Concise Notes on Password Cracking Techniques

Penetration Testing: Password-cracking techniques are key methods used by hackers to gain unauthorized access.

Gaining Access Phase: An attacker breaks into a system/network, escalates privileges, installs applications, and modifies or hides data.

Techniques Used:

• Password cracking
• Denial of service
• Session hijacking
• Buffer overflow
• Various unauthorized access methods

Password Cracking:

• Process to recover unknown or forgotten passwords.
• Enables unauthorized access for malicious activities like identity theft and fraud.

Methodologies for Password Cracking:

• Password Crackers: Use word lists or algorithms to guess passwords.
• Brute Force Attacks: Involve exhausting all possible password combinations.
• Credential recycling exploits reused passwords from previous breaches.
• Dictionary Attacks: Automated guessing using lists of common passwords and phrases.
• Mask Attacks: Tailored guesswork using known information about password structure.
• Rainbow Table Attacks: Use precomputed hash/password directories to break encrypted forms quickly.
• Network Analyzers: Tools that intercept and monitor data packets to capture plain text passwords.
• Spidering: Researching targets to gather sensitive information to facilitate credential attacks.
• Offline Cracking: Conducting attacks without time limits, often using stolen hashes from data breaches.
• Shoulder Surfing: Observing victims to obtain sensitive information directly.
• Guessing Attacks: Attempting to guess passwords based on predictable personal information.

Wireshark: A tool for capturing and analyzing network traffic, crucial for understanding data flow and vulnerabilities.

Wireshark Demo: Steps to demonstrate capturing login data on a test site (Altoro Mutual) to showcase potential vulnerabilities in non-secure (http) transactions.