Security Team Intelligence

Password Cracking: Top Tools Hackers Use to Crack Passwords

Jul 25, 2017
Guest Author

What’s the quickest way to a hacker’s heart? Make sure your business email password is “Password123.” Or perhaps “Summer2017” if you want to play coy. You do that and you fit into their perfect profile… of the perfect data breach victim.

In all seriousness, this blog post has the following objectives:

Show you how hackers prey on the presence of weak or default passwords
Learn the differences between password cracking and guessing, and the tools hacker use to get this done
Understand the importance of performing self audits (yep, hack your own company) [The live demo of password self-audit can be found here: Top five tools hackers use to crack passwords]

First off, what is penetration testing? Penetration Testing is the active exploitation of risk in applications, network devices, and systems. As it happens, the easiest way to actively exploit a system is to have the password or key. So how does an ethical hacker (and really, malicious ones, too) get a password or key? There are several ways to go about it (Hackers <3 Stealing Passwords):

Guessing – Using a password dictionary in an effort to guess a valid password
Sniffing – Man in the middle a conversation between network nodes, gather clear-text passwords and/or hashes
Phishing – Target end users in spear phishing attacks intended to compromise systems or harvest credentials
Cracking – Attempt to resolve an encrypted or hashed password to its clear-text equivalent

We’ll look at each one of this separately. Starting with password guessing.

Password Guessing

Requires a User List – You can’t crack a password without an account to attack. So how do you get a user list?
- Open source intelligence gathering
- Guess the usernames, too! Assume one account is protected by ‘Password1’ or ‘Spring2017’, and see if it sticks (asmith, bsmith, csmith, dsmith, etc.)
- Customize a password list to the company you’re targeting! ‘Apple1’ or ‘nymta1234’ or ‘Comp@ny1’
Think simple – End users hate passwords, and will go with something that is easy to remember, and this is what attackers target

Password Guessing Limitations & Tools

Service Oriented
- Password guessing attacks typically target live services such as SSH, FTP, HTTP, or web applications
Limited Bandwidth
- Guessing attacks are slow, you are limited by the network and system being attacked, lucky if you can try 100 passwords/sec
Account Lockouts
- This is like a security control catch-22 (a vuln-ducken?), even if an attacker fails to guess a password, they can still lock out every account on an application or server
Tools:
- Medusa
- THC-Hydra
- Burp Suite
- Metasploit Framework

Password Sniffing

Requires a condition where an attacker can induce another host on the network to route traffic through their system
Typically exploits a broadcast protocol (ARP, LLMNR)
Encrypted protocols and hashed passwords are not immune (NTLM relay attacks)
Tools:
- Ettercap
- SSLStrip
- WireShark
- Responder
- SmbrelayX

Password Phishing

Targeted Phishing Attack
- Sometimes the easiest way to get a password is to just ask for it, or create a pretext to trick users
Password complexity is not a factor as long as the victim supplies a valid password
Relies heavily on open source intelligence gathering to generate a list of targets, and web applications to spoof
Domain registration is cheap – Why not compliment this attack with a well crafted domain “microsofast.com”, “gooqle.com”, etc

Password Phishing Limitations and Tools

Victim List
- If you can’t find a ton of information about a company via open source intelligence gathering, you’ll have less success
Tools
- Web server (Apache, IIS, Python)
- Wget (mirror a website)
- Metasploit (host a payload listener and exploit)
- Perl (CGI scripting to harvest credentials)
- GoDaddy (or any domain registrar)
- SET (Social Engineering Toolkit)
- King Phisher (amazing all in one tool for phishing attacks)