In this lesson, we're going to talk about
different types of password attacks.
These include Brute-force Attacks, Dictionary Attacks,
Hybrid Attacks, and Rainbow Table Attacks.
Now understanding these attacks
will help you both defending against them
and using them ethically during your pentest.
First, let's look at brute-force attacks.
A brute-force attack is the most basic type of attack
where every possible combination of characters is tried
until the correct password is found.
Now, imagine trying every key combination
on a lock until it open.
That's essentially what a brute-force attack does
but with passwords.
Password attacks can be done using tools
like Hydra or John the Ripper.
For example, if you're targeting a SSH server
running on IP address, 192.168.1.100,
with the username jkelly, you might use Hydra
with the following command,
hydra -l jkelly -x,
and then we're going to have a whole bunch
of different options
that we're going to input here.
Okay, then we're going to also focus on
the SSH target at
IP address 192.168.1.100.
Now the x option instructs Hydra
to generate passwords based on the length
of 4 minimum and 8 maximum,
and then we have the alphabet from a through z,
and then we have 1234567890, which means
that will be the set of numbers we will use for this attack.
Next, we have dictionary attacks.
Unlike brute-force attacks,
which drop all possible combinations,
dictionary attacks use a predefined list of words
like a dictionary to guess the password.
This method is faster because it relies
on common passwords and phrases people use.
Tools like John The Ripper can be used
for this purpose as well.
For instance, if you're targeting a FTP server,
you might use a command like
john -- wordlist= and then we have the path
to the word list that we're looking for.
Then we'll set the rules, options, and the format options.
This method is particularly effective against systems
with weak password policies that allow common passwords.
Hybrid attacks combine the strategies
of brute-force and dictionary attacks.
They start with a dictionary attack,
but then combine variations such as numbers
or symbols at the end of each word.
This approach takes advantage of the fact
that many people modify simple passwords
in a predictable way.
Using John the Ripper, you might run a command
like john -- wordlist=, then you have
the path to the word list.
Then you have the rules option set,
and then the format will be in the md5,
and then we also need to associate it
with a particular file.
Now, this allows us to implement the hybrid attack,
adding rules, and the rules option is to try variations
of each word in the dictionary.
Finally, we have a rainbow table attack.
A rainbow table attack is a type of pre-computed attack
that uses a table of hashed passwords
and their corresponding plain text passwords
to crack password hashes quickly.
This method is highly efficient,
but requires significant storage space to hold the tables.
Hashcat is a powerful tool that can be used
to perform these attacks.
If you have a hash file from a captured database,
you might use Hashcat with a command like
hashcat -m 0 -a 3 -o, and then we have paths
to multiple files that we'll be using.
This method is particularly effective against
hashed passwords that do not use salt in their computing.
So remember, brute-force attacks try all combinations,
dictionary attacks use common words,
hybrid attacks combine dictionary and brute-force methods,
and rainbow attacks use pre-computed tables
of hashed passwords.
Now for the exam, you won't need
to have mastered these commands.
You just need to understand the general syntax
and the order of the options.
Also, understanding these methods will help you
both defend against and ethically use
these attacks in pentesting.