Well, let's finish up our treatment of Password's by cracking a few passwords, we can use lots of
different ways to do this.
We can look up a hash, we can use a dictionary attack or brute force attack.
I want to show a little bit of each one of those.
We're going to use a couple of different tools, one on line and one whole set of tools on our called
Linux box so that we can work with those passwords that we got from our section on Windows seven hacking
where we did a hash up.
If you don't have that file, you can go back and recreate it, or you can just see how we can create
our own MI5, some our own hash and try to crack it as well.
So first, let's go to our Calli Linux box, where we cracked a few passwords already, and then we'll
create a few more that we can crack as well in the section on Windows seven hacking.
Under my documents folder, I have that Windows seven hashes.
Let's take a look at that document and increase the font size sizes there.
And you can see I have this hash dump file that I got.
From my compromised Windows seven computer.
If you did not extract this or you didn't create this many users, that's OK, we're going to create
a couple of hashes ourselves as well.
But if you have this file, we can go ahead and try a couple of things out.
First of all, let's use one of the easiest tools out there for cracking passwords, and that's just
the World Wide Web.
So if I want to take a look at Wilma's password.
Well, actually, I tell you what, let's go ahead and make a shortened version of this has just the
password hashes.
You can see that the first half of all of these Ettlin passwords are all of these dumped passwords for
my Windows box.
Start with the same hash and then they have the actual hash of the password.
Lets go to file save as let's go to file save as or to the little drop down menu here.
Save as and let's call this just hashes and this will help us out because we're going to get rid of
all of this starting stuff.
We'll keep them in the same order so that we know that each user was administrator, guest, i.e. user
Fred and Wilma.
Those were the users that I had created in my Windows seven computer.
We're going to get rid of everything except for the actual hashes.
Well, as you can see, two of our password hashes are exactly identical.
The default administrator and guess passwords on the Windows seven box.
It looks like both of those might have been empty.
In fact, if you get to know your Intel's hashes, you'll see that that is the null or empty password.
But then all of our other three users have unique passwords.
So let's save that document just hashes.
And I'm going to make use of that ability to copy from one machine to the other.
We set that up back at the beginning of the Windows seven hacking.
So I should be able to just.
Right.
Click and copy all of those hashes.
And I'm going to switch back over to my local workstation and we can do a Web search for any password
cracking or hash tracking website.
But one of my favorites is Hash Killer Dot Code UK hash killer dot com in the UK, hash killer dot com
UK.
That's S.H. Killer Dot Code UK.
Then scroll to the bottom of that and come to the end TLM Decrypt or because we got these from a windows
in T flavored machine that is our Windows seven box.
We can put those hashes right in here.
So if I paste what I just copied and you can check your guest editions to make sure that you're able
to do this well and I pasted those in there.
Now I'm going to scroll down to the bottom of the page here.
A hash color.
They want us to do a captcha.
And in my case, it's found three of the hashes.
Look at this.
I'll try to zoom in a bit here and make those bigger.
Wow.
There we go.
Look at this.
It got the password for our third user, which was our IP user password with a capital P, a zero and
an exclamation, Wilma and Fred.
So Fred's password was, well, unwellness password was Fred on that Windows seven bucks that we set
up.
How did it do that?
Well, it's got a database of over 312 billion as of this writing.
It keeps growing all the time, but they've got hundreds of billions of password hashes in lots of different
formats.
In this case, the intel format was what we had from our Windows seven box, but that was pretty fast.
Let's also see one of the tools that comes with your Calli Linux installation.
There are lots of password cracking tools here under applications, password attacks.
You've got Johnny, you've got off crack, you've got Medusa.
If you want to try to log in with brute force on a server, I'll choose off crack just because it's
one easy graphical one.
So off crack.
And now we're going to load the password dump file from documents and go to win seven hashes.
And you can see right away, it's already told us that two of those password fields were empty.
So I can log into that Windows seven boxes administrator as my password and no as my username and password,
or I can try to find one of these passwords.
While I did not take long on brute force to test out and find one of the passwords, Willmot with just
a four character password, Fred took just about nine seconds to turn up with the password.
These others, we might need to use a password list.
And let's talk about where our password lists or our dictionaries are.
If you come under applications, password attacks, word lists.
Kelly will tell you that it comes with a whole lot of different word lists and you can get to these,
these are all linked from user share word lists.
So if I L's here, I'll see RockYou text.
That's a really good password database.
So I'm going to unzip that.
I'm going to unzip this RockYou so I'll say gee unzip because it's zipped with a zip g unzip or guns
zip rockyou and then if we lose we can see rockyou that text is in there now and now if I'm more Broch
you dot text.
I can see all of those passwords.
That people use one, two, three, four or five, six was most popular last year, password makes it
in there.
I love you, Princess RockYou.
ABC went to three names.
You see them all.
This is a huge password dictionary.
And everything that you might have thought of as a password may already be in here.
So that's really quick and easy to crack.
Let's go take a look at one other two.
I'm going to come to applications.
Password attacks.
We've got John the Ripper and Johnny, the graphical user interface version of that, and we can load
up our hashes that way and try to crack them as well.
I just want to show a couple of quick things, though.
We're going to use the terminal and we're just going to do a regular MD five some most of the time when
you get a password on a website they've used in the five MDE five some and we just hit enter and let's
type a password, let's say, well, pick a password that you think is unique, like P at dollar sign
dollar sign W a zero R D exclamation mark and then we're going to hit Kondrat control D twice.
And it's given us the Indy five hash of P at Dollar Sign dollar, send a zero R d exclamation.
So we're going to copy that and bring it back over here to hash Keiller.
And let's go down to the bottom and go to the NDY five descriptor and paste that hash in.
Scroll down to the bottom and do the little captcha and click submit, and it did not take very long
from this database of over 800 million, the five hashes.
To turn up at dollar sign, dollar sign a zero, the exclamation point as the password for this now
cracked and five hash so we can see that it's an important thing to have better passwords than just
substituting a few characters.
And unfortunately, even if you substitute a lot of characters out of 800 billion combinations right
now for the MI five password cracker.
Almost no password is safe if it's just a regular dictionary word with just a few substitutions in the
next lesson, we're going to talk about some ways to keep your passwords safe, to make your password
safer and to keep your password from getting exposed in any of the ways that we've seen today.
So we'll talk about some good tips from password safety coming up next.