Hack Security Pro.pdf - Index of

1.Authentication Brute force
In this section, we will talk about cracking password files for various OSs. Let us start by explaining the
3 methods used by softwares to crack password files.
Dictionary attack
This attack is the quickest one because it does a pass test using a dictionary file (this is a simple text
file with one word per line, one after the other). To have an efficient dictionary, you must collect a
maximum of information on the users of the target server. On the Internet, there are many already
complete dictionaries, as well as generators.
Brute force attack
The idea is to try all the combinations possible following a certain number of characters. If the
password to crack has several special characters, both numbers and letters, it will take longer to brute
force than a pass made up of letters only. So a brute force attack always succeeds, it is only a
question of time...
Hybrid attack
A hybrid attack is a mix of the 2 previous attacks. It uses a dictionary for the main part (e.g. crash) and
brute force for the final part (e.g. fr), which enables it to find passwords such as “crashfr” or “crash24”,
etc...
A) .pwl files of Windows9x/ME
Files with the .pwl extension have your Windows passwords, they are in the root directory
(c:\windows). Of course, all .pwl files are encrypted, as you will be able to see if you try to open one
with a text editor such as notepad, for example. These files can contain connection passwords, saving
screens, sessions, ...
To decrypt them, you must use software such as Pwltool (http://soft4you.com/vitas/pwltool.asp) that
will take care of cracking the file and then display the passwords clearly.
The Hackademy DMP -167/209- SYSDREAM