- [Instructor] There are several password attacks out there.
And here are a few examples of the most common ones.
The first one is password guessing,
and password guessing is actually one of the most type,
most common type of password attacks.
But some of these techniques may be very inefficient.
Threat actors can guess passwords locally or remotely,
using either a manual or an automated approach.
Now, there are several tools that can automate the process
of password guessing.
And here I'm actually showing a few examples.
The first one is Hydra,
a tool that can be downloaded from THC.org.
The second one is called TSGrinder,
and the third one is called SQLRecon.
And again, there are many other automated password
attack tools out there.
Some of them actually use a method
called the brute force attack.
And basically a brute force is when the attacker
tries every possible combination of characters
for a specific password.
Another technique that they use
is a password guessing attack called a dictionary attack.
Since most passwords consist of whole words,
either dates or numbers,
this tool uses a dictionary of words
or even phrases, and, you know,
even most commonly used passwords
like qwerty or password1 or cisco123,
or et cetera.
So matter of fact, there has been recent studies
by you know, security companies,
and what they actually have found
that the password password1 is one of the most commonly used
passwords out there.
And especially even by administrators,
which is kind of scary.
Now, there are other tools like John the Ripper,
Cain and Abel, that can take a hybrid approach
between brute force attacks and a dictionary attack.
Another password attack is password resetting attacks.
And in many cases it's actually easier to reset passwords
than to use tools to guess them.
There's several track cracking tools, you know, out there
that just attempt to reset passwords
instead of actually just, you know, steal them.
Now, most of password resetters contain a bootable version
of Linux that can mount NTFS volumes or, you know
any other type of volumes that can help you locate
and reset the administrator's password.
Another technique is password cracking.
And these attacks work by taking a password hash
and then converting it to the original plain text.
And in this case the attacker actually needs tools
such as extractors for hash guessing,
rainbow tables for looking up plain text passwords,
and password sniffers
to actually extract authentication information.
Now, the concept of a rainbow table is
where the attacker actually computes all possible passwords
and their hashes in a given system.
And then they actually put the results
in a lookup table called that, you know
like I mentioned before, a rainbow table.
Now this allows an attacker to just get a hash
from the victim and then just search for that hash
in the rainbow table to get the plain text password.
Now to mitigate a rainbow table attack,
you can disable LM hashes
and use long and complex passwords, right?
So the longer and the more complex the password is,
the harder it is actually to enumerate passwords
in a rainbow table and use a rainbow table attack.
Now, another technique is password sniffing
and the threat actor just sniffs authentication packets
between a client and a server and extracts, you know,
the password hashes or enough authentication information
to begin the cracking pass process.
Now the last one is password capturing
and this typically is done using key loggers,
whether it's physical or software key loggers,
or Trojan horses as well.