Cracking WordPress passwords with 20 lines of Go
1–10 of 21 posts
Re: Cracking WordPress passwords with 20 lines of Go
#2[deleted]
Re: Cracking WordPress passwords with 20 lines of Go
#3[deleted]
Re: Cracking WordPress passwords with 20 lines of Go
#4> Cracking WordPress passwords with 20 lines of Go
The original title is actually “WordPress passwords, explained and cracked”.
It seems Frenxi —the author— added “… with 20 lines of Go” in the post submission simply to appeal to the masses of Hacker News who often upvote links based on keywords more than the content of the article. Per the Hacker News Guidelines [1] → “[…] please use the original title, unless it is misleading or linkbait; don't editorialize.”
Go has nothing to do here except the author decided to write the brute force password cracker in it. The program could have been written in any other programming language without losing anything. Honestly, I am disappointed. They didn’t even try to make an interesting cracking program, the program doesn’t even have goroutines which one would expect from a tool that is trying to brute force a solution.
Re: Cracking WordPress passwords with 20 lines of Go
#5Realize that the attacker must first possess the user/password database for this to work. This is because the author takes the salt from that information. Without the salt, it will take much longer to brute force... even though it’s md5 hashed.
Re: Cracking WordPress passwords with 20 lines of Go
#6>2020/05/30 12:44:15 Executed in 0.000221
oh wow, i guess that would've taken years to execute had i written it in c#.
Re: Cracking WordPress passwords with 20 lines of Go
#7Realize that the attacker must first possess the user/password database for this to work. This is because the author takes the salt from that information. Without the salt, it will take much longer to brute force... even though it’s md5 hashed.
How is he getting the salt from the database?
Re: Cracking WordPress passwords with 20 lines of Go
#8I reckon this is a relatively simple explanation & demo of how simple it is to crack passwords if you have access to both a database dump of salted passwords, provided the password itself is relatively easily guessable (present in some dictionary of candidate passwords).
In terms of performance --
> At the moment, it processes 100K attempts in about 2 minutes on a small VPS.
It is a bit hard to compare performance without knowing what the `hashloop` parameter was set to for each attempt for that benchmark. Assuming that the hashloop parameter is set to `8192` aka `(1 For a 30,000x speedup for brute forcing md5: hashcat + 8x GPUs can hit something like 200 GH / sec of md5:
https://gist.github.com/epixoip/a83d38f412b4737e99bbef804a27...
Re: Cracking WordPress passwords with 20 lines of Go
#9Realize that the attacker must first possess the user/password database for this to work. This is because the author takes the salt from that information. Without the salt, it will take much longer to brute force... even though it’s md5 hashed.
How is he getting the salt from the database?
this corresponds to sad scenario where the database itself is leaked and the attacker has access to it. the blog describes how the salt is stored as prefix to each hash.
Re: Cracking WordPress passwords with 20 lines of Go
#10Cracking isn’t usually something that takes a lot of code, just a lot of time