Password Cracking

Techniques
Krishna Sharma
21072010
 Overview
• Password Cracking is the process of recovering passwords
from data that have been stored in or transmitted by a
computer System
The purpose of password cracking might be:
1. Help a user to recover a forgotten password
2. Gain unauthorized access to a system
3. Preventive measurement of password strength
Types of Password Attacks

Brute Force Attacks

DICTIONARY ATTACKS

RAINBOW TABLE ATTACK

PHISHING AND SOCIAL

ENGINEERING
 Hash Functions
• A hash function is a function that takes a set of inputs of any arbitrary
size and fits them into a table or other data structure that contains
fixed-size elements.
• A Hash function is considered practically impossible to invert. The
input data is called message and hash value is often called message
digest or simply digest.
 Rainbow Table Attack
• Rainbow tables were invented by Philippe Oechslin
• A rainbow table is a pre-computed compilation of plaintexts
and matching cipher texts(typically passwords and their
matching hashes).
• They are faster compared to brute force and dictionary
attacks.
• Rainbow tables are created by pre-computing the hash
representation of passwords, and creating a lookup table to
accelerate the process of checking for weak passwords.
 How Rainbow Tables are Created

• These chains are not stored instead only the start and end text of chain is stored
which helps is saving memory.
• The name “Rainbow” in “rainbow table” comes from usage of different reduction
functions
• Rainbow table attacks work on the principle of
time-memory trade-off.
 How to Prevent Rainbow Attacks
• Rainbow attacks can be preventing by adding Salt to the hash.
• A Salt is a random string that is appended to the value we want to
hash (the password) before the hash function is applied.
• The salt does not need to be secret. However, it must be
unpredictable and reasonable long.
•  The password now turns into completely different hash values
depending on the salt, to still be able to use a rainbow table the
attacker would have to create one table for each possible salt value.
THANK YOU