The dictstat Python script is a great little tool for password cracking results analysis or for regular wordlist analysis. The dictstat application is located in the /pentest/passwords/pack directory on Backtrack 5 R3 and can be run using “python dictstat.py” from within that directory. Written by iphelix during the 2010 Crack Me If You Can password cracking competition and is part of a larger toolset called PACK or Password Analysis and Cracking Kit. Below we show some examples of dictstat in action along with some details of the available parsing mechanisms that are in place.
The below article explains how I used password fingerprinting to crack 500,000 password hashes in less than half a day completly automated. This article shows each command step by step, but only to describe the details of how password fingerprinting with oclHashcat works. The reality is that the password fingerprinting process can easily be automated by a script which is why we call it automated password cracking.
The Fingerprint Attack in my example had a success rate of about 80% in a 100% automated process after 12 hours with a single GeForce GTX 285. In order to reach the 500,000 cracked hashes I first created a list of 650,000 unique password hashes using a well known leaked password hash database. Once I had the list of 650,000 unique password hashes I started out by doing some easy attacks on the hashes such as a five character long brute force using all possible character sets which will provide an initial wordlist to start the fingerprint attack with. You really do not need to perform this step as explained further below. Once the initial brute force attack is complete the real fingerprinting starts. You will take the initial results, pipe them into the expander, and then run a combined dictionary attack against the hash list. Once we have results from the second set of attacks we use the expander again and issue another attack. You will see through the process, which is described in detail below, that results are returned at a very high rate by automated finding patterns and exploiting those patterns to return results.
Recently I have started using Hashcat-gui a lot more to test the strength of various passwords for certain clients. One of the things I wasn’t sure of at first was how to save charsets in the Bruteforce Settings window and while it would be nice if you could have a text file that included various charsets you could select from the drop down menu it is also easy to save your preferred charsets as Hashcat Jobs. Below is information on how to save charsets as Hashcat Jobs as well as recommended charsets you might want to save.
Hashcat is an excellent tool to use or security audits of passwords. I will be doing a series of articles relating to anything from simple brute forcing such as the article to more complex techniques using Hashcat, oclHashcat, and the Hashcat-gui on both Windows and Linux operating systems. The goal is to make people more aware of the technologies available to crack passwords which should allow people to audit their companies passwords for more strict enforcement. This article relates to using the Hashcat-gui on Windows 7 to crack 10 MD5 hashes and assumes that you already have successfully installed Hashcat and the Hashcat-gui.
Ruby on Rails 1.2 and above automatically set a Content-type header including charset=UTF-8, which is well and good if you’re designing an application from scratch – JoelOnSoftware has a good introduction to character sets, for those who need a refresher – but breaks things in subtle ways if you are upgrading a legacy Rails 1.1…