1 / 5

Information Assurance Day Course

Information Assurance Day Course. Cracking Passwords. Outline. Introduction Passwords & Hashes How do you get them? How can you abuse them? The Exercises Obtaining Hashes LiveCD Exploit Passive Sniffing Cracking Passwords. Introduction – Passwords & Hashes.

jamescharris
Télécharger la présentation

Information Assurance Day Course

An Image/Link below is provided (as is) to download presentation Download Policy: Content on the Website is provided to you AS IS for your information and personal use and may not be sold / licensed / shared on other websites without getting consent from its author. Content is provided to you AS IS for your information and personal use only. Download presentation by click this link. While downloading, if for some reason you are not able to download a presentation, the publisher may have deleted the file from their server. During download, if you can't get a presentation, the file might be deleted by the publisher.

E N D

Presentation Transcript

  1. Information Assurance Day Course Cracking Passwords

  2. Outline • Introduction • Passwords & Hashes • How do you get them? • How can you abuse them? • The Exercises • Obtaining Hashes • LiveCD • Exploit • Passive Sniffing • Cracking Passwords

  3. Introduction – Passwords & Hashes Passwords are used everywhere. The recommended best practice for storing them is to store them as a salted hash. Unix: $1$O3JMY.Tw$AdLnLjQ/5jXF9.MTp3gHv/ Windows LM: 855c3697d9979e78ac404c4ba2c66533 Windows NTLM: $NT$7f8fe03093cc84b267b109625f6bbf4b Salts are used to prevent cracking using precomputed hashes (rainbow tables) and bulk cracking.

  4. Introduction – Obtaining Hashes In order to obtain password hashes, you must know where they are stored and how they are used. Hashes are usually stored locally on disk and are sometimes transmitted over the network. It follows then, that if we can somehow gain access to the disk or sniff some network traffic, we should be able to grab some password hashes.

  5. Introduction – Abusing Hashes You now have some hashes. What can you do with them? • Pass the Hash Attack (Windows) • Crack them! • John the Ripper • Ophcrack • rcracki

More Related