1 00:00:01,030 --> 00:00:06,460 Well, let's finish up our treatment of Password's by cracking a few passwords, we can use lots of 2 00:00:06,460 --> 00:00:07,480 different ways to do this. 3 00:00:07,480 --> 00:00:12,310 We can look up a hash, we can use a dictionary attack or brute force attack. 4 00:00:12,600 --> 00:00:14,800 I want to show a little bit of each one of those. 5 00:00:14,890 --> 00:00:19,650 We're going to use a couple of different tools, one on line and one whole set of tools on our called 6 00:00:19,670 --> 00:00:26,980 Linux box so that we can work with those passwords that we got from our section on Windows seven hacking 7 00:00:26,980 --> 00:00:28,210 where we did a hash up. 8 00:00:28,660 --> 00:00:33,220 If you don't have that file, you can go back and recreate it, or you can just see how we can create 9 00:00:33,220 --> 00:00:38,080 our own MI5, some our own hash and try to crack it as well. 10 00:00:38,680 --> 00:00:43,090 So first, let's go to our Calli Linux box, where we cracked a few passwords already, and then we'll 11 00:00:43,090 --> 00:00:48,430 create a few more that we can crack as well in the section on Windows seven hacking. 12 00:00:50,690 --> 00:00:55,260 Under my documents folder, I have that Windows seven hashes. 13 00:00:55,280 --> 00:00:59,060 Let's take a look at that document and increase the font size sizes there. 14 00:00:59,060 --> 00:01:03,590 And you can see I have this hash dump file that I got. 15 00:01:05,900 --> 00:01:08,870 From my compromised Windows seven computer. 16 00:01:11,140 --> 00:01:15,670 If you did not extract this or you didn't create this many users, that's OK, we're going to create 17 00:01:15,670 --> 00:01:17,530 a couple of hashes ourselves as well. 18 00:01:18,160 --> 00:01:21,710 But if you have this file, we can go ahead and try a couple of things out. 19 00:01:21,740 --> 00:01:27,340 First of all, let's use one of the easiest tools out there for cracking passwords, and that's just 20 00:01:27,340 --> 00:01:28,580 the World Wide Web. 21 00:01:29,110 --> 00:01:33,670 So if I want to take a look at Wilma's password. 22 00:01:34,030 --> 00:01:39,190 Well, actually, I tell you what, let's go ahead and make a shortened version of this has just the 23 00:01:39,190 --> 00:01:40,180 password hashes. 24 00:01:40,180 --> 00:01:47,230 You can see that the first half of all of these Ettlin passwords are all of these dumped passwords for 25 00:01:47,230 --> 00:01:48,360 my Windows box. 26 00:01:48,370 --> 00:01:54,360 Start with the same hash and then they have the actual hash of the password. 27 00:01:55,030 --> 00:02:02,830 Lets go to file save as let's go to file save as or to the little drop down menu here. 28 00:02:02,830 --> 00:02:10,060 Save as and let's call this just hashes and this will help us out because we're going to get rid of 29 00:02:10,060 --> 00:02:11,790 all of this starting stuff. 30 00:02:11,800 --> 00:02:16,090 We'll keep them in the same order so that we know that each user was administrator, guest, i.e. user 31 00:02:16,090 --> 00:02:16,950 Fred and Wilma. 32 00:02:17,680 --> 00:02:20,980 Those were the users that I had created in my Windows seven computer. 33 00:02:21,560 --> 00:02:24,350 We're going to get rid of everything except for the actual hashes. 34 00:02:24,670 --> 00:02:28,960 Well, as you can see, two of our password hashes are exactly identical. 35 00:02:28,960 --> 00:02:32,350 The default administrator and guess passwords on the Windows seven box. 36 00:02:32,710 --> 00:02:35,400 It looks like both of those might have been empty. 37 00:02:35,800 --> 00:02:41,350 In fact, if you get to know your Intel's hashes, you'll see that that is the null or empty password. 38 00:02:41,920 --> 00:02:44,680 But then all of our other three users have unique passwords. 39 00:02:44,680 --> 00:02:47,710 So let's save that document just hashes. 40 00:02:48,260 --> 00:02:51,910 And I'm going to make use of that ability to copy from one machine to the other. 41 00:02:51,910 --> 00:02:54,700 We set that up back at the beginning of the Windows seven hacking. 42 00:02:55,240 --> 00:02:56,950 So I should be able to just. 43 00:02:56,950 --> 00:02:57,270 Right. 44 00:02:57,280 --> 00:03:00,010 Click and copy all of those hashes. 45 00:03:00,460 --> 00:03:07,180 And I'm going to switch back over to my local workstation and we can do a Web search for any password 46 00:03:07,180 --> 00:03:09,210 cracking or hash tracking website. 47 00:03:09,220 --> 00:03:17,290 But one of my favorites is Hash Killer Dot Code UK hash killer dot com in the UK, hash killer dot com 48 00:03:18,040 --> 00:03:18,460 UK. 49 00:03:18,460 --> 00:03:22,050 That's S.H. Killer Dot Code UK. 50 00:03:22,510 --> 00:03:27,400 Then scroll to the bottom of that and come to the end TLM Decrypt or because we got these from a windows 51 00:03:27,400 --> 00:03:31,120 in T flavored machine that is our Windows seven box. 52 00:03:31,480 --> 00:03:33,690 We can put those hashes right in here. 53 00:03:34,210 --> 00:03:38,650 So if I paste what I just copied and you can check your guest editions to make sure that you're able 54 00:03:38,650 --> 00:03:41,800 to do this well and I pasted those in there. 55 00:03:41,800 --> 00:03:44,160 Now I'm going to scroll down to the bottom of the page here. 56 00:03:44,160 --> 00:03:44,800 A hash color. 57 00:03:44,800 --> 00:03:46,570 They want us to do a captcha. 58 00:03:46,810 --> 00:03:49,810 And in my case, it's found three of the hashes. 59 00:03:49,810 --> 00:03:50,590 Look at this. 60 00:03:50,590 --> 00:03:52,750 I'll try to zoom in a bit here and make those bigger. 61 00:03:53,440 --> 00:03:54,270 Wow. 62 00:03:54,280 --> 00:03:55,630 There we go. 63 00:03:55,780 --> 00:03:56,650 Look at this. 64 00:03:56,650 --> 00:04:03,640 It got the password for our third user, which was our IP user password with a capital P, a zero and 65 00:04:03,640 --> 00:04:07,600 an exclamation, Wilma and Fred. 66 00:04:07,600 --> 00:04:12,340 So Fred's password was, well, unwellness password was Fred on that Windows seven bucks that we set 67 00:04:12,340 --> 00:04:12,540 up. 68 00:04:13,120 --> 00:04:14,160 How did it do that? 69 00:04:14,170 --> 00:04:18,700 Well, it's got a database of over 312 billion as of this writing. 70 00:04:18,700 --> 00:04:27,010 It keeps growing all the time, but they've got hundreds of billions of password hashes in lots of different 71 00:04:27,010 --> 00:04:27,450 formats. 72 00:04:27,460 --> 00:04:33,100 In this case, the intel format was what we had from our Windows seven box, but that was pretty fast. 73 00:04:33,640 --> 00:04:37,360 Let's also see one of the tools that comes with your Calli Linux installation. 74 00:04:37,400 --> 00:04:42,250 There are lots of password cracking tools here under applications, password attacks. 75 00:04:42,550 --> 00:04:46,960 You've got Johnny, you've got off crack, you've got Medusa. 76 00:04:46,960 --> 00:04:53,830 If you want to try to log in with brute force on a server, I'll choose off crack just because it's 77 00:04:53,830 --> 00:04:55,240 one easy graphical one. 78 00:04:55,240 --> 00:04:56,290 So off crack. 79 00:04:56,650 --> 00:05:04,570 And now we're going to load the password dump file from documents and go to win seven hashes. 80 00:05:05,860 --> 00:05:10,830 And you can see right away, it's already told us that two of those password fields were empty. 81 00:05:11,320 --> 00:05:18,520 So I can log into that Windows seven boxes administrator as my password and no as my username and password, 82 00:05:18,940 --> 00:05:21,820 or I can try to find one of these passwords. 83 00:05:22,300 --> 00:05:27,880 While I did not take long on brute force to test out and find one of the passwords, Willmot with just 84 00:05:27,880 --> 00:05:33,300 a four character password, Fred took just about nine seconds to turn up with the password. 85 00:05:33,310 --> 00:05:36,550 These others, we might need to use a password list. 86 00:05:37,120 --> 00:05:40,740 And let's talk about where our password lists or our dictionaries are. 87 00:05:40,990 --> 00:05:44,770 If you come under applications, password attacks, word lists. 88 00:05:46,230 --> 00:05:52,020 Kelly will tell you that it comes with a whole lot of different word lists and you can get to these, 89 00:05:52,020 --> 00:05:55,670 these are all linked from user share word lists. 90 00:05:56,130 --> 00:06:00,550 So if I L's here, I'll see RockYou text. 91 00:06:00,570 --> 00:06:02,700 That's a really good password database. 92 00:06:02,700 --> 00:06:04,410 So I'm going to unzip that. 93 00:06:04,980 --> 00:06:12,810 I'm going to unzip this RockYou so I'll say gee unzip because it's zipped with a zip g unzip or guns 94 00:06:12,810 --> 00:06:20,520 zip rockyou and then if we lose we can see rockyou that text is in there now and now if I'm more Broch 95 00:06:20,520 --> 00:06:21,750 you dot text. 96 00:06:22,260 --> 00:06:25,680 I can see all of those passwords. 97 00:06:26,600 --> 00:06:33,140 That people use one, two, three, four or five, six was most popular last year, password makes it 98 00:06:33,140 --> 00:06:33,470 in there. 99 00:06:33,500 --> 00:06:35,540 I love you, Princess RockYou. 100 00:06:35,540 --> 00:06:38,600 ABC went to three names. 101 00:06:38,600 --> 00:06:39,640 You see them all. 102 00:06:39,650 --> 00:06:42,020 This is a huge password dictionary. 103 00:06:42,650 --> 00:06:47,200 And everything that you might have thought of as a password may already be in here. 104 00:06:47,210 --> 00:06:49,220 So that's really quick and easy to crack. 105 00:06:49,730 --> 00:06:51,650 Let's go take a look at one other two. 106 00:06:51,660 --> 00:06:53,270 I'm going to come to applications. 107 00:06:55,290 --> 00:06:56,640 Password attacks. 108 00:06:57,480 --> 00:07:02,670 We've got John the Ripper and Johnny, the graphical user interface version of that, and we can load 109 00:07:02,670 --> 00:07:06,030 up our hashes that way and try to crack them as well. 110 00:07:06,510 --> 00:07:08,340 I just want to show a couple of quick things, though. 111 00:07:08,340 --> 00:07:13,800 We're going to use the terminal and we're just going to do a regular MD five some most of the time when 112 00:07:13,800 --> 00:07:21,870 you get a password on a website they've used in the five MDE five some and we just hit enter and let's 113 00:07:21,870 --> 00:07:32,790 type a password, let's say, well, pick a password that you think is unique, like P at dollar sign 114 00:07:32,790 --> 00:07:41,850 dollar sign W a zero R D exclamation mark and then we're going to hit Kondrat control D twice. 115 00:07:43,110 --> 00:07:52,470 And it's given us the Indy five hash of P at Dollar Sign dollar, send a zero R d exclamation. 116 00:07:52,950 --> 00:07:56,520 So we're going to copy that and bring it back over here to hash Keiller. 117 00:07:56,520 --> 00:08:02,130 And let's go down to the bottom and go to the NDY five descriptor and paste that hash in. 118 00:08:03,460 --> 00:08:11,080 Scroll down to the bottom and do the little captcha and click submit, and it did not take very long 119 00:08:11,080 --> 00:08:15,310 from this database of over 800 million, the five hashes. 120 00:08:16,450 --> 00:08:25,150 To turn up at dollar sign, dollar sign a zero, the exclamation point as the password for this now 121 00:08:25,150 --> 00:08:32,620 cracked and five hash so we can see that it's an important thing to have better passwords than just 122 00:08:32,650 --> 00:08:34,440 substituting a few characters. 123 00:08:34,450 --> 00:08:42,130 And unfortunately, even if you substitute a lot of characters out of 800 billion combinations right 124 00:08:42,130 --> 00:08:44,710 now for the MI five password cracker. 125 00:08:45,610 --> 00:08:52,810 Almost no password is safe if it's just a regular dictionary word with just a few substitutions in the 126 00:08:52,810 --> 00:08:57,340 next lesson, we're going to talk about some ways to keep your passwords safe, to make your password 127 00:08:57,350 --> 00:09:02,960 safer and to keep your password from getting exposed in any of the ways that we've seen today. 128 00:09:03,280 --> 00:09:07,090 So we'll talk about some good tips from password safety coming up next.