Printable View
Hello,
Would someone please remind me of the name of the program used to take a list of words and hashes them into a table to be used in one of the password crackers like LC5, Cain, etc? I’ve got plenty of hash table creators that will build a table from a row of characters but I need to use it for a list of words. I really can not remember the name.
Thanks again!
Tony
Hmmm, was the program called John The Ripper?
Rainbow tables?
You could try this http://www.rainbowcrack-online.com/ and you won't have need
to create rainbow tables by yourself.
Hello,
Well, the program I was trying to think of was Winrtgen that comes with Cain but after looking it over it doesn't allow selecting a text file, it is like the others I saw where you select a dropdown menu and select one of the choices from a list of characters to build the table.
I had read somewhere a while back that you could take a text file and run this app against it to build a table but I am now assuming that means Winrtgen uses the text file that is laid out in a certain format as the text file to which they were referring.
I really thought there was a way to take a dictionary file and create a hash table. I wonder if you could take the entire text list of passwords and just encrypt the whole thing, if that would work??
I’m also going to check out a few of the ones suggested, I should get lucky on one of these.
Thanks everyone for your help!!
Tony
Sigh... Read about Rainbow tables as mentioned above..
What rainbow tables do, in a nutshell, is take a list of passwords (all the possible variations) and calculate the hashes from that.. It now has a list of all possible hashes, it then compares those with the hashes found on a system. The speed improvement is in the fact you can pre-calculate all the possible hashes, store them and reuse it.
Thanks for the reply!
I've read up on the tables already, maybe I'm missing something. What I was hoping to do is actually take the real list of user's passwords that I am extracting and run something to make a rainbow table from that list. I know the other tables may eventually find the passwords with the coompiled hashes but I was shotting for creating a hash table that had the exact passwords to which I am trying to crack already in the table and there would be no need for other hashes since I have the list. Then if there are password changes or new users LC5 would then use the next table in the list.
I tried placing the passwords in the dictionary list but that didn't help, I'm assuming that was because LC5 didn't look at the word as a whole but as each letter.
Hopefully I'm not too far off base, I may have not understood the documents but I pulled a lot of it from security courses I've taken. The way I understood, pre-computed hashes were originally created by hashing a dictionary and indexing it to inhance the speed, which would make all the words in hashed form to compare against the password hashes...
If not, then it's back to school for me...:P
Thx again!
Tony
T_Stark:
As far as I'm concerned, you are right, I see nothing for winrtgen that takes an input file to generate hashes on a predetermined password list.
In a quick Google, I found nothing for windows that stood out to do the task you have specified.
You could probably write your own script on Unix and generate the password/hash combinations.
SirDice: I haven't seen any functionality with the rainbow tables to generate a limited set of the charset. EG from a pass dictionary.
Read it again as you clearly misunderstood what rainbow tables are. You create tables for every password possible. So that includes anything and everything, any user can think of..Quote:
Originally posted here by T_Stark
I've read up on the tables already, maybe I'm missing something. What I was hoping to do is actually take the real list of user's passwords that I am extracting and run something to make a rainbow table from that list.
Hi Tony,
Firstly, let me state quite categorically that I am no expert in this area, but, given my limited understanding, it seems you are confusting two concepts.
1. A dictionary cracker............this has text entries (words) and probably well known default passwords, even if they are not proper language.
2. A brute force cracker...........rainbow tables are an advanced form of this. Here you calculate (or in the case of rainbow tables, pre-calculate) all possible combinations of characters within the set you have defined.
You appear to be trying to go diagonally across these two concepts?
I think that you might be looking for a dictionary cracker and how to load a specific dictionary? but I might well be wrong...........can you clarify a bit please?
:)
Oh! and if you are trying to do what I think you are...............don't, it is a total waste of time. You must educate your users in what are secure passwords, NOT criticise them for having weak ones. That will just p1$$ them off ;)
You then need to implement a process that validates their passwords in accordance with your security model. BEFORE they can use them to gain access.
I think he is looking for a marrying of the two... I haven't seen any tools out there, but it sounds like a good idea to me.
All the common passwords are already hashed out... you try your small set of tables first... proceed to other methods if that doesn't work.
Is that so hard to understand? Is that pointless? T_Stark is new to security, so he is thinking outside the box... because he doesn't know what the box is!
Then again, maybe T_Stark is confused...
alleyCat
I think that you have a good point. I haven't seen such a tool either.
OK, I don't know Tony's precise requirements, so I cannot come up with a slick workaround (not that I would be able to anyway :D )
I would put together an application that called on a dictionary cracker, then a brute forcer. You might want to make it a bit more sophisticated and enter "rules" like "if the password is more than X characters, skip the dictionary bit because it cannot be a word, and go straight for brute force."
If the objective is to validate user passwords in accordance with your security policy's password rules then you need something to test the password before it is submitted. I would just create a table of banned passwords and compare the submission to those. This would be a dictionary plus common defaults for systems and applications. So the test would be something like:
1. Is the password between the minimum and maximum allowed characters?
2. Does it contain numbers and letters?
3. Does it contain upper and lower case?
4. Does it contain symbols?
5. Is it in the "prohibited table?"
6. Has it been used before in the last X passwords for this user?
and so on......................................that way you check the password and enforce reasonably secure ones, without irritating the user by letting them think they are being spied on.
I know that you will hear people say that long passwords are bad because people cannot remember them? Well my solution (so far) is to recommend "packing" the password:
1. Select your "core password" say it is "password" which is 8 characters. Then disguise it:
"pa$sW0Rd"...................might as well leave the inverted commas?..............now add some packing:
AbCdEfG"pa$sW0Rd"0987654321...................so that's it, all we need is a bit of wrapping?
€[AbCdEfG"pa$sW0Rd"0987654321]£
And there you have an easily remembered 31 character password. When you change it, all you do is change the 8 character core.
Just a few thoughts :)
You are correct, I guess my thing was that I have seen dozens of different rainbow tables generated so it may take dozens to do the job....so I figured that if I could hash the actual passwords that the time to finish and the number of tables would be minimal.Quote:
Originally posted here by SirDice
Read it again as you clearly misunderstood what rainbow tables are. You create tables for every password possible. So that includes anything and everything, any user can think of..
Please don't get me wrong, I completly understand what you're saying, it just seemed less time to hash the actual password list. I guess I should have taken a server and made my own tables, unfortunatly I don't think the hashin program that comes with LC5 uses more than one processor and I don't think the tables built by other apps will work with LC5.
Next on my list is suggesting we use Rainbowcrack, Cain or John the Ripper...
Thanks for the response!
Tony