3 ms·

Are cracking programs optimized to do all 1 character passwords, then all 2 character passwords, then 3 then 4 etc? Otherwise how will an attacker know to only

by pilom 15y ago

Are cracking programs optimized to do all 1 character passwords, then all 2 character passwords, then 3 then 4 etc? Otherwise how will an attacker know to only run a search on 6 character passwords? Not to mention that a cracker always would have to computed for all possible characters (alphanumeric plus symbols) because there is no way of knowing ahead of time what character set the person used.

16s 15y ago
Speaking to easy hashes (NTLM, MD5, OpenLDAP SHA, etc.) One through four brute force is extremely trivial. A single core CPU will do all those in less than a minute. Five (all combinations... the entire space) in less than an hour. Modern GPUs can enumerate the entire six char space within a day or so. Some GPUs can enumerate the seven char space in a few days. Complete enumeration begins to get infeasible when you get into the eight char space. This is basically why CPUs are still viable. Speed won't get you nearly as far as intelligence will (append stuff onto the end of words). Nothing against speed here and if it was a pure enumeration race, then no doubt, go with GPUs. Edit: When I say "entire space" I mean the entire printable ASCII character set. Edit2: It's rather simple to calculate too. 95 printable ASCII chars to the power of the password length. So, to enumerate the four char space, it's 95^4 (81,450,625). You can "do the math" for any lenght password. But you'll see that when you hit eight chars (6,634,204,312,890,625) that even GPUs (which can do billions of hashes a second) have to be smart and not just fast.
matthiasb 15y ago
The cracking tool John The Ripper is highly configurable. I don't know about Cain and Abel. You can avoid running a full brute force attack by identifying the most common password patterns and generate passwords based on them. Eg: any word from a dictionary plus the current year. I blogged about this here: http://codebazaar.blogspot.com/2011/05/why-we-need-strong-p4ssw0rds.html http://codebazaar.blogspot.com/2011/05/why-we-need-strong-p4...

by pilom 15y ago

16s 15y ago

Speaking to easy hashes (NTLM, MD5, OpenLDAP SHA, etc.) One through four brute force is extremely trivial. A single core CPU will do all those in less than a minute. Five (all combinations... the entire space) in less than an hour. Modern GPUs can enumerate the entire six char space within a day or so. Some GPUs can enumerate the seven char space in a few days. Complete enumeration begins to get infeasible when you get into the eight char space. This is basically why CPUs are still viable. Speed won't get you nearly as far as intelligence will (append stuff onto the end of words). Nothing against speed here and if it was a pure enumeration race, then no doubt, go with GPUs. Edit: When I say "entire space" I mean the entire printable ASCII character set. Edit2: It's rather simple to calculate too. 95 printable ASCII chars to the power of the password length. So, to enumerate the four char space, it's 95^4 (81,450,625). You can "do the math" for any lenght password. But you'll see that when you hit eight chars (6,634,204,312,890,625) that even GPUs (which can do billions of hashes a second) have to be smart and not just fast.

matthiasb 15y ago

The cracking tool John The Ripper is highly configurable. I don't know about Cain and Abel. You can avoid running a full brute force attack by identifying the most common password patterns and generate passwords based on them. Eg: any word from a dictionary plus the current year. I blogged about this here: http://codebazaar.blogspot.com/2011/05/why-we-need-strong-p4ssw0rds.html http://codebazaar.blogspot.com/2011/05/why-we-need-strong-p4...