Original subtitles

in this lesson we're going to talk about

password cracking you're going to run

across instances where you can get hold

of the password file but of course

passwords aren't stored in clear text

and in subsequent lessons we'll get into

how passwords are actually stored let's

just say they're not stored in clear

text and you need to be able to do

something in order to get a clear text

password from these password files so

the first thing that we're going to look

at is the little play on of course Jack

the Ripper the famous serial killer it's

called John the Ripper the first thing

I'm going to do is grab a copy of the

password file that includes the

encrypted passwords in it so that i can

run John so I've got my password file

I'm actually going to copy that into

this directory where I've got my word

lists

so I'm going to go into this wordless

directory here now the thing about

password cracking is it's not like you

know the movies where you just run

through all of these things and very

quickly you get a password that can take

a really really long time and probably a

lot longer than your lifetime in order

to check through all of the various

permutations and combinations of letters

and characters and numbers and so what

we do is we create a word list of

potential passwords and then we go

through the process of creating a

password from it in other words doing

the same process that you would use to

store your password so we're going to do

a cryptographic hash of it and then we

compared the two hashes in order to see

whether they match or not and if they

match we know what the plaintext

password was because that's what we used

to create the hash so what I'm going to

do is I'm going to run John and I've got

my word list and it's called LST and I'm

going to run that against my password

file that I created up above so what

it's going to be doing here is running

through all of the passwords in that

file and checking them against the

password file and seeing whether they

match and this could take quite a while

and so you're going to want to just let

this run for hours and hours if not

potentially days doing this password

ripping or password cracking can take

quite a while one thing that can help

get around that is using something

called rainbow tables now rainbow tables

are pre computed hash tables that save

the computation time of doing the hash

on all of the passwords as you go

through them so here's a program called

oph crack that's a free windows password

cracker and it uses rainbow tables so

you can use this oph crack that you

could download all over the internet and

you can use those tables with off

crack in order to hopefully get some

quicker times to get your passwords

cracked there's no guarantee because if

the password isn't in the list of words

that you're checking then you're not

going to crack the password and that's

one of the places where complexity is

really important when it comes to

creating passwords if you're just using

a regular word even if you say

capitalize the first letter there's a

good chance that that may be in a word

list somewhere that somebody can crack

which is why typically you'll see strong

passwords recommending a combination of

symbols and letters and numbers as well

as upper and lower case if you do enough

complexity and add enough variability to

your password you're not going to see

that in a password cracker word list

probably and it's going to make your

password very difficult to crack because

what they would have to do would be to

do a real honest-to-goodness brute force

where they do check all of the potential

permutations and combinations that's

also why a longer password is better

because of course the more positions you

put into a password the longer it's

going to take to brute force the other

thing is that word lists are often kind

of up to eight characters because that's

traditionally been sort of a standard

password length so if you make it a

little bit longer you make your password

harder to crack and harder to find so

ophcrack here runs on windows linux and

mac OS you'll see you can also get free

tables for windows XP and vista and when

you download ophcrack you'll be able to

get those rainbow tables to go with that

particular program another utility

though that runs under windows Cain and

Abel is another password cracker it does

different things though so I could load

the secrets from my windows system

and you can see I'm pulling in the

password file here and I could run Cain

against that to see whether it can crack

them we can also look for wireless

passwords it'll dump out your internet

explorer passwords as well as different

edit boxes it can do some sniffing on

your network to be able to find

passwords there it also has the ability

to do ARP poisoning which means it can

actually get a lot of data coming in to

it that you wouldn't normally have so

you can run this as a sniffer to go

grabbing passwords and see what it can

find on the network there's a lot of

different types of passwords that it

supports you'll see up above there's VNC

and VPN there's some base64 password

decoders that it supports access

database password decoder and a cisco

type 7 password decoder because Cisco

stores passwords in their configuration

files on their routers in switches in a

particular format and it's possible to

break that and recover passwords that

are stored in that cisco 7 password

format you can decrypt WEP encrypted

messages and we'll get into some

wireless in subsequent lessons Cain and

Abel supports a lot of different ways to

grab passwords both locally and remotely

so that's three different utilities that

you could use to capture passwords and

crack passwords in some different

formats