Password Cracking
AKA how to be a real hackerman
Husnain
Have you ever gotten an email like this?
How did they get the password in the first place?
Password dumps.
https://haveibeenpwned.com/Passwords
How do hackers get these dumps?
How do websites store passwords?
Website
Database
requests password
sends back if password is in database
How do websites store passwords?
How do websites store passwords?
{“username” : “user”,
“password”: “password”}
How do websites store passwords?
{“username” : “user”,
“password”: “password”}
Database
SELECT * FROM users WHERE username == “user” AND password == “password”
How do websites store passwords?
Database
user found!
How do websites store passwords?
Database
user found!
redirect to actual page
SQL - language that databases speak
SELECT
username, bio FROM users
WHERE username LIKE "%a%"
input
SQL Injection
we don’t sanitize user input...
SELECT
username, bio FROM users
WHERE username LIKE "%%%"
matches any string
SQL Injection
so we can get arbitrary code execution!
SELECT
username, bio FROM users
WHERE username LIKE "%" UNION SELECT 1,2;--%"
Table Enumeration
so we can get arbitrary code execution!
SELECT
username, bio FROM users
WHERE username LIKE "%" UNION
SELECT 1,sql FROM sqlite_master WHERE type='table'
;--%"
CREATE TABLE users (
username text primary key not null,
password_hash text not null,
hint text not null,
bio text not null)
table name
column names
How to leak passwords?
Left as exercise
Hashing
If things go wrong, an attacker can leak all passwords on a server
Therefore, most websites don’t store raw passwords, but hashed ones
From Wikipedia: “A hash function is any function that can be used to map data of arbitrary size to fixed-size values.”
Basically, a function that is easy to calculate one way but hard to go back the other way*
Example: MD5
md5(“password”) = 5f4dcc3b5aa765d61d8327deb882cf99
md5(“Password”) = dc647eb65e6711e155375218212b3964
Don’t use MD5
https://github.com/mxrch/penglab
* Computers are very fast
We can crack 21 billion hashes per second!
Brute-force attack
Assuming your password contains just uppercase characters, lowercase characters, and numbers ([A-Z],[a-z],[0-9]), we have:
Number of Characters | Number of Possible Passwords | Time to Crack |
3 | 238328 | nearly instantly |
4 | ~14 million | nearly instantly |
5 | ~900 million | 43 milliseconds |
6 | ~56 billion | 2.7 seconds |
7 | ~3.5*10^12 | 2 minutes |
8 | ~2.2*10^14 | 3 hours |
9 | ~1.4*10^16 | 7.5 days |
Live demo (brute force)
Dictionary attack
If people use a password on a compromised site, they probably have used it on another website
Live demo (dictionary attack)
Rule attack
password
password123
password00
p@ssword
pa$$word
Password
P@$$word
Pa$$w0rd
P@$$w0rd
123Password123
123password123
...
Live demo (rule attack)
How to protect yourself
Obligatory XKCD reference
Questions?