We started getting into how we would find the passwords,
understand the passwords and how they're stored in those different devices and
operating systems, whether it's encrypted or hashed, whatever the case may be.
In this skill,
we're actually going to put pen to paper on taking those encrypted or hash
passwords and start trying to crack them and get a little bit behind the
wheel on the methodology behind it.
And there's many different types of ways to be able to crack passwords with
tools and, you know, uh, list out there and things like that.
And we will cover the classics, basically like turning your radio to the top 40.
But as we go through here, I do want to point out first that there are three
different types of password attacks.
We generally categorize them in one of three ways.
First, we have brute force where we try every possible combination
of characters out there.
You know, upper, lower numbers, funnies, all that other great stuff.
And, uh, we give a rule sets when we do brute force attacking, for instance,
in the previous skill, we said that, uh, Windows can set a minimum length of
password. You wouldn't want to try to brute force a three character password
when the minimum length is, let's say eight. Now, when we do brute force,
we're trying every possible combination out there, or as we in the math world
go permutations, because that's all it is.
It's just a permutation of every possible combination of characters.
If we start with lowercase a, it would be a, a, a, a, a, a, a, a, b, a, c, and
so on and so on and so on.
So there's many, many, many different ways to be able to brute force
in multiple combinations.
That being said, using brute force takes a lot of time and effort along with
resources, especially if you're only using, let's say one, uh, system to be
able to pen test.
So you'll see, as we go throughout and use some of these applications to work
on a passwords, it really is a resource hog.
So realistically is brute force really there for all the passwords out there?
Not really, but there are cases to where we would prefer to use brute force
over others, and we'll see those as we continue throughout the course, but it
is very slow, so it's kind of unrealistic, especially if you have a certain time
limit within your rules of engagement for your pen test against an organization.
The biggest thing about this one is, is that we use brute force where we don't
know anything about the password and I mean, nothing.
So we know that there's a password on the actual system or account, but we
don't know the minimum requirements.
We don't know if there's complexity involved in the actual password set or
you know, if there's a lockout period or anything like that, you're just, you're,
you're throwing everything at the wall and hoping something in your
combination of permutation sticks.
Now, the one we usually go to, uh, the most out of this list, and this is tied
with the third one is password spray.
This is where we try a, a certain list of passwords that are either known or very
common out there in the real world.
For example, password, a lot of folks like to use password.
Or we learn about our target and we use birthdays, nicknames, basically things
that you would get in those 20 questions about you on the social media is that
you should never answer because that's how people start to put together different
tidbits about your passwords on different accounts.
And this also avoids lockouts because we're not just doing this over and over
and over, we're doing this on a set schedule and also in a line with some of
the password requirements and account settings of that particular system or
device.
So in the previous skill where we found out there's a lockout threshold, we would
set our tools that we're password spraying with to that actual criteria.
So that way we don't get caught or locked out of an account and raise suspicion.
Now, as you could guess, based on all the criteria that goes into password spraying,
this is used for your larger environments.
So when we're pentesting against an organization that uses, let's say, Active
Directory or some sort of other domain environment and has service accounts,
you know, privileged users, power users, et cetera, et cetera, this would be one of
the methods that we would use in order to be able to try and get one of those
passwords learned.
So that way we can start mucking around the systems.
Now, tied with password spraying is the dictionary attack.
And I actually prefer this one because it's a combination of password spray and
also a little bit of brute force.
Follow me on this because this, when we use a dictionary attack, we're trying
entries from a pre-compiled list.
Now you may hear me refer to this list as a rainbow table, and I will get more on
that as the skill unfolds.
But essentially what we do is we have a list of predetermined passwords, like
password or, uh, the big thing here is, is that the leet speak, how they use
different characters to represent actual letters of the alphabet.
For example, you may see a password, a password, and it'd be replaced
with P at dollar dollar W O R D.
That's that leet speak thing where you use the special characters in a
combination with a regular word in order to bypass some of the complexity
requirements set by the organization.
Folks are typically lazy when it comes to setting their passwords, and they
like to use the same password in multiple different devices and accounts.
This is also a much faster method of being able to crack those passwords,
especially when we can compile a very detailed list of known passwords.
And a word list, uh, can be tailored.
There are some that are default inside of Kali and the tools we'll use, and I'll
show you where those are and how to use them, but we can make changes to them.
Like for example, we can add the organization's name, add some years,
adds like birthdays and things like that, and kind of work it around the
organization that we're actually pen testing against.