Password Security, Threats and Measures - Revision history

HAbdalla at 17:37, 18 December 2024

2024-12-18T17:37:54Z

← Older revision		Revision as of 17:37, 18 December 2024
Line 163:		Line 163:
	* https://ieeexplore.ieee.org/document/9023888		* https://ieeexplore.ieee.org/document/9023888
	* https://ieeexplore.ieee.org/document/9609778		* https://ieeexplore.ieee.org/document/9609778
			* https://ieeexplore.ieee.org/document/8400211
			* https://ieeexplore.ieee.org/document/10127057
			* https://hashcat.net/hashcat/
			* https://ieeexplore.ieee.org/document/8500257
			* https://ieeexplore.ieee.org/document/9821858?signout=success

	[[Category:Documentation]]		[[Category:Documentation]]

HAbdalla at 17:32, 18 December 2024

2024-12-18T17:32:04Z

← Older revision		Revision as of 17:32, 18 December 2024
Line 115:		Line 115:
	* Operating system/Platform: Kali Linux		* Operating system/Platform: Kali Linux
	* Packages: git openwall/john		* Packages: git openwall/john


	== Cracking a password ==		== Cracking a password ==

HAbdalla at 17:29, 18 December 2024

2024-12-18T17:29:40Z

← Older revision		Revision as of 17:29, 18 December 2024
Line 9:		Line 9:
	The quality of a password is described as the time it takes to crack a password using the trial and error method. Passwords which take longer to crack are considered to be of higher quality.		The quality of a password is described as the time it takes to crack a password using the trial and error method. Passwords which take longer to crack are considered to be of higher quality.
	The entropy of a password is described as the randomness and unpredictability of a password. The entropy of a password can be impacted through factors like the length and character set size.		The entropy of a password is described as the randomness and unpredictability of a password. The entropy of a password can be impacted through factors like the length and character set size.

			=== Hashing ===

			To minimize security risks, it is not only crucial to choose strong passwords but also to implement effective security measures.

			One of the most important ways to securely store passwords is by using cryptographic methods like hashing, which is a core element of modern password security.

			Passwords are transformed into a non-reversible, fixed-length string of characters known as hash values using a mathematical algorithm. Cryptographic hash functions must meet certain criteria, such as being one-way (irreversible), collision-resistant, efficient, and deterministic.

			While both cryptographic hash functions and PBKDFs (Password-Based Key Derivation Functions) are used to securely process passwords, they operate differently. A cryptographic hash function, such as SHA-256, converts an input into a fixed-length hash value, which is typically computed quickly. In contrast, PBKDFs (e.g., PBKDF2, bcrypt, scrypt) use multiple iterations and additional salt values to deliberately slow down attackers, particularly in brute-force attacks.

			=== Salt and Pepper ===

			Salting:
			Salting is a technique used to enhance password security by adding a random, unique value (the "salt") to a password before hashing it. This protects against attacks like Rainbow-Table attacks, as identical passwords will generate different hash values due to the unique salt. Salting makes it harder for attackers to quickly crack passwords using precomputed tables.

			Peppering:
			Peppering adds another layer of security by appending a secret, constant value (the "pepper") to the password. Unlike the salt, the pepper is not stored in the database but is kept secret on the server side.

	=== Password Managers ===		=== Password Managers ===
Line 37:		Line 55:
	* Keylogging		* Keylogging
	Is recording the keystrokes which a user puts in.		Is recording the keystrokes which a user puts in.


	==== Attacks ====		==== Attacks ====
Line 43:		Line 60:

	Some of these attacks are:		Some of these attacks are:
	* Brute-Force ~~and Dictionary Attacks~~		* Brute-Force
	~~Trying to guess~~ the password or ~~using wordlists~~.		Systematic testing of every possible combination of characters until the password is found.
			* Dictionary Attack
			Test passwords from a prepared list of common or frequently used passwords.
			* Hybrid Attack
			A hybrid attack combines the concepts of dictionary and brute force attacks. It starts with a list of known passwords and expands these with systematic combinations.
	* Rainbow-Table Attack		* Rainbow-Table Attack
	~~Hashing a password over~~ and ~~over again in order~~ to ~~gain the same hash as the victim password and then reconstruct the plaintext password~~.		Use of pre-calculated tables containing plaintext passwords and their hashes to quickly crack passwords.
			* Social Engineering Attack
			Social engineering uses psychological manipulation to trick people into disclosing confidential information or performing unsafe acts.

	== Security Measures ==		== Security Measures ==
Line 67:		Line 90:
	These are only some of the cracking tools which can be used to attack a victims account:		These are only some of the cracking tools which can be used to attack a victims account:
	* John The Ripper		* John The Ripper
	~~Supports~~ brute-force and ~~dictionary~~ attacks. This tool will be used later in this documentation to present a password cracking process.		A widely used open-source password cracking tool that supports various hashing algorithms and can crack passwords using dictionary, brute force and hybrid attacks. John the Ripper (JtR) offers various modes:
			The Single Crack Mode uses personal information such as user names
			to guess passwords efficiently.
			The Wordlist Mode uses prefabricated word lists to test known terms or patterns.
			Incremental mode relies on brute force attacks in which all possible character combinations are systematically tried out.
			In external mode, users can develop their own methods for cracking passwords.

			This tool will be used later in this documentation to present a password cracking process.

	* Hashcat		* Hashcat
	~~Offers~~ brute-force, dictionary, mask attacks and ~~more~~.		Hashcat is a powerful open-source password cracking tool that runs on Linux, Windows and macOS and supports a variety of hashing algorithms and attack methods including brute force, dictionary, hybrid and mask attacks. Hashcat combines CPU and GPU-based calculations in a single application. A highlight is the ability to create customised rules to flexibly adapt attacks to known vulnerabilities or patterns.

			* RainbowCrack
			RainbowCrack is a password cracking tool that uses the Rainbow Table technique to crack passwords efficiently, based on the time-memory trade-off concept. It supports common hash algorithms such as LM, NTLM, MD5, SHA1 and SHA256 and uses the reduction function to save memory space.

	* OPH Crack		* OPH Crack
	Implements the rainbow table attack.		Implements the rainbow table attack.

			* Medusa
			Medusa is a parallel brute force tool that can attack multiple network protocols (such as SSH, FTP, HTTP) to crack passwords. Thanks to its modular structure, protocols can be flexibly adapted, and parallel processing enables up to 2000 password attempts per minute.

	== Requirements ==		== Requirements ==

NSelimovic at 18:25, 4 March 2024

2024-03-04T18:25:16Z

← Older revision		Revision as of 18:25, 4 March 2024
Line 65:		Line 65:

	== Password Cracking Tools ==		== Password Cracking Tools ==
	These are only some of the cracking tools:		These are only some of the cracking tools which can be used to attack a victims account:
	* John The Ripper		* John The Ripper
	Supports brute-force and dictionary attacks. This tool will be used later in this documentation to present a password cracking process.		Supports brute-force and dictionary attacks. This tool will be used later in this documentation to present a password cracking process.

NSelimovic: /* Description */

2024-03-04T18:22:51Z

Description

← Older revision		Revision as of 18:22, 4 March 2024
Line 82:		Line 82:


	== ~~Description~~ ==		== Cracking a password ==
	The following steps are necessary in order to crack a password. Kali linux is used as the operating system as it provides different cracking tools and more. The used tool for this crack process is "John The Ripper".		The following steps are necessary in order to crack a password. Kali linux is used as the operating system as it provides different cracking tools and more. The used tool for this crack process is "John The Ripper".
	* NOTE: Password cracking is unethical. This demonstration serves for educational purposes and should not be recreated.		* NOTE: Password cracking is unethical. This demonstration serves for educational purposes and should not be recreated.
Line 117:		Line 117:
	This way john will try to crack the password with the password-list.txt password list file.		This way john will try to crack the password with the password-list.txt password list file.
	* In the case of a successful attack, john will provide a confirmation message about the successful attack and display the password.		* In the case of a successful attack, john will provide a confirmation message about the successful attack and display the password.

	== References ==		== References ==

NSelimovic at 18:22, 4 March 2024

2024-03-04T18:22:16Z

@@ Line 28: / Line 28: @@
 === Threats ===
 These weakly created passwords are often the victim to different threats. These threats are
 == Requirements ==
@@ Line 37: / Line 83: @@
 == Description ==
 === Step 1 ===
-Enter these commands in the shell
+Create a .zip password secured archive.
-  echo foo
+  sudo apt-get install zip
 === Step 2 ===
-Make sure to read
+Now the hash of the password needs to be achieved.
-* War and Peace
+=== Step 3 ===
-== Used Hardware ==
+Now the hash can be cracked. The crack is only successful if the password is in the password list that john uses to compare the hashes.
-[[Device to be used with this documentation]]
+ john hash.txt
-== Courses ==
+The passwordlist in this case is the default password list of john. However, different password lists can be used by specifying the file they are saved as.
-* [[A course where this documentation was used]] (2017, 2018)
+ john --wordlist=/tmp/password-list.txt hash.txt
 == References ==
 * https://www.openwall.com/john/
 * https://www.kali.org/tools/john/
 * https://www.kali.org/
 [[Category:Documentation]]

NSelimovic: Created page with "== Summary == This documentation provides an overview of the threats to passwords and the security measures taken against them. Furtheron, this article provides a presentation on how to crack a password with the pentesting tool "John The Ripper". == Password Security == Passwords are the most used authentication method. Therefore, the security of a password is of significant importance. The strenght of a password can be measured through the quality of the password or..."

2024-03-04T01:17:19Z

Created page with "== Summary == This documentation provides an overview of the threats to passwords and the security measures taken against them. Furtheron, this article provides a presentation on how to crack a password with the pentesting tool "John The Ripper". == Password Security == Passwords are the most used authentication method. Therefore, the security of a password is of significant importance. The strenght of a password can be measured through the quality of the password or..."

New page

== Summary ==

This documentation provides an overview of the threats to passwords and the security measures taken against them. Furtheron, this article provides a presentation on how to crack a password with the pentesting tool "John The Ripper".

== Password Security ==

Passwords are the most used authentication method. Therefore, the security of a password is of significant importance. The strenght of a password can be measured through the quality of the password or its entropy. Besides the quality and entropy of a password, factors like personal data or known passwords have to be considered.

The quality of a password is described as the time it takes to crack a password using the trial and error method. Passwords which take longer to crack are considered to be of higher quality.
The entropy of a password is described as the randomness and unpredictability of a password. The entropy of a password can be impacted through factors like the length and character set size.

=== Password Managers ===

Password managers can store the passwords, guide the creation and provide security when sharing passwords. Password managers can include aid in the cases of long, complex and important passwords as they store the passwords of the user and provide a certain level of security. These managers often consist of several authentication steps in order to achieve this certain level of security. The functionality can differ as there are different types of managers.

Types of password managers:
* Cloud-Based Password Managers
* Local Password Managers
* Browser-Based Managers
* Enterprise Managers
* Hardware Password Managers

== Vulnerabilities and Threats ==

Passwords are mostly created by humans and are therefore a subject to vulnerabilities. Humans seek simplicity and comfort and they try to create easy to remember passwords. They often use personal information in order to provide a memorable word. Most of them use the same passwords on multiple websites and neither do they change them frequently. Close to two thirds of users do not use special characters in their passwords.

These factors create many vulnerabilities as they make the passwords predictable, of low quality or entropy and therefore easier to crack.

=== Threats ===
These weakly created passwords are often the victim to different threats. These threats are

== Requirements ==

* Operating system/Platform: Kali Linux
* Packages: git openwall/john

== Description ==

=== Step 1 ===

Enter these commands in the shell

echo foo
echo bar

=== Step 2 ===

Make sure to read

* War and Peace
* Lord of the Rings
* The Baroque Cycle

== Used Hardware ==

[[Device to be used with this documentation]]
[[Maybe another device to be used with this documentation]]

== Courses ==

* [[A course where this documentation was used]] (2017, 2018)
* [[Another one]] (2018)

== References ==

* https://www.openwall.com/john/
* https://www.kali.org/tools/john/
* https://www.kali.org/

[[Category:Documentation]]