![Secure Password
Comprises:
[a-zA-z, 0-9, symbols , space]
No short length / birthday / phone
number / real name , company name
Don’t use complete words or
Shakespeare quotes
◦ Example:
◦ Hello123: Weak
◦ @(H311l0)@: Strong
Easy to remember, hard to guess](https://image.slidesharecdn.com/passwordattack15may2014-140523005103-phpapp01/85/Password-Attack-10-320.jpg)
![Password Cracking Depends
on
Attacker's strengths
Attacker's computing resources
Attacker's knowledge
Attacker's mode of access [physical or online]
Strength of the passwords
How often you change your passwords?
How close are the old and new passwords?
How long is your password?
Have you used every possible combination:
alphabets, numbers and special characters?
How common are your letters, words, numbers or
combination?
Have you used strings followed by numbers or vice
versa, instead of mixing them randomly?](https://image.slidesharecdn.com/passwordattack15may2014-140523005103-phpapp01/85/Password-Attack-31-320.jpg)
![Secure Password
Comprises:
[a-zA-z, 0-9, symbols , space]
No short length / birthday / phone
number / real name , company name
Don’t use complete words or
Shakespeare quotes
◦ Example:
◦ Hello123: Weak
◦ @(H311l0)@: Strong
Easy to remember, hard to guess](https://image.slidesharecdn.com/passwordattack15may2014-140523005103-phpapp01/75/Password-Attack-10-2048.jpg)
![Password Cracking Depends
on
Attacker's strengths
Attacker's computing resources
Attacker's knowledge
Attacker's mode of access [physical or online]
Strength of the passwords
How often you change your passwords?
How close are the old and new passwords?
How long is your password?
Have you used every possible combination:
alphabets, numbers and special characters?
How common are your letters, words, numbers or
combination?
Have you used strings followed by numbers or vice
versa, instead of mixing them randomly?](https://image.slidesharecdn.com/passwordattack15may2014-140523005103-phpapp01/75/Password-Attack-31-2048.jpg)
Uploaded bySina Manavi
Password Attack
The document outlines a hacking methodology focused on password attacks, featuring various techniques such as brute force, dictionary, and phishing attacks. It includes practical demonstrations and tools for password cracking, along with guidance on secure password practices and password hardening techniques. Additionally, it touches on the importance of password policy and the implementation of biometric technologies to enhance security.
In this document
Powered by AI
Overview of password attacks methodology presented by Instructor Sina Manavi, including an agenda on security and demos.
Types of password attacks including Dictionary, Brute Force, Rainbow table, Phishing, Social Engineering, Malware, and Offline cracking.
Recommendations for strong password practices, including avoiding old passwords, optimal composition, and examples of weak vs strong passwords.
Live demos showcasing Windows password reset, Facebook phishing, cracking Zip/Rar files, and Windows login cracking.
Discussion on illegal password cracking concepts, various types of attacks, methods (brute force, phishing), and tools available for cracking.
Live demos showcasing Windows password reset, Facebook phishing, cracking Zip/Rar files, and Windows login cracking.
Discussion on illegal password cracking concepts, various types of attacks, methods (brute force, phishing), and tools available for cracking.
Discussion on illegal password cracking concepts, various types of attacks, methods (brute force, phishing), and tools available for cracking.
Live demos showcasing Windows password reset, Facebook phishing, cracking Zip/Rar files, and Windows login cracking.Introduction to password hardening techniques and biometric technologies to enhance security and counteract attacks.
Live demos showcasing Windows password reset, Facebook phishing, cracking Zip/Rar files, and Windows login cracking.
Discussion on illegal password cracking concepts, various types of attacks, methods (brute force, phishing), and tools available for cracking.
Live demos showcasing Windows password reset, Facebook phishing, cracking Zip/Rar files, and Windows login cracking.
Conclusion and contact information for further inquiries and resources related to password security and hacking.
More Related Content
Similar to Password Attack
Password Attack
- 1. Hackaway Hacking Methodology: Password Attacks EC-Council,Malaysia Instructor : Sina Manavi 15th May 2014 http://eccouncilacademy.org/home/hackaway- hacking-methodology/
- 2. About Me My nameis Sina Manavi , Master of Computer Security and Digital Forensics Contact : Manavi.Sina@Gmail.com Homepage: sinamanavi.wordpress.com
- 3. Agenda Password Security Demo: Windows Password Reset Demo: Google Dork Demo: Password disclosure! Demo: Gmail Password Extraction (Forensics Method) Secure Password Password Cracking Concept Coffee time Demo: Facebook Phishing Attack Introducing Password Cracking Tools Demo: Zip/Rar password File Cracking Demo: Windows Login Password Hacking
- 4. Type of PasswordAttacks Dictionary Attack Brute Force Attack Rainbow table attack Phishing Social Engineering Malware Offline cracking Guess
- 5. Password Security Don’tuse your old passwords Don’t use working or private email for every website registration such as games, news,….etc.
- 6.
- 7.
- 9. Gmail and FacebookPassword Extraction (Dumping Physical Memory) Dumpit (free Windows tool) Or if you use win8, you can do dump specific process in task manager Strings and Grep Hex Editor
- 10. Secure Password Comprises: [a-zA-z,0-9, symbols , space] No short length / birthday / phone number / real name , company name Don’t use complete words or Shakespeare quotes ◦ Example: ◦ Hello123: Weak ◦ @(H311l0)@: Strong Easy to remember, hard to guess
- 11. Demo Router passwordcracking
- 12. Password Cracking Concept Password Cracking is illegal purpose to gain unauthorized access To retrieve password for authorize access purpose ( misplacing, missing) due to various reason. ( e.g. what was my password??)
- 13. Password Cracking Types BruteForce, Dictionary Attack, Rainbow Table
- 14. Password Cracking Types:(Guessing Technique) Ihave tried many friends house and even some companies that , their password was remained as default, admin, admin .
- 16. Demo Facebook PhishingAttack
- 17.
- 18. Password Cracking Types:(Social Engineering) sometimes very lazy genius non-IT Geeks can guess or find out your password
- 19.
- 20.
- 21. Lets work assoftware cracker or Reverse Engineer Open the myprogram.exe file with your Hex Editor Try to find the password inside of
- 22. Password Cracking Types:(Offline Cracking) We have enough time to break the password Usually take place for big data very strong and complicated password After attack Forensics investigation
- 23. Password Cracking Tools Brutus ◦ Remote online cracking tool, Windows base, free, supports:(HTTP, POP3, FTP, SMB, ...etc), resume/pause option .no recent update but still on top ranking. RainbowCrack ◦ Hash cracker tool, windows/linux based, faster than traditional brute force attack, compare both plain text and hash pairs. Commercial and free version Wfuzz ◦ Web application brute forcing (GET and POST), checking (SQL, XSS, LDAP,etc) injection Cain and Able *** ◦ Few features of password cracking ability: Syskey Decoder,VNC Password decoder , MS SQl MYSQL and Oracle password extractor Based64, Credential Manager Password Decoder, Dialup Password Decoder,PWL Cached Password Decoder, Rainbowcrack-online client, Hash Calculator, John the Ripper ◦ Offline mode, Unix/linux based, auto hash password type detector, powerful, contain several built-in password cracker THC Hydra ◦ Dictionary attack tool for many databases, over 30 protocols (e.g. FTP.HTTP,HTPPS,...etc) Medusa AirCrack-NG ◦ WEP and WPA-PSK keys cracking, faster than other WEP cracker tools OphCrack L0phtCrack
- 24. Demo 1- Cracking ZipFiles 2- Cracking Rar Files
- 25. Cracking Zip passwordProtected File Requirement: Medusa/Hydra free open source tool (can be find on your Backtrack or Kali) Having Password-list and Username- list for brute forcing A Zip password protected File And poor file owner
- 26.
- 27. Password Hardening Techniquesor technologies which put attacker, cracker or any other malicious user in difficulties Brings password policy Increase the level of web,network , application and physical access of to the company or organization. Using biometric technologies such as fingerprint, Eye Detection, RFID Tag Cards….etc
- 28. Password Hardening Allthe Security solution just make it more difficult. Harder but possible
- 30. Windows Login Cracking Requirement: Medusa/Hydra free open source tool (can be find on your Backtrack or Kali) nmap Having Password-list and Username- list for bruteforcing Target windows
- 31. Password Cracking Depends on Attacker's strengths Attacker's computing resources Attacker's knowledge Attacker's mode of access [physical or online] Strength of the passwords How often you change your passwords? How close are the old and new passwords? How long is your password? Have you used every possible combination: alphabets, numbers and special characters? How common are your letters, words, numbers or combination? Have you used strings followed by numbers or vice versa, instead of mixing them randomly?
- 32. Demo: Web SiteLogin Cracking
- 33. Any Question? Manavi.sina@gmail.com @sinamanavi LinkedIn: Sina Manavi Check my homepage for latest presentations/ tutorial
Editor's Notes
- #18 Using Fake pages or application