- [Instructor] Now, let's explore some of the tools
for credential-base attacks.
One of the most popular tools out there
for cracking passwords offline is called John the Ripper.
It's a very, very popular tool,
and in many cases, actually,
people just refer to it as John.
It actually uses search patterns,
as well as password files, or wordlists,
to crack passwords.
It actually supports different cracking modes,
and understands many different cipher text formats,
including different variants of encryption
and hashing algorithms.
You can download John the Ripper from the link
that I'm actually showing on the screen, openwall.com/john.
Now, let's take a look at an example
of using John the Ripper using a hash file
that you already obtained from a compromised system.
So, let's suppose you already got a foothold of a system,
you compromise a system, you have a shell,
and now you we're able to obtain a hash file
from that system, then, in this case,
we're actually using John the Ripper to crack that password
using wordlist, so using a series of words
in a specific list than can contain
even legitimate passwords.
Nowadays, there are many wordlists out there
that contain passwords that have been exposed
because of many different breaches out there.
Now, cracking passwords can take anywhere
between a couple of minutes, a couple of seconds,
a couple of days, a couple of weeks, months,
or years even, depending on your computing power,
depending on the efficacy of your wordlist,
and also, whether you're using GPU's,
or you're just using your CPU, and so on.
In many cases, in real pent testing activities,
you have a separate system, a dedicated system,
to perform password cracking.
You're probably not gonna be doing this in your laptop
unless it's actually something
extremely simple to actually crack,
but in many cases, of course, you'd have dedicated systems.
It also depending on the salt mechanism
that the system actually use to encrypt
or hash the password.
So, in this case, actually,
we know since we are doing a quick demo here,
we had a hash file that was actually cracked
within a couple of seconds.
Now, another tool that is very, very popular,
it's called Hashcat.
And it's somewhat similar to John the Ripper,
it actually has a lot of different options,
and also can be used in systems
that are dedicated with different GPU's.
OclHashcat is the equivalent of Hashcat
to run in those systems.
Now, let's cover a concept that has been used
for many attackers for many years called rainbow tables.
And basically, attackers often use rainbow tables
to accelerate password cracking.
It is possible to use a rainbow table
to derive a password by actually looking at the hash value.
And basically what a rainbow table is,
it's a precomputed table for reversing
cryptographic hash functions.
Now, the tool Rainbow Crack, or Rcrack,
can actually be used to automate the cracking of passwords
using rainbow tables.
C-E-W-L, or cool, that's how you actually pronounce it,
is a great tool that can be used to create wordlists.
You can you Cewl to crawl websites and retrieve words.
For example, I can actually just point it to any website,
like the hackit.org, or theartofhacking.org,
and actually obtain a lot of different lists,
and save those lists to a specific file.