31–40 of 66 posts
Does anyone have a good cloud-hosted password cracker? I can't seem to brute force it, no matter how long I let John the ripper run.
Ok, so what should we use instead of passwords?
Thanks for sharing. This looks interesting. Impressive achievement. This book is currently not really relevant for me, so I just skimmed the samples on Amazon. I found the technical content to be reasonably accurate and interesting although sometimes a little bit verbose (e.g., the section about 'what is a password') or slightly imprecise. In general, I think this book might have benefited from a thorough copyediting…
What did you find slightly imprecise?
> "Then there is also the fact that having a fully-fledged graphical desktop environment running in the background at all times is not quite optimal to say the least. 99 percent of the time when cracking passwords, you will be staring at a black terminal filled with white text, so using Windows, which is especially GUI-heavy, is usually impractical unless you are specifically testing something or showcasing some process."
I am reasonably sure that the Windows UI has rather little practical effect on hashcat's speed, and this thread implies the same: https://hashcat.net/forum/archive/index.php?thread-8958.html Also, 99 percent of the time when cracking passwords, I am not staring at a black terminal filled with white text.
(I am generally taking it a little bit personally when the author directly addresses me and tells me what I am probably thinking or doing.)
> "Behind a hash function are a series of complicated mathematical operations that make deriving the input from the output literally impossible."
I'd argue that the mathematical operations themselves are usually not that complicated. More importantly, the whole book seems to be about ways to derive the (probable) input of a hash function from the output. It is not literally impossible.
> "It is important to note, however, that hash functions are not truly random;"
As the author writes elsewhere, hash functions are deterministic and not random at all. Calling them not truly random seems to imply that they are somewhat random.
> "When encrypting a file or any kind of data with AES for example, the program leveraging AES will prompt you for a password. Yes, a password."
Yes, this is a book about password cracking, but there are lots of cases where programs use AES with a computer-generated key and won't prompt you for a password. E.g., TLS.
(Just to reiterate: I am not trying to diminish the author's work, I wanted to suggest ways for improvement. I might be wrong or overly pedantic.)
Thanks for sharing. This looks interesting. Impressive achievement. This book is currently not really relevant for me, so I just skimmed the samples on Amazon. I found the technical content to be reasonably accurate and interesting although sometimes a little bit verbose (e.g., the section about 'what is a password') or slightly imprecise. In general, I think this book might have benefited from a thorough copyediting…
Personally, I love abusing commas for comments and shitposting, but they should be avoided in informative resources like books, otherwise, it looks like a word salad. Say your thoughts and ideas with boldness and certainty.
But hey you write better than I did at 18, so I ain't judging. Just trying to provide helpful feedback for you (the op) to improve on.
Ok, so what should we use instead of passwords?
This is a really impressive project, especially starting at 14. The point about there being no single comprehensive resource rings true, I've tried to learn about password security before and always ended up jumping between five different tabs just to understand one concept.
Netmux (2019): Hash Crack: Password Cracking Manual¹
James Leyte-Vidal (2024): Ethical Password Cracking: decode passwords using John the Ripper, hashcat, and advanced methods for password breaking²
Daniel W. Dieterle (2024): Password Cracking with Kali Linux³
¹) https://www.amazon.com/gp/product/1793458618
²) https://www.amazon.com/Ethical-Password-Cracking-passwords-a...
³) https://www.oreilly.com/library/view/password-cracking-with/...
Earlier quoted context omitted.
What did you find slightly imprecise?
It's awkwardly phrased and doesn't really say what it intends to (though, the meaning is obvious after reading it a second or third time). As for it being imprecise, it doesn't talk about any specific software that has any compatibility issues. It dismisses the topic out of hand.
There being room for improvement is both acceptable and expected.
I've got an old datacenter KVM with a root password I've been unable to crack, even though it's an ancient DES one. Does anyone have a good cloud-hosted password cracker? I can't seem to brute force it, no matter how long I let John the ripper run.
Earlier quoted context omitted.
What did you find slightly imprecise?
A few small things. You might call this nitpicking. And, as I wrote, I found the technical details generally accurate. > "Then there is also the fact that having a fully-fledged graphical desktop environment running in the background at all times is not quite optimal to say the least. 99 percent of the time when cracking passwords, you will be staring at a black terminal filled with white text, so using Windows, whic…
I think you're not being pedantic enough here. "Probable" is doing some heavy lifting. And the phrasing is "derive the input," which I think is fair to say. The best you can do with a proper hash is discover one or more possible inputs, but you're not deriving them from the output; the output is just used to check the result. The many-to-one nature of a hash precludes determining the exact input.
Ok, so what should we use instead of passwords?