Overview: Password attacks are attempts to crack or guess a user's password. This document discusses various techniques used in password attacks and ways to defend against them.
- Brute Force Attack
- Dictionary Attack
- Rainbow Table Attack
- Password Cracking Tools
- Best Practices for Password Security
- Resources
A brute force attack tries every possible combination until the correct password is found. It is time-intensive and may be mitigated with account lockout mechanisms.
Example: Using Hydra to brute-force SSH:
hydra -l <username> -P <password-list> ssh://<target-ip>A dictionary attack uses a list of common passwords or words, assuming the target's password is a common one.
Example: Using John the Ripper with a wordlist:
john --wordlist=<wordlist.txt> <hashfile>Rainbow tables are precomputed tables for reversing cryptographic hash functions, primarily used to crack password hashes quickly.
- Prevention: Use salted hashes to prevent rainbow table attacks.
- John the Ripper: Powerful password cracker for various hash types.
- Hydra: Fast and flexible network login cracker.
- Hashcat: Advanced GPU-accelerated password recovery tool.
- Use long, complex passwords.
- Enable multi-factor authentication (MFA).
- Avoid using the same password across multiple sites.
- Password Cracking Tools by Kali Linux
- Cybersecurity Password Best Practices