]]

=== Step 7 - Inserting the rainbow table ===

Now the created rainbow table can be inserted:

[[File:insertTable.png||border|center|600px|Insert the rainbow table]]

=== Step 8 - Cracking passwords ===

Now the tool will try to crack the passwords.

[[File:cracked.png||border|center|600px|The cracked passwords]]

The unsalted ones were cracked, the salted ones remained secret.

== Conclusion ==

This experiment clearly shows how effective rainbow tables are at cracking unsalted passwords, and how adding a salt significantly increases security. Unsalted passwords can be cracked quickly using pre-built rainbow tables, while salted passwords resist these attacks because each password is made unique by the individual salt.

== References ==

* http://project-rainbowcrack.com/
* http://project-rainbowcrack.com/generate.htm

[[Category:Documentation]]

Password Cracking with RainbowCrack

2024-12-18T16:01:56Z

HAbdalla: /* Step 4 - Sorting the rainbow table */

== Summary ==

This documentation shows that salted passwords are more secure than unsalted passwords. A practical test was performed using the RainbowCrack tool. Simple passwords were used, both unsalted and salted, and then rainbow tables were created to crack the passwords. The test clearly shows that unsalted passwords were cracked, while salted passwords remained secure.

== Requirements ==

* Hashing tools/websites: To generate the hash values
* RainbowCrack: A tool for creating and using rainbow tables. [http://project-rainbowcrack.com/ RainbowCrack]

== Description ==

=== Step 1 - Installation ===

Installing the RainbowCrack tool: [http://project-rainbowcrack.com/ Download the RainbowCrack tool from here]

After downloading the .zip folder, it must be unpacked. The tool is then ready for use.

=== Step 2 - Choice of password and password hashing ===

Selection of the passwords to be cracked and the algorithm to be used to hash them.

For this practical test, the following passwords were used and hashed using the md5 algorithm.

{| class="wikitable" style="margin:auto"
|+ Used Passwords
|-
! plain text without salt !! hash !! plain text with salt !! hash
|-
| abcde || ab56b4d92b40713acc5af89985d4b786 || abcde1 || 0565a9d4889781545eae12fc99050921
|-
| abc || 900150983cd24fb0d6963f7d28e17f72 || abcwxz || 7bc7789b9e7a66c74c7222a8db097cbd
|-
| abc23 || 3be5ef429769acbb7b9bb73443ea9fee || abc23zyx || da18289e8de951b4a16e3da7ab6e5951
|-
| bc23 || 44af58e2ce5327a8f6a846e43085478c || bc23xyz || f4cdbc7a935c6ee7d283963228c3c44a
|}

=== Step 3 - Creating rainbow table ===

The command to create a rainbow table is "rtgen". This stands for "rainbow table generate".

The Syntax for creating the rainbow table:

[[File:rtgen.png|border|center|750px|Syntax of the rtgen command]]

For this test we create the following rainbow table:

<code>rtgen md5 loweralpha-numeric 1 6 1 2400 100000 0</code>

md5 ... Specifies the hash algorithm to use. In this case, it is the MD5 hashing algorithm.

loweralpha-numeric ... Defines the character set to be used for the passwords.

- loweralpha = Lowercase letters (a-z)

- numeric = Numbers (0-9)

Combined, the set includes all lowercase letters and numbers.

1 ... This is the minimum password length for the generated Rainbow Table.

6 ... This is the maximum password length for the generated Rainbow Table.

1 ... Represents the table index. This is used to distinguish between multiple tables for the same parameters.

2400 ... Specifies the chain length. The chain length determines how many hashes and plaintext combinations will be included in each chain.

100000 ... Indicates the number of chains in the table.

0 ... Used to split a large rainbow table into smaller files.

=== Step 4 - Sorting the rainbow table ===

Once the rainbow table has been created, it needs to be sorted so that it can be used correctly.

The command "rtsort ." sorts the rainbow table.

[[File:rtsort.png||border|center|500px|rtsort command]]

=== Step 5 - RainbowCrack UI ===

Opening of the RainbowCrack user interface for password cracking.

Click on the following file to open the UI:

[[File:uiFile.png||border|center|600px|File to open the UI]]

The UI looks like this:

[[File:ui.png||border|center|550px|The UI]]

=== Step 6 - Adding the hashed passwords ===

Now the hashed passwords can be added.

By clicking on "File" -> "Add Hashes...":

[[File:addHashes.png||border|center|600px|Adding the Hashes]]

[[File:add.png||border|center|600px|Adding the Hashes]]

[[File:added.png||border|center|600px|Hashes added]]

=== Step 7 - Inserting the rainbow table ===

Now the created rainbow table can be inserted:

[[File:insertTable.png||border|center|600px|Insert the rainbow table]]

=== Step 8 - Cracking passwords ===

Now the tool will try to crack the passwords.

[[File:cracked.png||border|center|600px|The cracked passwords]]

The unsalted ones were cracked, the salted ones remained secret.

== Courses ==

* [[A course where this documentation was used]] (2017, 2018)

== References ==

* http://project-rainbowcrack.com/
* http://project-rainbowcrack.com/generate.htm

[[Category:Documentation]]

Password Cracking with RainbowCrack

2024-12-18T16:01:42Z

HAbdalla: /* Step 3 - Creating rainbow table */

== Summary ==

This documentation shows that salted passwords are more secure than unsalted passwords. A practical test was performed using the RainbowCrack tool. Simple passwords were used, both unsalted and salted, and then rainbow tables were created to crack the passwords. The test clearly shows that unsalted passwords were cracked, while salted passwords remained secure.

== Requirements ==

* Hashing tools/websites: To generate the hash values
* RainbowCrack: A tool for creating and using rainbow tables. [http://project-rainbowcrack.com/ RainbowCrack]

== Description ==

=== Step 1 - Installation ===

Installing the RainbowCrack tool: [http://project-rainbowcrack.com/ Download the RainbowCrack tool from here]

After downloading the .zip folder, it must be unpacked. The tool is then ready for use.

=== Step 2 - Choice of password and password hashing ===

Selection of the passwords to be cracked and the algorithm to be used to hash them.

For this practical test, the following passwords were used and hashed using the md5 algorithm.

{| class="wikitable" style="margin:auto"
|+ Used Passwords
|-
! plain text without salt !! hash !! plain text with salt !! hash
|-
| abcde || ab56b4d92b40713acc5af89985d4b786 || abcde1 || 0565a9d4889781545eae12fc99050921
|-
| abc || 900150983cd24fb0d6963f7d28e17f72 || abcwxz || 7bc7789b9e7a66c74c7222a8db097cbd
|-
| abc23 || 3be5ef429769acbb7b9bb73443ea9fee || abc23zyx || da18289e8de951b4a16e3da7ab6e5951
|-
| bc23 || 44af58e2ce5327a8f6a846e43085478c || bc23xyz || f4cdbc7a935c6ee7d283963228c3c44a
|}

=== Step 3 - Creating rainbow table ===

The command to create a rainbow table is "rtgen". This stands for "rainbow table generate".

The Syntax for creating the rainbow table:

[[File:rtgen.png|border|center|750px|Syntax of the rtgen command]]

For this test we create the following rainbow table:

<code>rtgen md5 loweralpha-numeric 1 6 1 2400 100000 0</code>

md5 ... Specifies the hash algorithm to use. In this case, it is the MD5 hashing algorithm.

loweralpha-numeric ... Defines the character set to be used for the passwords.

- loweralpha = Lowercase letters (a-z)

- numeric = Numbers (0-9)

Combined, the set includes all lowercase letters and numbers.

1 ... This is the minimum password length for the generated Rainbow Table.

6 ... This is the maximum password length for the generated Rainbow Table.

1 ... Represents the table index. This is used to distinguish between multiple tables for the same parameters.

2400 ... Specifies the chain length. The chain length determines how many hashes and plaintext combinations will be included in each chain.

100000 ... Indicates the number of chains in the table.

0 ... Used to split a large rainbow table into smaller files.

=== Step 4 - Sorting the rainbow table ===

Once the rainbow table has been created, it needs to be sorted so that it can be used correctly.

The command "rtsort ." sorts the rainbow table.

[[File:rtsort.png||border|center|600px|rtsort command]]

=== Step 5 - RainbowCrack UI ===

Opening of the RainbowCrack user interface for password cracking.

Click on the following file to open the UI:

[[File:uiFile.png||border|center|600px|File to open the UI]]

The UI looks like this:

[[File:ui.png||border|center|550px|The UI]]

=== Step 6 - Adding the hashed passwords ===

Now the hashed passwords can be added.

By clicking on "File" -> "Add Hashes...":

[[File:addHashes.png||border|center|600px|Adding the Hashes]]

[[File:add.png||border|center|600px|Adding the Hashes]]

[[File:added.png||border|center|600px|Hashes added]]

=== Step 7 - Inserting the rainbow table ===

Now the created rainbow table can be inserted:

[[File:insertTable.png||border|center|600px|Insert the rainbow table]]

=== Step 8 - Cracking passwords ===

Now the tool will try to crack the passwords.

[[File:cracked.png||border|center|600px|The cracked passwords]]

The unsalted ones were cracked, the salted ones remained secret.

== Courses ==

* [[A course where this documentation was used]] (2017, 2018)

== References ==

* http://project-rainbowcrack.com/
* http://project-rainbowcrack.com/generate.htm

[[Category:Documentation]]

Password Cracking with RainbowCrack

2024-12-18T16:01:12Z

HAbdalla: /* Step 3 - Creating rainbow table */

== Summary ==

This documentation shows that salted passwords are more secure than unsalted passwords. A practical test was performed using the RainbowCrack tool. Simple passwords were used, both unsalted and salted, and then rainbow tables were created to crack the passwords. The test clearly shows that unsalted passwords were cracked, while salted passwords remained secure.

== Requirements ==

* Hashing tools/websites: To generate the hash values
* RainbowCrack: A tool for creating and using rainbow tables. [http://project-rainbowcrack.com/ RainbowCrack]

== Description ==

=== Step 1 - Installation ===

Installing the RainbowCrack tool: [http://project-rainbowcrack.com/ Download the RainbowCrack tool from here]

After downloading the .zip folder, it must be unpacked. The tool is then ready for use.

=== Step 2 - Choice of password and password hashing ===

Selection of the passwords to be cracked and the algorithm to be used to hash them.

For this practical test, the following passwords were used and hashed using the md5 algorithm.

{| class="wikitable" style="margin:auto"
|+ Used Passwords
|-
! plain text without salt !! hash !! plain text with salt !! hash
|-
| abcde || ab56b4d92b40713acc5af89985d4b786 || abcde1 || 0565a9d4889781545eae12fc99050921
|-
| abc || 900150983cd24fb0d6963f7d28e17f72 || abcwxz || 7bc7789b9e7a66c74c7222a8db097cbd
|-
| abc23 || 3be5ef429769acbb7b9bb73443ea9fee || abc23zyx || da18289e8de951b4a16e3da7ab6e5951
|-
| bc23 || 44af58e2ce5327a8f6a846e43085478c || bc23xyz || f4cdbc7a935c6ee7d283963228c3c44a
|}

=== Step 3 - Creating rainbow table ===

The command to create a rainbow table is "rtgen". This stands for "rainbow table generate".

The Syntax for creating the rainbow table:

[[File:rtgen.png|border|center|700px|Syntax of the rtgen command]]

For this test we create the following rainbow table:

<code>rtgen md5 loweralpha-numeric 1 6 1 2400 100000 0</code>

md5 ... Specifies the hash algorithm to use. In this case, it is the MD5 hashing algorithm.

loweralpha-numeric ... Defines the character set to be used for the passwords.

- loweralpha = Lowercase letters (a-z)

- numeric = Numbers (0-9)

Combined, the set includes all lowercase letters and numbers.

1 ... This is the minimum password length for the generated Rainbow Table.

6 ... This is the maximum password length for the generated Rainbow Table.

1 ... Represents the table index. This is used to distinguish between multiple tables for the same parameters.

2400 ... Specifies the chain length. The chain length determines how many hashes and plaintext combinations will be included in each chain.

100000 ... Indicates the number of chains in the table.

0 ... Used to split a large rainbow table into smaller files.

=== Step 4 - Sorting the rainbow table ===

Once the rainbow table has been created, it needs to be sorted so that it can be used correctly.

The command "rtsort ." sorts the rainbow table.

[[File:rtsort.png||border|center|600px|rtsort command]]

=== Step 5 - RainbowCrack UI ===

Opening of the RainbowCrack user interface for password cracking.

Click on the following file to open the UI:

[[File:uiFile.png||border|center|600px|File to open the UI]]

The UI looks like this:

[[File:ui.png||border|center|550px|The UI]]

=== Step 6 - Adding the hashed passwords ===

Now the hashed passwords can be added.

By clicking on "File" -> "Add Hashes...":

[[File:addHashes.png||border|center|600px|Adding the Hashes]]

[[File:add.png||border|center|600px|Adding the Hashes]]

[[File:added.png||border|center|600px|Hashes added]]

=== Step 7 - Inserting the rainbow table ===

Now the created rainbow table can be inserted:

[[File:insertTable.png||border|center|600px|Insert the rainbow table]]

=== Step 8 - Cracking passwords ===

Now the tool will try to crack the passwords.

[[File:cracked.png||border|center|600px|The cracked passwords]]

The unsalted ones were cracked, the salted ones remained secret.

== Courses ==

* [[A course where this documentation was used]] (2017, 2018)

== References ==

* http://project-rainbowcrack.com/
* http://project-rainbowcrack.com/generate.htm

[[Category:Documentation]]

Password Cracking with RainbowCrack

2024-12-18T16:00:45Z

HAbdalla: /* Step 8 - Cracking passwords */

== Summary ==

This documentation shows that salted passwords are more secure than unsalted passwords. A practical test was performed using the RainbowCrack tool. Simple passwords were used, both unsalted and salted, and then rainbow tables were created to crack the passwords. The test clearly shows that unsalted passwords were cracked, while salted passwords remained secure.

== Requirements ==

* Hashing tools/websites: To generate the hash values
* RainbowCrack: A tool for creating and using rainbow tables. [http://project-rainbowcrack.com/ RainbowCrack]

== Description ==

=== Step 1 - Installation ===

Installing the RainbowCrack tool: [http://project-rainbowcrack.com/ Download the RainbowCrack tool from here]

After downloading the .zip folder, it must be unpacked. The tool is then ready for use.

=== Step 2 - Choice of password and password hashing ===

Selection of the passwords to be cracked and the algorithm to be used to hash them.

For this practical test, the following passwords were used and hashed using the md5 algorithm.

{| class="wikitable" style="margin:auto"
|+ Used Passwords
|-
! plain text without salt !! hash !! plain text with salt !! hash
|-
| abcde || ab56b4d92b40713acc5af89985d4b786 || abcde1 || 0565a9d4889781545eae12fc99050921
|-
| abc || 900150983cd24fb0d6963f7d28e17f72 || abcwxz || 7bc7789b9e7a66c74c7222a8db097cbd
|-
| abc23 || 3be5ef429769acbb7b9bb73443ea9fee || abc23zyx || da18289e8de951b4a16e3da7ab6e5951
|-
| bc23 || 44af58e2ce5327a8f6a846e43085478c || bc23xyz || f4cdbc7a935c6ee7d283963228c3c44a
|}

=== Step 3 - Creating rainbow table ===

The command to create a rainbow table is "rtgen". This stands for "rainbow table generate".

The Syntax for creating the rainbow table:

[[File:rtgen.png|border|center|800px|Syntax of the rtgen command]]

For this test we create the following rainbow table:

<code>rtgen md5 loweralpha-numeric 1 6 1 2400 100000 0</code>

md5 ... Specifies the hash algorithm to use. In this case, it is the MD5 hashing algorithm.

loweralpha-numeric ... Defines the character set to be used for the passwords.

- loweralpha = Lowercase letters (a-z)

- numeric = Numbers (0-9)

Combined, the set includes all lowercase letters and numbers.

1 ... This is the minimum password length for the generated Rainbow Table.

6 ... This is the maximum password length for the generated Rainbow Table.

1 ... Represents the table index. This is used to distinguish between multiple tables for the same parameters.

2400 ... Specifies the chain length. The chain length determines how many hashes and plaintext combinations will be included in each chain.

100000 ... Indicates the number of chains in the table.

0 ... Used to split a large rainbow table into smaller files.

=== Step 4 - Sorting the rainbow table ===

Once the rainbow table has been created, it needs to be sorted so that it can be used correctly.

The command "rtsort ." sorts the rainbow table.

[[File:rtsort.png||border|center|600px|rtsort command]]

=== Step 5 - RainbowCrack UI ===

Opening of the RainbowCrack user interface for password cracking.

Click on the following file to open the UI:

[[File:uiFile.png||border|center|600px|File to open the UI]]

The UI looks like this:

[[File:ui.png||border|center|550px|The UI]]

=== Step 6 - Adding the hashed passwords ===

Now the hashed passwords can be added.

By clicking on "File" -> "Add Hashes...":

[[File:addHashes.png||border|center|600px|Adding the Hashes]]

[[File:add.png||border|center|600px|Adding the Hashes]]

[[File:added.png||border|center|600px|Hashes added]]

=== Step 7 - Inserting the rainbow table ===

Now the created rainbow table can be inserted:

[[File:insertTable.png||border|center|600px|Insert the rainbow table]]

=== Step 8 - Cracking passwords ===

Now the tool will try to crack the passwords.

[[File:cracked.png||border|center|600px|The cracked passwords]]

The unsalted ones were cracked, the salted ones remained secret.

== Courses ==

* [[A course where this documentation was used]] (2017, 2018)

== References ==

* http://project-rainbowcrack.com/
* http://project-rainbowcrack.com/generate.htm

[[Category:Documentation]]

Password Cracking with RainbowCrack

2024-12-18T16:00:28Z

HAbdalla: /* Step 7 - Inserting the rainbow table */

== Summary ==

This documentation shows that salted passwords are more secure than unsalted passwords. A practical test was performed using the RainbowCrack tool. Simple passwords were used, both unsalted and salted, and then rainbow tables were created to crack the passwords. The test clearly shows that unsalted passwords were cracked, while salted passwords remained secure.

== Requirements ==

* Hashing tools/websites: To generate the hash values
* RainbowCrack: A tool for creating and using rainbow tables. [http://project-rainbowcrack.com/ RainbowCrack]

== Description ==

=== Step 1 - Installation ===

Installing the RainbowCrack tool: [http://project-rainbowcrack.com/ Download the RainbowCrack tool from here]

After downloading the .zip folder, it must be unpacked. The tool is then ready for use.

=== Step 2 - Choice of password and password hashing ===

Selection of the passwords to be cracked and the algorithm to be used to hash them.

For this practical test, the following passwords were used and hashed using the md5 algorithm.

{| class="wikitable" style="margin:auto"
|+ Used Passwords
|-
! plain text without salt !! hash !! plain text with salt !! hash
|-
| abcde || ab56b4d92b40713acc5af89985d4b786 || abcde1 || 0565a9d4889781545eae12fc99050921
|-
| abc || 900150983cd24fb0d6963f7d28e17f72 || abcwxz || 7bc7789b9e7a66c74c7222a8db097cbd
|-
| abc23 || 3be5ef429769acbb7b9bb73443ea9fee || abc23zyx || da18289e8de951b4a16e3da7ab6e5951
|-
| bc23 || 44af58e2ce5327a8f6a846e43085478c || bc23xyz || f4cdbc7a935c6ee7d283963228c3c44a
|}

=== Step 3 - Creating rainbow table ===

The command to create a rainbow table is "rtgen". This stands for "rainbow table generate".

The Syntax for creating the rainbow table:

[[File:rtgen.png|border|center|800px|Syntax of the rtgen command]]

For this test we create the following rainbow table:

<code>rtgen md5 loweralpha-numeric 1 6 1 2400 100000 0</code>

md5 ... Specifies the hash algorithm to use. In this case, it is the MD5 hashing algorithm.

loweralpha-numeric ... Defines the character set to be used for the passwords.

- loweralpha = Lowercase letters (a-z)

- numeric = Numbers (0-9)

Combined, the set includes all lowercase letters and numbers.

1 ... This is the minimum password length for the generated Rainbow Table.

6 ... This is the maximum password length for the generated Rainbow Table.

1 ... Represents the table index. This is used to distinguish between multiple tables for the same parameters.

2400 ... Specifies the chain length. The chain length determines how many hashes and plaintext combinations will be included in each chain.

100000 ... Indicates the number of chains in the table.

0 ... Used to split a large rainbow table into smaller files.

=== Step 4 - Sorting the rainbow table ===

Once the rainbow table has been created, it needs to be sorted so that it can be used correctly.

The command "rtsort ." sorts the rainbow table.

[[File:rtsort.png||border|center|600px|rtsort command]]

=== Step 5 - RainbowCrack UI ===

Opening of the RainbowCrack user interface for password cracking.

Click on the following file to open the UI:

[[File:uiFile.png||border|center|600px|File to open the UI]]

The UI looks like this:

[[File:ui.png||border|center|550px|The UI]]

=== Step 6 - Adding the hashed passwords ===

Now the hashed passwords can be added.

By clicking on "File" -> "Add Hashes...":

[[File:addHashes.png||border|center|600px|Adding the Hashes]]

[[File:add.png||border|center|600px|Adding the Hashes]]

[[File:added.png||border|center|600px|Hashes added]]

=== Step 7 - Inserting the rainbow table ===

Now the created rainbow table can be inserted:

[[File:insertTable.png||border|center|600px|Insert the rainbow table]]

=== Step 8 - Cracking passwords ===

Now the tool will try to crack the passwords.

[[File:cracked.png|The cracked passwords]]

The unsalted ones were cracked, the salted ones remained secret.

== Courses ==

* [[A course where this documentation was used]] (2017, 2018)

== References ==

* http://project-rainbowcrack.com/
* http://project-rainbowcrack.com/generate.htm

[[Category:Documentation]]

Password Cracking with RainbowCrack

2024-12-18T16:00:02Z

HAbdalla: /* Step 5 - RainbowCrack UI */

== Summary ==

This documentation shows that salted passwords are more secure than unsalted passwords. A practical test was performed using the RainbowCrack tool. Simple passwords were used, both unsalted and salted, and then rainbow tables were created to crack the passwords. The test clearly shows that unsalted passwords were cracked, while salted passwords remained secure.

== Requirements ==

* Hashing tools/websites: To generate the hash values
* RainbowCrack: A tool for creating and using rainbow tables. [http://project-rainbowcrack.com/ RainbowCrack]

== Description ==

=== Step 1 - Installation ===

Installing the RainbowCrack tool: [http://project-rainbowcrack.com/ Download the RainbowCrack tool from here]

After downloading the .zip folder, it must be unpacked. The tool is then ready for use.

=== Step 2 - Choice of password and password hashing ===

Selection of the passwords to be cracked and the algorithm to be used to hash them.

For this practical test, the following passwords were used and hashed using the md5 algorithm.

{| class="wikitable" style="margin:auto"
|+ Used Passwords
|-
! plain text without salt !! hash !! plain text with salt !! hash
|-
| abcde || ab56b4d92b40713acc5af89985d4b786 || abcde1 || 0565a9d4889781545eae12fc99050921
|-
| abc || 900150983cd24fb0d6963f7d28e17f72 || abcwxz || 7bc7789b9e7a66c74c7222a8db097cbd
|-
| abc23 || 3be5ef429769acbb7b9bb73443ea9fee || abc23zyx || da18289e8de951b4a16e3da7ab6e5951
|-
| bc23 || 44af58e2ce5327a8f6a846e43085478c || bc23xyz || f4cdbc7a935c6ee7d283963228c3c44a
|}

=== Step 3 - Creating rainbow table ===

The command to create a rainbow table is "rtgen". This stands for "rainbow table generate".

The Syntax for creating the rainbow table:

[[File:rtgen.png|border|center|800px|Syntax of the rtgen command]]

For this test we create the following rainbow table:

<code>rtgen md5 loweralpha-numeric 1 6 1 2400 100000 0</code>

md5 ... Specifies the hash algorithm to use. In this case, it is the MD5 hashing algorithm.

loweralpha-numeric ... Defines the character set to be used for the passwords.

- loweralpha = Lowercase letters (a-z)

- numeric = Numbers (0-9)

Combined, the set includes all lowercase letters and numbers.

1 ... This is the minimum password length for the generated Rainbow Table.

6 ... This is the maximum password length for the generated Rainbow Table.

1 ... Represents the table index. This is used to distinguish between multiple tables for the same parameters.

2400 ... Specifies the chain length. The chain length determines how many hashes and plaintext combinations will be included in each chain.

100000 ... Indicates the number of chains in the table.

0 ... Used to split a large rainbow table into smaller files.

=== Step 4 - Sorting the rainbow table ===

Once the rainbow table has been created, it needs to be sorted so that it can be used correctly.

The command "rtsort ." sorts the rainbow table.

[[File:rtsort.png||border|center|600px|rtsort command]]

=== Step 5 - RainbowCrack UI ===

Opening of the RainbowCrack user interface for password cracking.

Click on the following file to open the UI:

[[File:uiFile.png||border|center|600px|File to open the UI]]

The UI looks like this:

[[File:ui.png||border|center|550px|The UI]]

=== Step 6 - Adding the hashed passwords ===

Now the hashed passwords can be added.

By clicking on "File" -> "Add Hashes...":

[[File:addHashes.png||border|center|600px|Adding the Hashes]]

[[File:add.png||border|center|600px|Adding the Hashes]]

[[File:added.png||border|center|600px|Hashes added]]

=== Step 7 - Inserting the rainbow table ===

Now the created rainbow table can be inserted:

[[File:insertTable.png|Insert the rainbow table]]

=== Step 8 - Cracking passwords ===

Now the tool will try to crack the passwords.

[[File:cracked.png|The cracked passwords]]

The unsalted ones were cracked, the salted ones remained secret.

== Courses ==

* [[A course where this documentation was used]] (2017, 2018)

== References ==

* http://project-rainbowcrack.com/
* http://project-rainbowcrack.com/generate.htm

[[Category:Documentation]]

Password Cracking with RainbowCrack

2024-12-18T15:59:28Z

HAbdalla: /* Step 6 - Adding the hashed passwords */

== Summary ==

This documentation shows that salted passwords are more secure than unsalted passwords. A practical test was performed using the RainbowCrack tool. Simple passwords were used, both unsalted and salted, and then rainbow tables were created to crack the passwords. The test clearly shows that unsalted passwords were cracked, while salted passwords remained secure.

== Requirements ==

* Hashing tools/websites: To generate the hash values
* RainbowCrack: A tool for creating and using rainbow tables. [http://project-rainbowcrack.com/ RainbowCrack]

== Description ==

=== Step 1 - Installation ===

Installing the RainbowCrack tool: [http://project-rainbowcrack.com/ Download the RainbowCrack tool from here]

After downloading the .zip folder, it must be unpacked. The tool is then ready for use.

=== Step 2 - Choice of password and password hashing ===

Selection of the passwords to be cracked and the algorithm to be used to hash them.

For this practical test, the following passwords were used and hashed using the md5 algorithm.

{| class="wikitable" style="margin:auto"
|+ Used Passwords
|-
! plain text without salt !! hash !! plain text with salt !! hash
|-
| abcde || ab56b4d92b40713acc5af89985d4b786 || abcde1 || 0565a9d4889781545eae12fc99050921
|-
| abc || 900150983cd24fb0d6963f7d28e17f72 || abcwxz || 7bc7789b9e7a66c74c7222a8db097cbd
|-
| abc23 || 3be5ef429769acbb7b9bb73443ea9fee || abc23zyx || da18289e8de951b4a16e3da7ab6e5951
|-
| bc23 || 44af58e2ce5327a8f6a846e43085478c || bc23xyz || f4cdbc7a935c6ee7d283963228c3c44a
|}

=== Step 3 - Creating rainbow table ===

The command to create a rainbow table is "rtgen". This stands for "rainbow table generate".

The Syntax for creating the rainbow table:

[[File:rtgen.png|border|center|800px|Syntax of the rtgen command]]

For this test we create the following rainbow table:

<code>rtgen md5 loweralpha-numeric 1 6 1 2400 100000 0</code>

md5 ... Specifies the hash algorithm to use. In this case, it is the MD5 hashing algorithm.

loweralpha-numeric ... Defines the character set to be used for the passwords.

- loweralpha = Lowercase letters (a-z)

- numeric = Numbers (0-9)

Combined, the set includes all lowercase letters and numbers.

1 ... This is the minimum password length for the generated Rainbow Table.

6 ... This is the maximum password length for the generated Rainbow Table.

1 ... Represents the table index. This is used to distinguish between multiple tables for the same parameters.

2400 ... Specifies the chain length. The chain length determines how many hashes and plaintext combinations will be included in each chain.

100000 ... Indicates the number of chains in the table.

0 ... Used to split a large rainbow table into smaller files.

=== Step 4 - Sorting the rainbow table ===

Once the rainbow table has been created, it needs to be sorted so that it can be used correctly.

The command "rtsort ." sorts the rainbow table.

[[File:rtsort.png||border|center|600px|rtsort command]]

=== Step 5 - RainbowCrack UI ===

Opening of the RainbowCrack user interface for password cracking.

Click on the following file to open the UI:

[[File:uiFile.png||border|center|800px|File to open the UI]]

The UI looks like this:

[[File:ui.png||border|center|600px|The UI]]

=== Step 6 - Adding the hashed passwords ===

Now the hashed passwords can be added.

By clicking on "File" -> "Add Hashes...":

[[File:addHashes.png||border|center|600px|Adding the Hashes]]

[[File:add.png||border|center|600px|Adding the Hashes]]

[[File:added.png||border|center|600px|Hashes added]]

=== Step 7 - Inserting the rainbow table ===

Now the created rainbow table can be inserted:

[[File:insertTable.png|Insert the rainbow table]]

=== Step 8 - Cracking passwords ===

Now the tool will try to crack the passwords.

[[File:cracked.png|The cracked passwords]]

The unsalted ones were cracked, the salted ones remained secret.

== Courses ==

* [[A course where this documentation was used]] (2017, 2018)

== References ==

* http://project-rainbowcrack.com/
* http://project-rainbowcrack.com/generate.htm

[[Category:Documentation]]

Password Cracking with RainbowCrack

2024-12-18T15:58:39Z

HAbdalla: /* Step 5 - RainbowCrack UI */

== Summary ==

This documentation shows that salted passwords are more secure than unsalted passwords. A practical test was performed using the RainbowCrack tool. Simple passwords were used, both unsalted and salted, and then rainbow tables were created to crack the passwords. The test clearly shows that unsalted passwords were cracked, while salted passwords remained secure.

== Requirements ==

* Hashing tools/websites: To generate the hash values
* RainbowCrack: A tool for creating and using rainbow tables. [http://project-rainbowcrack.com/ RainbowCrack]

== Description ==

=== Step 1 - Installation ===

Installing the RainbowCrack tool: [http://project-rainbowcrack.com/ Download the RainbowCrack tool from here]

After downloading the .zip folder, it must be unpacked. The tool is then ready for use.

=== Step 2 - Choice of password and password hashing ===

Selection of the passwords to be cracked and the algorithm to be used to hash them.

For this practical test, the following passwords were used and hashed using the md5 algorithm.

{| class="wikitable" style="margin:auto"
|+ Used Passwords
|-
! plain text without salt !! hash !! plain text with salt !! hash
|-
| abcde || ab56b4d92b40713acc5af89985d4b786 || abcde1 || 0565a9d4889781545eae12fc99050921
|-
| abc || 900150983cd24fb0d6963f7d28e17f72 || abcwxz || 7bc7789b9e7a66c74c7222a8db097cbd
|-
| abc23 || 3be5ef429769acbb7b9bb73443ea9fee || abc23zyx || da18289e8de951b4a16e3da7ab6e5951
|-
| bc23 || 44af58e2ce5327a8f6a846e43085478c || bc23xyz || f4cdbc7a935c6ee7d283963228c3c44a
|}

=== Step 3 - Creating rainbow table ===

The command to create a rainbow table is "rtgen". This stands for "rainbow table generate".

The Syntax for creating the rainbow table:

[[File:rtgen.png|border|center|800px|Syntax of the rtgen command]]

For this test we create the following rainbow table:

<code>rtgen md5 loweralpha-numeric 1 6 1 2400 100000 0</code>

md5 ... Specifies the hash algorithm to use. In this case, it is the MD5 hashing algorithm.

loweralpha-numeric ... Defines the character set to be used for the passwords.

- loweralpha = Lowercase letters (a-z)

- numeric = Numbers (0-9)

Combined, the set includes all lowercase letters and numbers.

1 ... This is the minimum password length for the generated Rainbow Table.

6 ... This is the maximum password length for the generated Rainbow Table.

1 ... Represents the table index. This is used to distinguish between multiple tables for the same parameters.

2400 ... Specifies the chain length. The chain length determines how many hashes and plaintext combinations will be included in each chain.

100000 ... Indicates the number of chains in the table.

0 ... Used to split a large rainbow table into smaller files.

=== Step 4 - Sorting the rainbow table ===

Once the rainbow table has been created, it needs to be sorted so that it can be used correctly.

The command "rtsort ." sorts the rainbow table.

[[File:rtsort.png||border|center|600px|rtsort command]]

=== Step 5 - RainbowCrack UI ===

Opening of the RainbowCrack user interface for password cracking.

Click on the following file to open the UI:

[[File:uiFile.png||border|center|800px|File to open the UI]]

The UI looks like this:

[[File:ui.png||border|center|600px|The UI]]

=== Step 6 - Adding the hashed passwords ===

Now the hashed passwords can be added.

By clicking on "File" -> "Add Hashes...":

[[File:addHashes.png|Adding the Hashes]]

[[File:add.png|Adding the Hashes]]

[[File:added.png|Hashes added]]

=== Step 7 - Inserting the rainbow table ===

Now the created rainbow table can be inserted:

[[File:insertTable.png|Insert the rainbow table]]

=== Step 8 - Cracking passwords ===

Now the tool will try to crack the passwords.

[[File:cracked.png|The cracked passwords]]

The unsalted ones were cracked, the salted ones remained secret.

== Courses ==

* [[A course where this documentation was used]] (2017, 2018)

== References ==

* http://project-rainbowcrack.com/
* http://project-rainbowcrack.com/generate.htm

[[Category:Documentation]]

File:Cracked.png

2024-12-18T15:57:50Z

HAbdalla:

File:InsertTable.png

2024-12-18T15:57:35Z

HAbdalla:

File:Added.png

2024-12-18T15:57:18Z

HAbdalla:

File:Add.png

2024-12-18T15:57:05Z

HAbdalla:

File:AddHashes.png

2024-12-18T15:56:49Z

HAbdalla:

File:UiFile.png

2024-12-18T15:56:27Z

HAbdalla:

File:Ui.png

2024-12-18T15:56:06Z

HAbdalla:

Password Cracking with RainbowCrack

2024-12-18T15:55:20Z

HAbdalla: /* Step 4 - Sorting the rainbow table */

== Summary ==

This documentation shows that salted passwords are more secure than unsalted passwords. A practical test was performed using the RainbowCrack tool. Simple passwords were used, both unsalted and salted, and then rainbow tables were created to crack the passwords. The test clearly shows that unsalted passwords were cracked, while salted passwords remained secure.

== Requirements ==

* Hashing tools/websites: To generate the hash values
* RainbowCrack: A tool for creating and using rainbow tables. [http://project-rainbowcrack.com/ RainbowCrack]

== Description ==

=== Step 1 - Installation ===

Installing the RainbowCrack tool: [http://project-rainbowcrack.com/ Download the RainbowCrack tool from here]

After downloading the .zip folder, it must be unpacked. The tool is then ready for use.

=== Step 2 - Choice of password and password hashing ===

Selection of the passwords to be cracked and the algorithm to be used to hash them.

For this practical test, the following passwords were used and hashed using the md5 algorithm.

{| class="wikitable" style="margin:auto"
|+ Used Passwords
|-
! plain text without salt !! hash !! plain text with salt !! hash
|-
| abcde || ab56b4d92b40713acc5af89985d4b786 || abcde1 || 0565a9d4889781545eae12fc99050921
|-
| abc || 900150983cd24fb0d6963f7d28e17f72 || abcwxz || 7bc7789b9e7a66c74c7222a8db097cbd
|-
| abc23 || 3be5ef429769acbb7b9bb73443ea9fee || abc23zyx || da18289e8de951b4a16e3da7ab6e5951
|-
| bc23 || 44af58e2ce5327a8f6a846e43085478c || bc23xyz || f4cdbc7a935c6ee7d283963228c3c44a
|}

=== Step 3 - Creating rainbow table ===

The command to create a rainbow table is "rtgen". This stands for "rainbow table generate".

The Syntax for creating the rainbow table:

[[File:rtgen.png|border|center|800px|Syntax of the rtgen command]]

For this test we create the following rainbow table:

<code>rtgen md5 loweralpha-numeric 1 6 1 2400 100000 0</code>

md5 ... Specifies the hash algorithm to use. In this case, it is the MD5 hashing algorithm.

loweralpha-numeric ... Defines the character set to be used for the passwords.

- loweralpha = Lowercase letters (a-z)

- numeric = Numbers (0-9)

Combined, the set includes all lowercase letters and numbers.

1 ... This is the minimum password length for the generated Rainbow Table.

6 ... This is the maximum password length for the generated Rainbow Table.

1 ... Represents the table index. This is used to distinguish between multiple tables for the same parameters.

2400 ... Specifies the chain length. The chain length determines how many hashes and plaintext combinations will be included in each chain.

100000 ... Indicates the number of chains in the table.

0 ... Used to split a large rainbow table into smaller files.

=== Step 4 - Sorting the rainbow table ===

Once the rainbow table has been created, it needs to be sorted so that it can be used correctly.

The command "rtsort ." sorts the rainbow table.

[[File:rtsort.png||border|center|600px|rtsort command]]

=== Step 5 - RainbowCrack UI ===

Opening of the RainbowCrack user interface for password cracking.

Click on the following file to open the UI:

[[File:uiFile.png|File to open the UI]]

The UI looks like this:

[[File:ui.png|The UI]]

=== Step 6 - Adding the hashed passwords ===

Now the hashed passwords can be added.

By clicking on "File" -> "Add Hashes...":

[[File:addHashes.png|Adding the Hashes]]

[[File:add.png|Adding the Hashes]]

[[File:added.png|Hashes added]]

=== Step 7 - Inserting the rainbow table ===

Now the created rainbow table can be inserted:

[[File:insertTable.png|Insert the rainbow table]]

=== Step 8 - Cracking passwords ===

Now the tool will try to crack the passwords.

[[File:cracked.png|The cracked passwords]]

The unsalted ones were cracked, the salted ones remained secret.

== Courses ==

* [[A course where this documentation was used]] (2017, 2018)

== References ==

* http://project-rainbowcrack.com/
* http://project-rainbowcrack.com/generate.htm

[[Category:Documentation]]

File:Rtsort.png

2024-12-18T15:54:38Z

HAbdalla:

Password Cracking with RainbowCrack

2024-12-18T15:53:49Z

HAbdalla: /* Step 3 - Creating rainbow table */

== Summary ==

This documentation shows that salted passwords are more secure than unsalted passwords. A practical test was performed using the RainbowCrack tool. Simple passwords were used, both unsalted and salted, and then rainbow tables were created to crack the passwords. The test clearly shows that unsalted passwords were cracked, while salted passwords remained secure.

== Requirements ==

* Hashing tools/websites: To generate the hash values
* RainbowCrack: A tool for creating and using rainbow tables. [http://project-rainbowcrack.com/ RainbowCrack]

== Description ==

=== Step 1 - Installation ===

Installing the RainbowCrack tool: [http://project-rainbowcrack.com/ Download the RainbowCrack tool from here]

After downloading the .zip folder, it must be unpacked. The tool is then ready for use.

=== Step 2 - Choice of password and password hashing ===

Selection of the passwords to be cracked and the algorithm to be used to hash them.

For this practical test, the following passwords were used and hashed using the md5 algorithm.

{| class="wikitable" style="margin:auto"
|+ Used Passwords
|-
! plain text without salt !! hash !! plain text with salt !! hash
|-
| abcde || ab56b4d92b40713acc5af89985d4b786 || abcde1 || 0565a9d4889781545eae12fc99050921
|-
| abc || 900150983cd24fb0d6963f7d28e17f72 || abcwxz || 7bc7789b9e7a66c74c7222a8db097cbd
|-
| abc23 || 3be5ef429769acbb7b9bb73443ea9fee || abc23zyx || da18289e8de951b4a16e3da7ab6e5951
|-
| bc23 || 44af58e2ce5327a8f6a846e43085478c || bc23xyz || f4cdbc7a935c6ee7d283963228c3c44a
|}

=== Step 3 - Creating rainbow table ===

The command to create a rainbow table is "rtgen". This stands for "rainbow table generate".

The Syntax for creating the rainbow table:

[[File:rtgen.png|border|center|800px|Syntax of the rtgen command]]

For this test we create the following rainbow table:

<code>rtgen md5 loweralpha-numeric 1 6 1 2400 100000 0</code>

md5 ... Specifies the hash algorithm to use. In this case, it is the MD5 hashing algorithm.

loweralpha-numeric ... Defines the character set to be used for the passwords.

- loweralpha = Lowercase letters (a-z)

- numeric = Numbers (0-9)

Combined, the set includes all lowercase letters and numbers.

1 ... This is the minimum password length for the generated Rainbow Table.

6 ... This is the maximum password length for the generated Rainbow Table.

1 ... Represents the table index. This is used to distinguish between multiple tables for the same parameters.

2400 ... Specifies the chain length. The chain length determines how many hashes and plaintext combinations will be included in each chain.

100000 ... Indicates the number of chains in the table.

0 ... Used to split a large rainbow table into smaller files.

=== Step 4 - Sorting the rainbow table ===

Once the rainbow table has been created, it needs to be sorted so that it can be used correctly.

The command "rtsort ." sorts the rainbow table.

[[File:rtsort.png|rtsort command]]

=== Step 5 - RainbowCrack UI ===

Opening of the RainbowCrack user interface for password cracking.

Click on the following file to open the UI:

[[File:uiFile.png|File to open the UI]]

The UI looks like this:

[[File:ui.png|The UI]]

=== Step 6 - Adding the hashed passwords ===

Now the hashed passwords can be added.

By clicking on "File" -> "Add Hashes...":

[[File:addHashes.png|Adding the Hashes]]

[[File:add.png|Adding the Hashes]]

[[File:added.png|Hashes added]]

=== Step 7 - Inserting the rainbow table ===

Now the created rainbow table can be inserted:

[[File:insertTable.png|Insert the rainbow table]]

=== Step 8 - Cracking passwords ===

Now the tool will try to crack the passwords.

[[File:cracked.png|The cracked passwords]]

The unsalted ones were cracked, the salted ones remained secret.

== Courses ==

* [[A course where this documentation was used]] (2017, 2018)

== References ==

* http://project-rainbowcrack.com/
* http://project-rainbowcrack.com/generate.htm

[[Category:Documentation]]

Password Cracking with RainbowCrack

2024-12-18T15:52:01Z

HAbdalla: /* Step 3 - Creating rainbow table */

== Summary ==

This documentation shows that salted passwords are more secure than unsalted passwords. A practical test was performed using the RainbowCrack tool. Simple passwords were used, both unsalted and salted, and then rainbow tables were created to crack the passwords. The test clearly shows that unsalted passwords were cracked, while salted passwords remained secure.

== Requirements ==

* Hashing tools/websites: To generate the hash values
* RainbowCrack: A tool for creating and using rainbow tables. [http://project-rainbowcrack.com/ RainbowCrack]

== Description ==

=== Step 1 - Installation ===

Installing the RainbowCrack tool: [http://project-rainbowcrack.com/ Download the RainbowCrack tool from here]

After downloading the .zip folder, it must be unpacked. The tool is then ready for use.

=== Step 2 - Choice of password and password hashing ===

Selection of the passwords to be cracked and the algorithm to be used to hash them.

For this practical test, the following passwords were used and hashed using the md5 algorithm.

{| class="wikitable" style="margin:auto"
|+ Used Passwords
|-
! plain text without salt !! hash !! plain text with salt !! hash
|-
| abcde || ab56b4d92b40713acc5af89985d4b786 || abcde1 || 0565a9d4889781545eae12fc99050921
|-
| abc || 900150983cd24fb0d6963f7d28e17f72 || abcwxz || 7bc7789b9e7a66c74c7222a8db097cbd
|-
| abc23 || 3be5ef429769acbb7b9bb73443ea9fee || abc23zyx || da18289e8de951b4a16e3da7ab6e5951
|-
| bc23 || 44af58e2ce5327a8f6a846e43085478c || bc23xyz || f4cdbc7a935c6ee7d283963228c3c44a
|}

=== Step 3 - Creating rainbow table ===

The command to create a rainbow table is "rtgen". This stands for "rainbow table generate".

The Syntax for creating the rainbow table:

[[File:rtgen.png|frame|50px|Syntax of the rtgen command]]

For this test we create the following rainbow table:

<code>rtgen md5 loweralpha-numeric 1 6 1 2400 100000 0</code>

md5 ... Specifies the hash algorithm to use. In this case, it is the MD5 hashing algorithm.

loweralpha-numeric ... Defines the character set to be used for the passwords.

- loweralpha = Lowercase letters (a-z)

- numeric = Numbers (0-9)

Combined, the set includes all lowercase letters and numbers.

1 ... This is the minimum password length for the generated Rainbow Table.

6 ... This is the maximum password length for the generated Rainbow Table.

1 ... Represents the table index. This is used to distinguish between multiple tables for the same parameters.

2400 ... Specifies the chain length. The chain length determines how many hashes and plaintext combinations will be included in each chain.

100000 ... Indicates the number of chains in the table.

0 ... Used to split a large rainbow table into smaller files.

=== Step 4 - Sorting the rainbow table ===

Once the rainbow table has been created, it needs to be sorted so that it can be used correctly.

The command "rtsort ." sorts the rainbow table.

[[File:rtsort.png|rtsort command]]

=== Step 5 - RainbowCrack UI ===

Opening of the RainbowCrack user interface for password cracking.

Click on the following file to open the UI:

[[File:uiFile.png|File to open the UI]]

The UI looks like this:

[[File:ui.png|The UI]]

=== Step 6 - Adding the hashed passwords ===

Now the hashed passwords can be added.

By clicking on "File" -> "Add Hashes...":

[[File:addHashes.png|Adding the Hashes]]

[[File:add.png|Adding the Hashes]]

[[File:added.png|Hashes added]]

=== Step 7 - Inserting the rainbow table ===

Now the created rainbow table can be inserted:

[[File:insertTable.png|Insert the rainbow table]]

=== Step 8 - Cracking passwords ===

Now the tool will try to crack the passwords.

[[File:cracked.png|The cracked passwords]]

The unsalted ones were cracked, the salted ones remained secret.

== Courses ==

* [[A course where this documentation was used]] (2017, 2018)

== References ==

* http://project-rainbowcrack.com/
* http://project-rainbowcrack.com/generate.htm

[[Category:Documentation]]

File:Rtgen.png

2024-12-18T15:50:35Z

HAbdalla:

Password Cracking with RainbowCrack

2024-12-18T15:49:39Z

HAbdalla: Created page with "== Summary == This documentation shows that salted passwords are more secure than unsalted passwords. A practical test was performed using the RainbowCrack tool. Simple passwords were used, both unsalted and salted, and then rainbow tables were created to crack the passwords. The test clearly shows that unsalted passwords were cracked, while salted passwords remained secure. == Requirements == * Hashing tools/websites: To generate the hash values * RainbowCrack: A..."

== Summary ==

This documentation shows that salted passwords are more secure than unsalted passwords. A practical test was performed using the RainbowCrack tool. Simple passwords were used, both unsalted and salted, and then rainbow tables were created to crack the passwords. The test clearly shows that unsalted passwords were cracked, while salted passwords remained secure.

== Requirements ==

* Hashing tools/websites: To generate the hash values
* RainbowCrack: A tool for creating and using rainbow tables. [http://project-rainbowcrack.com/ RainbowCrack]

== Description ==

=== Step 1 - Installation ===

Installing the RainbowCrack tool: [http://project-rainbowcrack.com/ Download the RainbowCrack tool from here]

After downloading the .zip folder, it must be unpacked. The tool is then ready for use.

=== Step 2 - Choice of password and password hashing ===

Selection of the passwords to be cracked and the algorithm to be used to hash them.

For this practical test, the following passwords were used and hashed using the md5 algorithm.

{| class="wikitable" style="margin:auto"
|+ Used Passwords
|-
! plain text without salt !! hash !! plain text with salt !! hash
|-
| abcde || ab56b4d92b40713acc5af89985d4b786 || abcde1 || 0565a9d4889781545eae12fc99050921
|-
| abc || 900150983cd24fb0d6963f7d28e17f72 || abcwxz || 7bc7789b9e7a66c74c7222a8db097cbd
|-
| abc23 || 3be5ef429769acbb7b9bb73443ea9fee || abc23zyx || da18289e8de951b4a16e3da7ab6e5951
|-
| bc23 || 44af58e2ce5327a8f6a846e43085478c || bc23xyz || f4cdbc7a935c6ee7d283963228c3c44a
|}

=== Step 3 - Creating rainbow table ===

The command to create a rainbow table is "rtgen". This stands for "rainbow table generate".

The Syntax for creating the rainbow table:

[[File:rtgen.png|Syntax of the rtgen command]]

For this test we create the following rainbow table:

<code>rtgen md5 loweralpha-numeric 1 6 1 2400 100000 0</code>

md5 ... Specifies the hash algorithm to use. In this case, it is the MD5 hashing algorithm.

loweralpha-numeric ... Defines the character set to be used for the passwords.

- loweralpha = Lowercase letters (a-z)

- numeric = Numbers (0-9)

Combined, the set includes all lowercase letters and numbers.

1 ... This is the minimum password length for the generated Rainbow Table.

6 ... This is the maximum password length for the generated Rainbow Table.

1 ... Represents the table index. This is used to distinguish between multiple tables for the same parameters.

2400 ... Specifies the chain length. The chain length determines how many hashes and plaintext combinations will be included in each chain.

100000 ... Indicates the number of chains in the table.

0 ... Used to split a large rainbow table into smaller files.

=== Step 4 - Sorting the rainbow table ===

Once the rainbow table has been created, it needs to be sorted so that it can be used correctly.

The command "rtsort ." sorts the rainbow table.

[[File:rtsort.png|rtsort command]]

=== Step 5 - RainbowCrack UI ===

Opening of the RainbowCrack user interface for password cracking.

Click on the following file to open the UI:

[[File:uiFile.png|File to open the UI]]

The UI looks like this:

[[File:ui.png|The UI]]

=== Step 6 - Adding the hashed passwords ===

Now the hashed passwords can be added.

By clicking on "File" -> "Add Hashes...":

[[File:addHashes.png|Adding the Hashes]]

[[File:add.png|Adding the Hashes]]

[[File:added.png|Hashes added]]

=== Step 7 - Inserting the rainbow table ===

Now the created rainbow table can be inserted:

[[File:insertTable.png|Insert the rainbow table]]

=== Step 8 - Cracking passwords ===

Now the tool will try to crack the passwords.

[[File:cracked.png|The cracked passwords]]

The unsalted ones were cracked, the salted ones remained secret.

== Courses ==

* [[A course where this documentation was used]] (2017, 2018)

== References ==

* http://project-rainbowcrack.com/
* http://project-rainbowcrack.com/generate.htm

[[Category:Documentation]]