3 ms·

Any ideas on how they manage to crack these? I can't grok how they would achieve this via a dictionary attack, especially the likes of: MgihtyDutchmanMgiht

by aleem 10y ago

Any ideas on how they manage to crack these? I can't grok how they would achieve this via a dictionary attack, especially the likes of: MgihtyDutchmanMgihtyDutchmanMgihtyDutchman alapdanceissomuchbetterwhenthestripperiscrying <script>alert(document.cookie);</script>

ryan-c 10y ago
Password cracking "dictionaries" can have phrases in them.
- aleem 10y ago
  I get that but permuting over typos, letter casing, lengths and combination of words would make the dataset huge. Is there a massively collaborated rainbow table database that is constantly growing? Are there other heuristics that come into play such as guessing the password length or some such thing?
  - phpnode 10y ago
    Rainbow tables aren't really a thing any more, you can calculate a hash much faster than you can download one
mrb 10y ago
Brute forcing tools (eg. Hashcat) can take lists of words, mangle them to simulate typos, concatenate them a few times. That's how the first password is constructed (mighty, dutchman). There is really not that many combinations to try: take the most common 2^13 English words, add 4 variations of each word to simulate 4 different typos (2^15 words), test all possible pairs of words (2^30 pairs), repeat each pair up to 4 times, and that's a total of only 2^32 candidate passwords, which takes 1-2 seconds to brute force with hashcat on a GPU rig. The 2nd password seems to come from a long dictionary: "a lap dance..." is the exact title of a song with no spaces and all in lowercase. It's good practice when brute forcing to take the titles of all known books, movies, songs... and put them in your dictionary. The 3rd password also seems to come from a dictionary, typically built by scraping a few million web pages and taking literally all strings separated by whitespace.
unholymackerel 10y ago
If they had a list of usernames it shouldn't have been too hard. Most of the stuff on here is repeated usernames. The one in the middle is a song title with no spaces -- Bloodhound Gang, Hooray For Boobies

by aleem 10y ago

ryan-c 10y ago

Password cracking "dictionaries" can have phrases in them.

aleem 10y ago
I get that but permuting over typos, letter casing, lengths and combination of words would make the dataset huge. Is there a massively collaborated rainbow table database that is constantly growing? Are there other heuristics that come into play such as guessing the password length or some such thing?
- phpnode 10y ago
  Rainbow tables aren't really a thing any more, you can calculate a hash much faster than you can download one

mrb 10y ago

Brute forcing tools (eg. Hashcat) can take lists of words, mangle them to simulate typos, concatenate them a few times. That's how the first password is constructed (mighty, dutchman). There is really not that many combinations to try: take the most common 2^13 English words, add 4 variations of each word to simulate 4 different typos (2^15 words), test all possible pairs of words (2^30 pairs), repeat each pair up to 4 times, and that's a total of only 2^32 candidate passwords, which takes 1-2 seconds to brute force with hashcat on a GPU rig. The 2nd password seems to come from a long dictionary: "a lap dance..." is the exact title of a song with no spaces and all in lowercase. It's good practice when brute forcing to take the titles of all known books, movies, songs... and put them in your dictionary. The 3rd password also seems to come from a dictionary, typically built by scraping a few million web pages and taking literally all strings separated by whitespace.

unholymackerel 10y ago

If they had a list of usernames it shouldn't have been too hard. Most of the stuff on here is repeated usernames. The one in the middle is a song title with no spaces -- Bloodhound Gang, Hooray For Boobies