Number one of the biggest security holes are passwords, as every password security study shows.
Password cracking is the process of recovering passwords from data that have been stored in or transmitted by a computer system. Password cracking isn't done by trying to log in to, say, a bank's website millions of times; websites generally don't allow many wrong guesses, and the process would be unbearably slow even if it were possible. The cracks always take place offline after people obtain long lists of "hashed" passwords, often through hacking.
Password cracking is the process of recovering passwords from data that have been stored in or transmitted by a computer system. Password cracking isn't done by trying to log in to, say, a bank's website millions of times; websites generally don't allow many wrong guesses, and the process would be unbearably slow even if it were possible. The cracks always take place offline after people obtain long lists of "hashed" passwords, often through hacking.
Below are the top Hacking
Tools used as a Password cracker
Cain & Abel is a password
recovery tool for Microsoft Operating Systems. It allows easy recovery of
various kinds of passwords by sniffing the network, cracking encrypted
passwords using Dictionary, Brute-Force and Cryptanalysis attacks, recording
VoIP conversations, decoding scrambled passwords, recovering wireless network
keys, revealing password boxes, uncovering cached passwords and analyzing
routing protocols. The program does not exploit any software vulnerabilities or
bugs that could not be fixed with little effort. It covers some security
aspects/weakness present in protocol's standards, authentication methods and
caching mechanisms; its main purpose is the simplified recovery of passwords
and credentials from various sources, however it also ships some "non
standard" utilities for Microsoft Windows users.
THC Hydra is a fast and flexible
Network Login Hacking Tool. It uses a dictionary attack to try various
password/login combinations against an Internet service to determine a valid
set of login credentials. It supports a wide set of protocols including Mail
(POP3, IMAP, etc.), Databases, LDAP, SMB, VNC, and SSH.
Ophcrack is a free open source
(GPL licensed) program that cracks Windows passwords by using LM hashes through
rainbow tables. The program includes the ability to import the hashes from a
variety of formats, including dumping directly from the SAM files of Windows.
On most computers, ophcrack can crack most passwords within a few minutes.
John the Ripper is a free
password cracking software tool. Initially developed for the Unix operating
system, it now runs on fifteen different platforms (eleven of which are
architecture-specific versions of Unix, DOS, Win32, BeOS, and OpenVMS). It is
one of the most popular password testing and breaking programs as it combines a
number of password crackers into one package, autodetects password hash types,
and includes a customizable cracker. It can be run against various encrypted
password formats including several crypt password hash types most commonly
found on various Unix versions (based on DES, MD5, or Blowfish), Kerberos AFS,
and Windows NT/2000/XP/2003 LM hash. Additional modules have extended its
ability to include MD4-based password hashes and passwords stored in LDAP,
MySQL, and others.
Medusa is intended to be a
speedy, massively parallel, modular, login brute-forcer. The goal is to support
as many services which allow remote authentication as possible. The author
considers following items as some of the key features of this application:
- Thread-based parallel testing. Brute-force testing can be performed against multiple hosts, users or passwords concurrently.
- Flexible user input. Target information (host/user/password) can be specified in a variety of ways. For example, each item can be either a single entry or a file containing multiple entries. Additionally, a combination file format allows the user to refine their target listing.
- Modular design. Each service module exists as an independent .mod file. This means that no modifications are necessary to the core application in order to extend the supported list of services for brute-forcing.
%2Bdork%2Blist%2Binfosec%2Baffairs.png)