Learning Kali Linux, 2nd Edition

Chapter 9. Cracking Passwords

Password cracking isn’t always needed, depending on how much cooperation you are getting from the people who are paying you to test their systems. However, it can be valuable if you are going in without any awareness of what you will find. Cracking passwords can help you get additional layers of privileges as well as potentially provide you access to additional systems in the network. These may be additional server systems, or they may be entryways into the desktop network. Again, this is where it’s essential to get a scope of activity when you document your agreement with your employer. You need to know what is out of bounds and what is considered fair play. This will let you know whether you even need to worry about password cracking.

Passwords are stored in a way that requires us to perform cracking attacks in order to get the passwords back out. However, what exactly does that mean? What is password cracking, and why is it necessary? We’ll cover that in this chapter. In the process, you’ll get a better understanding of cryptographic hashes. You will run across these all over the place, so it’s a good concept to get your hands and head around.

We are going to go after a couple of types of passwords. First, we’ll talk about how to run attacks if you happen to have a file of the passwords, in their hashed form, in front of you. We will also take a look at how to go after remote services. Numerous network services require authentication before a user ...