This document is for people who want to learn to the how and why of password cracking. There is
a lot of information being presented and you should READ IT ALL BEFORE you attempted
doing anything documented here. I do my best to provide step by step instructions along with the
reasons for doing it this way. Other times I will point to a particular website where you find the
information. In those cases someone else has done what I attempting and did a good or great job
and I did not want to steal their hard work. These instructions have several excerpts from a
combination of posts from pureh@te, granger53, irongeek, PrairieFire, RaginRob, stasik, and
Solar Designer. I would also like to thank each of them and others for the help they have provided
me on the BackTrack forum.
Contents
1 LM vs. NTLM
2 Syskey
3 Cracking Windows Passwords
3.1 Extracting the hashes from the Windows SAM
3.1.1 Using BackTrack Tools
3.1.1.1 Using bkhive and samdump v1.1.1 (BT2 and BT3)
3.1.1.2 Using samdump2 v2.0.1 (BT4)
3.1.1.3 Cached Credentials
3.1.2 Using Windows Tools
3.1.2.1 Using fgdump
3.1.2.2 Using gsecdump
3.1.2.3 Using pwdump7
3.1.2.4 Cached Credentials
3.2 Extracting the hashes from the Windows SAM remotely
3.2.1 Using BackTrack Tools
3.2.1.1 ettercap
3.2.2 Using Windows Tools
3.2.2.1 Using fgdump
3.3 Cracking Windows Passwords
3.3.1 Using BackTrack Tools
3.3.1.1 John the Ripper BT3 and BT4
3.3.1.1.1 Cracking the LM hash
3.3.1.1.2 Cracking the NTLM hash
3.3.1.1.3 Cracking the NTLM using the cracked LM hash
3.3.1.1.4 Cracking cached credentials
3.3.1.2 John the Ripper - current
3.3.1.2.1 Get and Compile
3.3.1.2.2 Cracking the LM hash
3.3.1.2.3 Cracking the LM hash using known letter(s) in known location(s) (knownforce)
3.3.1.2.4 Cracking the NTLM hash
3.3.1.2.5 Cracking the NTLM hash using the cracked LM hash (dumbforce)
3.3.1.2.6 Cracking cached credentials
3.3.1.3 Using MDCrack
3.3.1.3.1 Cracking the LM hash
3.3.1.3.2 Cracking the NTLM hash
3.3.1.3.3 Cracking the NTLM hash using the cracked LM hash
3.3.1.4 Using Ophcrack
3.3.1.4.1 Cracking the LM hash
3.3.1.4.2 Cracking the NTLM hash
3.3.1.4.3 Cracking the NTLM hash using the cracked LM hash
3.3.2 Using Windows Tools
3.3.2.1 John the Ripper
3.3.2.1.1 Cracking the LM hash
3.3.2.1.2 Cracking the NTLM hash
3.3.2.1.3 Cracking the NTLM hash using the cracked LM hash
3.3.2.1.4 Cracking cached credentials
3.3.2.2 Using MDCrack
3.3.2.2.1 Cracking the LM hash
3.3.2.2.2 Cracking the NTLM hash
3.3.2.2.3 Cracking the NTLM hash using the cracked LM hash
3.3.2.3 Using Ophcrack
3.3.2.3.1 Cracking the LM hash
3.3.2.3.2 Cracking the NTLM hash
3.3.2.3.3 Cracking the NTLM hash using the cracked LM hash
3.3.2.4 Using Cain and Abel
3.3.3 Using a Live CD
3.3.3.1 Ophcrack
4. Changing Windows Passwords
4.1 Changing Local User Passwords
4.1.1 Using BackTrack Tools
4.1.1.1 chntpw
4.1.2 Using a Live CD
4.1.2.1 chntpw
4.1.2.2 System Rescue CD
4.2 Changing Active Directory Passwords
5 plain-text.info
6 Cracking Novell NetWare Passwords
7 Cracking Linux/Unix Passwords
8 Cracking networking equipment passwords
8.1 Using BackTrack tools
8.1.1 Using Hydra
8.1.2 Using Xhydra
8.1.3 Using Medusa
8.1.4 Using John the Ripper to crack a Cisco hash
8.2 Using Windows tools
8.2.1 Using Brutus
9 Cracking Applications
9.1 Cracking Oracle 11g (sha1)
9.2 Cracking Oracle passwords over the wire
9.3 Cracking Office passwords
9.4 Cracking tar passwords
9.5 Cracking zip passwords
9.6 Cracking pdf passwords
10 Wordlists aka Dictionary attack
10.1 Using John the Ripper to generate a wordlist
10.2 Configuring John the Ripper to use a wordlist
10.3 Using crunch to generate a wordlist
10.4 Generate a wordlist from a textfile or website
10.5 Using premade wordlists
10.6 Other wordlist generators
10.7 Manipulating your wordlist
11 Rainbow Tables
11.1 What are they?
11.2 Generating your own
11.2.1 rcrack - obsolete but works
11.2.2 rcracki
11.2.3 rcracki - boinc client
11.2.4 Generating a rainbow table
11.3 WEP cracking
11.4 WPA-PSK
11.4.1 airolib
11.4.2 pyrit
12 Distributed Password cracking
12.1 john
12.2 medussa (not a typo this is not medusa)
13 using a GPU
13.1 cuda - nvidia
13.2 stream - ati
14 example hash.txt
Like it ? Share it.a lot of information being presented and you should READ IT ALL BEFORE you attempted
doing anything documented here. I do my best to provide step by step instructions along with the
reasons for doing it this way. Other times I will point to a particular website where you find the
information. In those cases someone else has done what I attempting and did a good or great job
and I did not want to steal their hard work. These instructions have several excerpts from a
combination of posts from pureh@te, granger53, irongeek, PrairieFire, RaginRob, stasik, and
Solar Designer. I would also like to thank each of them and others for the help they have provided
me on the BackTrack forum.
Type: E-Book
Contents
1 LM vs. NTLM
2 Syskey
3 Cracking Windows Passwords
3.1 Extracting the hashes from the Windows SAM
3.1.1 Using BackTrack Tools
3.1.1.1 Using bkhive and samdump v1.1.1 (BT2 and BT3)
3.1.1.2 Using samdump2 v2.0.1 (BT4)
3.1.1.3 Cached Credentials
3.1.2 Using Windows Tools
3.1.2.1 Using fgdump
3.1.2.2 Using gsecdump
3.1.2.3 Using pwdump7
3.1.2.4 Cached Credentials
3.2 Extracting the hashes from the Windows SAM remotely
3.2.1 Using BackTrack Tools
3.2.1.1 ettercap
3.2.2 Using Windows Tools
3.2.2.1 Using fgdump
3.3 Cracking Windows Passwords
3.3.1 Using BackTrack Tools
3.3.1.1 John the Ripper BT3 and BT4
3.3.1.1.1 Cracking the LM hash
3.3.1.1.2 Cracking the NTLM hash
3.3.1.1.3 Cracking the NTLM using the cracked LM hash
3.3.1.1.4 Cracking cached credentials
3.3.1.2 John the Ripper - current
3.3.1.2.1 Get and Compile
3.3.1.2.2 Cracking the LM hash
3.3.1.2.3 Cracking the LM hash using known letter(s) in known location(s) (knownforce)
3.3.1.2.4 Cracking the NTLM hash
3.3.1.2.5 Cracking the NTLM hash using the cracked LM hash (dumbforce)
3.3.1.2.6 Cracking cached credentials
3.3.1.3 Using MDCrack
3.3.1.3.1 Cracking the LM hash
3.3.1.3.2 Cracking the NTLM hash
3.3.1.3.3 Cracking the NTLM hash using the cracked LM hash
3.3.1.4 Using Ophcrack
3.3.1.4.1 Cracking the LM hash
3.3.1.4.2 Cracking the NTLM hash
3.3.1.4.3 Cracking the NTLM hash using the cracked LM hash
3.3.2 Using Windows Tools
3.3.2.1 John the Ripper
3.3.2.1.1 Cracking the LM hash
3.3.2.1.2 Cracking the NTLM hash
3.3.2.1.3 Cracking the NTLM hash using the cracked LM hash
3.3.2.1.4 Cracking cached credentials
3.3.2.2 Using MDCrack
3.3.2.2.1 Cracking the LM hash
3.3.2.2.2 Cracking the NTLM hash
3.3.2.2.3 Cracking the NTLM hash using the cracked LM hash
3.3.2.3 Using Ophcrack
3.3.2.3.1 Cracking the LM hash
3.3.2.3.2 Cracking the NTLM hash
3.3.2.3.3 Cracking the NTLM hash using the cracked LM hash
3.3.2.4 Using Cain and Abel
3.3.3 Using a Live CD
3.3.3.1 Ophcrack
4. Changing Windows Passwords
4.1 Changing Local User Passwords
4.1.1 Using BackTrack Tools
4.1.1.1 chntpw
4.1.2 Using a Live CD
4.1.2.1 chntpw
4.1.2.2 System Rescue CD
4.2 Changing Active Directory Passwords
5 plain-text.info
6 Cracking Novell NetWare Passwords
7 Cracking Linux/Unix Passwords
8 Cracking networking equipment passwords
8.1 Using BackTrack tools
8.1.1 Using Hydra
8.1.2 Using Xhydra
8.1.3 Using Medusa
8.1.4 Using John the Ripper to crack a Cisco hash
8.2 Using Windows tools
8.2.1 Using Brutus
9 Cracking Applications
9.1 Cracking Oracle 11g (sha1)
9.2 Cracking Oracle passwords over the wire
9.3 Cracking Office passwords
9.4 Cracking tar passwords
9.5 Cracking zip passwords
9.6 Cracking pdf passwords
10 Wordlists aka Dictionary attack
10.1 Using John the Ripper to generate a wordlist
10.2 Configuring John the Ripper to use a wordlist
10.3 Using crunch to generate a wordlist
10.4 Generate a wordlist from a textfile or website
10.5 Using premade wordlists
10.6 Other wordlist generators
10.7 Manipulating your wordlist
11 Rainbow Tables
11.1 What are they?
11.2 Generating your own
11.2.1 rcrack - obsolete but works
11.2.2 rcracki
11.2.3 rcracki - boinc client
11.2.4 Generating a rainbow table
11.3 WEP cracking
11.4 WPA-PSK
11.4.1 airolib
11.4.2 pyrit
12 Distributed Password cracking
12.1 john
12.2 medussa (not a typo this is not medusa)
13 using a GPU
13.1 cuda - nvidia
13.2 stream - ati
14 example hash.txt
