Well, welcome back to the official start of Cup Series.
This is the certified CALLY Linux pen tester course.
Work onto the password attacks module.
We're going to cover different password attacks.
We're going to look at password hashing and the various tools that come with calling Linux in order
to work with passwords.
So this is our outline.
We're going to go over some of the password attack types.
Some of the different tools will even do some attack demos.
We'll look at some of the different countermeasures that can be employed to foil these kinds of attacks.
We'll look at rainbow tables and some of the online tools for generating hashes in such.
This is our chapter flow.
We're going to talk about the password attacks that was followed by labs and countermeasures, pretty
similar to other modules we've done.
So what our password attacks while password attacks are.
Essentially the opposite of authentication.
So passwords normally are.
Not made complex by users.
Users will do what is easier.
Not necessarily.
What is the most secure.
So password attacks can be done online or offline.
And essentially the.
Online attacks are where you're trying to break into a system that's connected and you're trying to
get into a system that's currently functioning.
Offline attacks is where you just capture the information or capture the traffic and try to crack the
password later on through various methods.
So.
Online attacks typically can be stopped by.
A number of attempts causing the account to lockout or having a password lockout policy now.
We all know that the number of passwords that people are using is increasing almost daily.
If we go and look at some statistics.
There's a website called Have I Been Phoned?
And this website has over 572 million real world passwords that have been exposed in data breaches.
So you can actually type in a password and see if it's been found.
So I just typed in the word password and we could see that it's been found over 3 million times before.
Now, what this means is that this password has been used as one of the most common passwords, or it's
been brought out and dumped out on the dark web, or maybe a site like Pastebin.
And the main thing to remember here is that everyone, at some point or another will reuse a password
from one side to the other because it's hard to generate complex passwords.
Of course, you can use a password manager like one pass or LastPass.
Things like that.
So, of course, two factor authentication.
Those things can help to an extent.
But what is Nist's guidance say?
So they created this pond password service in August of 2017 after NEST released guidance, specifically
recommending that user provided passwords be checked against data breaches.
So there was this large password dump of around 306 million passwords, and then another version came
out in 2018.
And then the third release, another 16 million passwords to a total of 551 million passwords by July
of 2019.
And version six just arrived here in June of 2020, bringing the total password list to 573 million.
You can actually go and download this password database of the most commonly known passwords.
So now this is actually run by a security researcher by the name of Troy Hunt.
He was worked for many, many years in the industry.
It's a great site for keeping people safe.
They even have an API so you can integrate their functionality of the passwords into your programs.
So there's no excuse to have bad passwords, but this still does happen.
So if you look at all the different organizations that have been breached.
It's almost just too many just to scroll through.
I mean, MySpace, BitTorrent banks, web stores, mobile apps.
Doesn't matter the target size.
Eventually everyone gets a data breach.
You can actually have it set up to notify you when your email address is compromised as well.
So a lot of useful functionality there.
But the main point we want to make sure we understand is that.
Passwords and password dumps are easily located.
And once you have one password success finding it.
Essentially, an attacker can use it to another site that you might do business with.
So if they get your Amazon password, maybe that's the same password as you use for your banking website.
So this this graphic here actually depicts how people pick passwords.
So a lot of times they pick up a place or a thing or something that's meaningful to them, maybe a number
that they're interested in, possibly some, you know, short phrase.
Now, obviously, rather than doing passwords, the better option is to do pass phrases where you can
pick maybe the first letter of each word as your password.
But it shouldn't be something that you have posted on your website, on Facebook.
And what happens a lot of times is users will post their security question information to one of their
sites and not realizing that attackers can go to websites that have password recovery enabled and based
on their, you know, dog's name or their girlfriend's name or their birth date, they can try and gas
and work out some of these passwords.
So these categories of password attacks are generally broken down as follows.
So we have get password guessing this is pretty much just using the most common passwords like 123,
four, five, six or the something like that.
Or if you know facts about the user and you can, you can steal their password, it potentially can
also be trying to sniff it over the network if you're not using secure transmission like on a banking
website.
And most of the banking websites have have gotten on to the idea of using digital certificates to secure
their traffic and using TLS.
But any website that doesn't use issued IPS, essentially everything can be seen in plain text, and
if your password or your account happens to go over that, then that can be captured.
If your password goes out over email and that email's unencrypted, that password can be obtained.
The second type of password attack is the dictionary attack, which is essentially automated password
guessing by loading in a predetermined list of possible values or a word list.
And then you have the brute force password attack, which is using every possible combination.
With password cracking software.
So if you have a seven character password, then it will try.
Aye, aye, aye, aye, aye.
And then a a a B and it'll try every permutation and every variation of those passwords until it gets
a match.
This is prone to errors and essentially time consuming.
So A Better Way is doing something called a rainbow table.
A rainbow table is essentially a set of plaintext passwords and they're hashes.
And so the rainbow table works by the work being done beforehand, which saves computer time or CPU
time during the actual attack.
So a hybrid attack is essentially.
A combination of several different attacks.
And then you have the birthday attack, which exploits weaknesses in the mathematical algorithms which
is used to generate hashes using a birthdate.
So essentially, what is the probability that two different hash values or two different plain texts
have the same hash value?
The plaintext is essentially your plaintext password, which then gets hashed using MD5 or SHA one and
gets stored in your operating system or stored in a database.
So the birthday attack exploits that weakness and certain hashing algorithms like MD5 and SHA one where
there's a greater risk of there being potentially a collision.
So there are some there are lots of password cracking tools.
They're out there with Calleigh Lennox.
All right.
So let's look at some of the different statistics on the most commonly used passwords.
So even in 2020, you can Google search, you know, the some of the top most used passwords.
So, you know, one, two, three, four, five, six or a clarity or you know, let me and these are
just bad passwords and they can be easily.
Figure it out via brute force or some other type of password method.
And so there are some there are different tools that come with Kali, like John the Ripper, Hash,
Cat, Medusa, Hydra, and these are all in the password cracking section.
If you go to the Kali start menu and you look at password attacks, there are all kinds of tools, word
list.
There's off crack, there's and they're even categorized by offline versus online.
And they're even tools where you can pass the hash instead of the password to a program.
So first, let's look at a hash cap.
Cash cat is a open source Malta operating system.
Depending on your graphics card and your system, you may be able to utilize different versions of Hash
Cat.
They even have.
If you have an invalid driver, you can use the CUDA Toolkit.
So it's generally considered to be the fastest password cracker.
Best at cracking multiple hashes at the same time.
It's multi-device multi hash, multi type, and also supports distributed password attacks over the
network.
It supports salting and many other different types of hashes.
So the way in which we run a hash cat is we can open up a terminal.
And we can.
We can run it from the link or we can just open up the terminal and I'll go ahead and close down some
of these.
So there's the hash cap.
So that gives you some example commands if you want to crack different types of hashes.
So let's say we wanted to run a brute force command.
All you have to have is just the list of hashes that you have.
So let's go ahead and run hash, cat and brute force mode.
Okay.
Then we have to give it the number of characters long we want.
So we want a.
Six character long password.
We would do something like this.
And it has some preloaded.
Word lists plus rules as well.
So it's going to start and says not a native until open seal runtime.
I can use dash force to override.
Let's do that.
So this is a sample of what you might see on your hash cat.
Essentially, it's hash cat, dash am for the type of hash.
Dash A for the mode you want it to run in.
So this case, it's loading a hash that's on the desktop and it's picking the word list rock you don't
text.
And so it's found five matches for that particular list.
Then we have John the Ripper.
John the Ripper is an open source password cracking software uses dictionary attack, does encrypted
sample dictionary words and compares those to the encrypted password.
It supports DC based on the data encryption standard and supports extended DC based the Cisco and Linux
MD5 based passwords as well as Blowfish on some distributions.
It also supports Kerberos and Windows, Elm Password Hashes and Mac OS as well.
So basically.
Once we get the the password, the hash file that we want to actually crack.
So what we're going to do here is we're going to we we set the mask on the system at 077, we're going
to run shadow the Etsy shadow and Etsy password file.
I'm going to write it out to a file called my pay stub.
And then we're going to use John the Ripper to make some decisions on cracking those passwords.
So it's going to load three password hashes with different salts, and that's going to do some different
iterations.
If you press just spacebar, it'll keep on giving you.
It's not just spacebar.
Pretty much any other key.
It'll keep giving you updates as various attempts it's making.
So it's working with the rule, the rule list.
That is in the US.
Our share.
John the Ripper directory.
It's continuing different attempts until it gets a match.
Depending on your system's performance, it may take a little bit of time.
So there is a pro version of John the Ripper.
This is kind of what it would look like.
So let's talk about Hydra.
Hydra is a.
Password cracker that has many different protocols.
It's very flexible and works with lots of different types of devices.
But you need to know the IP address of whatever machine you're going to.
Essentially, the SSA changed from the Kinect with Hydra.
So let's go ahead and go back to our virtual machine here.
We'll open up a new tab.
So this is Zohydro, which is the gooey based version.
You pick your target.
That you want to be able to crack.
So I'm going to go after my local host system.
You pick the protocol that you want.
And it actually gives you the the equivalent command you would enter.
And what protocol.
You want to go after your passwords.
Put the username if you have a username.
My system happens to be that you can put in.
The password list if you have one.
From here.
And then from there, it will actually attempt to.
Find the passwords.
So we have to move this down a little bit so we can see it.
You can give it a proxy method if you need one.
Then once you're done, go ahead and click start.
And it will attempt to run.
The password crack.
He's not using military or Secret Service organizations.
Again, password cracking.
This is anything that can be done illegally.
You can save out the output as well.
There's a lot of functionality with this platform and it's very user friendly.
You can set up multiple targets if you have a target list, you could do it in a text file.
You could set up different ports and protocols you wanted to connect on.
If you want the output to be more verbose.
You can even have it just generate passwords.
Have it.
Just try everything.
We see it's still.
Still running here.
So that is hydro.
So the command line version very similar.
You can essentially everything you can do in the Google, you can do in the command line.
So you can pick the protocol you want.
You can choose how you want it to connect.
And so on and so forth.
There are several different options for Hydra.
So if you want to go to a default set of credentials or maybe common passwords.
A lot of different options.
So how do we mitigate password cracks?
Well, we can use a.
Program called Fail to Man.
Essentially, this will set to watch certain log files and record any specific activity.
Such as blocking the number of attempts.
So once you've configured failed to ban Hydra, brute force attacks will not work.
So then we have rainbow table.
What are our rainbow tables?
These are pre-computer tables for reversing cryptographic hash functions, usually for cracking password
hashes.
The idea is that you can recover a password up to a certain length consisting of a limited set of characters.
The main thing is that you run the plaintext through a hashing function and then you try and reduce
the amount of possible attempts you have to make.
So the tables get hashed and then the hash tables are essentially a group of words stored in the table.
So there's a program called our Tea Gen or Rainbow Tea Table Generation.
And if it's not installed in Kelly Lennox, you can always do an app to get install.
And so you may have to go to the website.
This is Hash Katz website.
So rainbow table generation and sort.
So this is an example of running it.
You can actually purchase the rainbow tables as well to save the processing time.
These are some of the different programs that are available.
There's rainbow crack or ah, crack for the guilty based version.
So there are some online tools with which you can use to crack online passwords.
I mean, these are MD5.
Online dot com as well as crack station essentially with MD5 what it really is a lookup table.
So if you type in one, two, three, four, five, six and want to get the hash of that, takes it
a minute.
There's the MD5 hash.
Now, if I want to check the hash to make sure it works, I can go to the decryption part of my related
crypto because I'm not reversing the hash.
I'm just looking it up in a table.
And then when I get back, I should get my original password, which I do.
So that's the is over.
What is a billion hashes in the database?
So this is one example.
Crack station is another dot, net is another password cracking.
Also, you can enter in your hashes here.
Her password.
So let's go over to
the SC shadow file and we'll go ahead and just grab one of these hashes that we've created and we'll
see if we can get the
the crack station to.
You ought to find out what it is.
Of course, I'll say I'm not a robot.
I think these hashes are salted.
So this may not work necessarily with this is just one example.
You can actually even download their word list.
So it says it's an unrecognized hash format.
If you want to download their word list, they have over 4.2 gigabytes compressed, uncompressed.
It's 15 gigabytes.
So a lot of password recovery options there.
There are many other sites by which you can use it to reverse engineer password hashes.
So we talked about password attacks that are.
Using to circumvent authentication.
Whether it's password resets, whether it's online attacks, offline attacks.
We looked at John the Ripper with dictionary attack.
We looked at some different options with that.
We also looked at Hydra and TFC Hydra, the graphical version.
We talked about rainbow tables.
So this is a pre-computer table for reversing cryptographic hash functions to offload some of the processing
work by doing it beforehand.
And then we looked at some of the online tools which run on various password encryption algorithms and
give you the plaintext for the the hashed version of the password.
Is some of the acronyms we talked about.
And now some practice questions.
Question one Password attacks are attacks that attempt to circumvent the blank of a service.
Is it a authentication?
B Availability.
C group or.
D None.
The answer is a authentication.
Number two, which of the following is not a common file permission?
A Right.
B Execute.
C Stop.
Or d read.
The answer is stop.
So read, write and execute our common file permissions.
If you look at the Linux file structure, you can see that.
So if we do the LS command with the LRA, we will get the file permissions.
These are all the permissions read, write and execute.
If it has a D in front of it, that means it's a directory.
Rule number three Why is a one time password safe?
It's easy to generate.
B It cannot be shared.
C It's different for every access.
Or D It's a complex encrypted password.
Correct answer is C.
It is different for every access.
So one time pads are usually designed to provide as close to a truly random number generation as possible
number for which happens first authorization or authentication.
A authorisation.
B Authentication.
C Authorisation and authentication are the same or none of the above.
So authorization, authentication, authorization, authentication of the same or none of the above.
The correct answer is be authentication.
So you authenticate and then you get authorized access to resources.
Authorization has to do with the access control.
Authentication merely looks at your identity and says yes or no based on your provided credentials.
Number five What is not a best practice for password policies?
A deciding on the maximum age of passwords.
B Restricting on password re-use and history.
C Password encryption or.
D Having to change the password every two years.
Andy would not be a good password policy because every two years is not nearly often enough to prevent
online or offline attacks.
So in summer we talked about different password attack types.
We looked at some of the different attack tools that exist.
We conducted a demo attack on some different password hashes as well as some online resources.
We looked at some of the countermeasures that you can do to prevent these types of attacks.
And we also looked at rainbow tables.
I appreciate your attention in this module.
I hope you learned more about passwords than you knew before.
And we'll see you guys in the next module.