Printable View
Does anyone know of a password cracker, that runs on windows, and cracks Unix/Linux password files?
The reason why, is because, I would like to see how secure my password is for my website. If there isn't one that does that. How can I make a password on windows, and use a windows password cracker, to audit it?
I think somewhere in the MISC forum was a post for a web based cracking utility that allowed you to enter the MS hash of your password.
Edit: here it is
http://www.sec33.com/modules.php?name=IPC
As far as I would imagine, password complexity is just that...and not dependent upon operating system.
Otherwise, L0phtCrack does have a trial version that does everything but brute force. I assume your password is at least going to pass the dictionary and dictionary+numbers attack that the trial does.
search google or astalavista.com
I imagine that a password cracker could be on windows against linux/unix or you could run it on unix against your localhost. I don't use many of these tools. I imagine a brute force attack could eventually gain access (assuming the account does not get locked after x failed attempts).
Cheers,
Duncan
Try John the Ripper @ http://www.openwall.com/john/. It has *nix/win/dos versions and is considered to be one of the best password crackers around. There was an article on it today from Linux Security called "Psst... I know your password".
This is an NT password cracker and I cannot speculate on its efficiency since the source code has not been released. I remember there were some doubts about this when the link to this was first posted at AO.Quote:
I think somewhere in the MISC forum was a post for a web based cracking utility that allowed you to enter the MS hash of your password.
Edit: here it is
http://www.sec33.com/modules.php?name=IPC
As far as I would imagine, password complexity is just that...and not dependent upon operating system.
Otherwise, L0phtCrack does have a trial version that does everything but brute force. I assume your password is at least going to pass the dictionary and dictionary+numbers attack that the trial does.
JohntheRipper just get a a couple good word lists first
John The Ripper kicks butt!
John The Ripper is pretty cool with a huge dictionnary.
I use L0PHT crack. Its pretty good but is kind of slow, if you look around you can get a copy for free. Search google or another search engine for the link to the site.
Go here:
http://www.evadenet.com/downloads/lophtcrack.shtml
A direct d/l for lophtcrack.
PS... Dooh! Nevermind. I had my head up my a*$ and did'nt pay attention to the question. Lophtcrack runs on Win32 or Unix/Linux. But it's used to hit Password Dumps and SAMS on Win32 platforms. You want to nail a *nix box from win. I can't read tonight. Somebody slap me before I post again................... :rolleyes:
Scorp666 the last time i got john the word list sucked. musta been i got unlucky or you got lucky. i think i got mine from a link on packet storm but i might be wrong.
just went and followed the link to http://www.openwall.com/john/
attached is the lst file
tinycrack is good to im not sure but if i remember you can get a windoze version but i know of some goodies in the HDC archive but if you really wanted to have some fun and not many limitations just install linux cause most distros come with a cracker in one form or anther
remember if the passdw file is shadowed, their wont be an encrytion to crack
in red hat:
/etc/passwd`s output is `x` for the passwd
is covered by /etc/shadow
and i think teh hosts is shadowed too
preep
John the Tripper's got a cool option to combine dictionaries. . .I thought it made it kinda easy to make a good wordlist, just have to download a shitload of ready-made wordlists off the net, too bad no graphiX proggie can turn a pic into a plain text file, then it be f*kin' cake. . . btw if anyone DOES know of a way to turn a scan of text into a plain text file, you rock!!!. . .and tell us HOW.
d313t3d the ocr software that comes with scanners does a pretty good job. at work thay scan faxs to workable text files and the only thing that dosn't get converted is a badly written signiture. the software came with a 99 dollar scanner. if you need the name you'll have to wait until tuesday.