In the Ethical Hacking - Passwords lesson, I will embark on a comprehensive journey into the world of password security and its vulnerabilities. This hands-on session is designed to provide me with valuable insights into the techniques and methods employed by ethical hackers to crack passwords. I will not only learn the art of password cracking but also gain a deep understanding of how passwords are susceptible to hacking and hijacking. The lesson will delve into the intricacies of password interception by demonstrating how to sniff unencrypted passwords using the powerful tool Wireshark. By the end of this lesson, I will possess a robust skill set for assessing and bolstering password security, making me well-equipped to defend against potential cyber threats.
Environment Used
Kali Linux, Windows, and Metasploitable2 VM
Network Attached to: Host-only Adapter
Name: Virtualbox Host-Only Ethernet Adapter #2
IP Address = 10.0.3 Network
Device Breakdown:
Kali Linux VM: Victim Device
Windows VM: Sniffing Device
Metasploitable2 VM: Opening up the Mutillidae application for sniffing
Tool Used:
Wireshark on Windows VM
Mutillidae on Metasploitable2 VM
Problems with Passwords
Social Engineering:
Just a simple phishing email section 3 can phish your password no matter how great your password is
Snacking:
Post-it notes with passwords around their workstation
A technique used to reveal passwords stored in the browser that we will learn in this lesson
Sniffing:
Capturing unencrypted passwords with a tool called Wireshark we will learn in this lesson
Cracking:
A technique used to crack passwords by using hash lookup, dictionary, or brute force attack that we will learn in this lesson
Hijacking Stored Password from Chrome
Google Chrome
Go to a website that has a login page.
For Example: Facebook, Twitter
On Facebook if the browser has autofill on, highlight the masked password > right-click> inspect
In the inspect window, look at the highlighted field
changing the input type="password" to input type="text" will display the password
Chrome Facebook Hijacking
4. On [Twitter](https://twitter.com/i/flow/login) if the browser has autofill on, highlight the masked password > right-click> inspect
5. In the inspect window, look at the highlighted field
- changing the input type="password" to input type="text" will display the password
Chrome Twitter Hijacking
This method basically works on almost all the websites that have autofill, just need to inspect and change type=password to type=text. This can also work on Firefox the same way as Chrome. Other browsers as well but with some extension.
Sniffing Password from the Network
Preparation: Installing Wireshark
- Open up Windows VM on the Oracle VM Application
- Make sure you have internet access, download [Wireshark](https://www.wireshark.org/)
- Run the installer
- Change the network for Windows VM to a host-only adapter [10.0.3] Network
- Turn Promiscuous Mode from Deny to Allow VMs
Changing Network on Windows VM
- Open up Metasploitable2 VM on the Oracle VM Application
- Open up Kali Linux VM on the Oracle VM Application
- Check all VM IP Addresses are in the 10.0.3 Network by using ifconfig/ipconfig command
- Windows VM: 10.0.3.4
- Kali Linux: 10.0.3.5
- Metasploitable2 VM: 10.0.3.6
Sniffing Unencrypted Passwords with Wireshark
1. Open up Wireshark on Windows VM
2. Capture > Options > Check if you enable promiscuous mode and we are just looking at the Ethernet one
Enable Promiscuous Mode on Wireshark
3. On Kali Linux, Type in browser: 10.0.3.6
Kali Linux Browsing Metasploitable2 IP
4. Click on Multillidae > Reset DB > Login/Register
- Register Name: jeff; Password: NotApassword
5. Go back to the Windows VM Wireshark and press start capturing packets underneath File
6. Go back to Kali Linux and log in with the:
- Name: jeff; Password: NotApassword
Setup For Step 4 - 6
7. Wirshark will capture the packets when we are logging in to Mutillidae
Wireshark Packet Captured
8. Save the captured packet > File > Save as: Login traffic
Saving Captured Packet
9. Analyze the Packet > Edit > Find packet
- Change the Display filter to String; type in "post" in the box
Running Post Command to Analyze the Packet
10. Double-click on the dark green highlighted packet with HTTP as Protocol
- Can expand the HTML form URL
- We can get the username and password from this form
Packet Analyze HTML Form
Cracking Passwords with Kali Linux and Online Tools
- We can use [Hashes.com](https://hashes.com/en/decrypt/hash) to crack passwords that is in hashes
- For example Hash: 64f12cddaa88057e06a81b54e73b949b = Password1
Hashes.com cracking hashes Form
- We can also use ophcrack on Kali Linux to crack passwords that are in hashes
- Click on the top left corner of the VM for application > Scroll down to 5. Password Attacks > ophcrack
- We can also use Kali Linux to hash our password
- Go to the terminal and type in:
- > md5sum
> [what you want your password to be]
- Ctrl + D twice
- Example: I put in Password1 for password then I press Ctrl + D
- Result: Password12ac9cb7dc02b3c0083eb70898e549b63
- Everything after Password1 = hashes = 2ac9cb7dc02b3c0083eb70898e549b63
Hashes.com cracking hashes Form
Conclusion
In conclusion, the Ethical Hacking - Password Cracking lesson has equipped me with a comprehensive understanding of password security and its vulnerabilities. Through hands-on experience, I've gained valuable insights into the techniques and methods employed by ethical hackers to crack passwords. This journey has enabled me not only to crack passwords but also to recognize how passwords can be susceptible to hacking and hijacking. The lesson's exploration of password interception using Wireshark has been particularly illuminating. As a result of this lesson, I now possess a robust skill set for assessing and enhancing password security, enhancing my ability to defend against potential cyber threats.
In addition to this newfound knowledge, I've also learned best practices for securing passwords, including:
- Never share passwords with anyone.
- Utilizing strong, memorable passwords without writing them down.
- Employing multiple passwords to mitigate the impact of a potential breach.
- Always use HTTPS for password entry and avoid HTTP to ensure encryption.
- Implementing salted password hashes.
- Leveraging multi-factor authentication for added security.
- Considering the use of a password manager.
- Strengthening the security of my email account, as it is often the gateway for password resets.
- Vigilantly safeguarding physical access to my workstation, recognizing that unauthorized access can compromise stored passwords in web browsers.
Ethical Hacking 5 - Password Problems
Description:
In the Ethical Hacking - Passwords lesson, I will embark on a comprehensive journey into the world of password security and its vulnerabilities. This hands-on session is designed to provide me with valuable insights into the techniques and methods employed by ethical hackers to crack passwords. I will not only learn the art of password cracking but also gain a deep understanding of how passwords are susceptible to hacking and hijacking. The lesson will delve into the intricacies of password interception by demonstrating how to sniff unencrypted passwords using the powerful tool Wireshark. By the end of this lesson, I will possess a robust skill set for assessing and bolstering password security, making me well-equipped to defend against potential cyber threats.
Environment Used
Kali Linux, Windows, and Metasploitable2 VM
Device Breakdown:
Tool Used:
Problems with Passwords
Hijacking Stored Password from Chrome
Google Chrome
Go to a website that has a login page.
On Facebook if the browser has autofill on, highlight the masked password > right-click> inspect
In the inspect window, look at the highlighted field
Chrome Facebook Hijacking
4. On [Twitter](https://twitter.com/i/flow/login) if the browser has autofill on, highlight the masked password > right-click> inspect 5. In the inspect window, look at the highlighted field - changing the input type="password" to input type="text" will display the password
Chrome Twitter Hijacking
This method basically works on almost all the websites that have autofill, just need to inspect and change type=password to type=text. This can also work on Firefox the same way as Chrome. Other browsers as well but with some extension.
Sniffing Password from the Network
Preparation: Installing Wireshark - Open up Windows VM on the Oracle VM Application - Make sure you have internet access, download [Wireshark](https://www.wireshark.org/) - Run the installer - Change the network for Windows VM to a host-only adapter [10.0.3] Network - Turn Promiscuous Mode from Deny to Allow VMsChanging Network on Windows VM
- Open up Metasploitable2 VM on the Oracle VM Application - Open up Kali Linux VM on the Oracle VM Application - Check all VM IP Addresses are in the 10.0.3 Network by using ifconfig/ipconfig command - Windows VM: 10.0.3.4 - Kali Linux: 10.0.3.5 - Metasploitable2 VM: 10.0.3.6 Sniffing Unencrypted Passwords with Wireshark 1. Open up Wireshark on Windows VM 2. Capture > Options > Check if you enable promiscuous mode and we are just looking at the Ethernet one
Enable Promiscuous Mode on Wireshark
3. On Kali Linux, Type in browser: 10.0.3.6
Kali Linux Browsing Metasploitable2 IP
4. Click on Multillidae > Reset DB > Login/Register - Register Name: jeff; Password: NotApassword 5. Go back to the Windows VM Wireshark and press start capturing packets underneath File 6. Go back to Kali Linux and log in with the: - Name: jeff; Password: NotApassword
Setup For Step 4 - 6
7. Wirshark will capture the packets when we are logging in to Mutillidae
Wireshark Packet Captured
8. Save the captured packet > File > Save as: Login traffic
Saving Captured Packet
9. Analyze the Packet > Edit > Find packet - Change the Display filter to String; type in "post" in the box
Running Post Command to Analyze the Packet
10. Double-click on the dark green highlighted packet with HTTP as Protocol - Can expand the HTML form URL - We can get the username and password from this form
Packet Analyze HTML Form
Cracking Passwords with Kali Linux and Online Tools
- We can use [Hashes.com](https://hashes.com/en/decrypt/hash) to crack passwords that is in hashes - For example Hash: 64f12cddaa88057e06a81b54e73b949b = Password1Hashes.com cracking hashes Form
- We can also use ophcrack on Kali Linux to crack passwords that are in hashes - Click on the top left corner of the VM for application > Scroll down to 5. Password Attacks > ophcrack - We can also use Kali Linux to hash our password - Go to the terminal and type in: - > md5sum > [what you want your password to be] - Ctrl + D twice - Example: I put in Password1 for password then I press Ctrl + D - Result: Password12ac9cb7dc02b3c0083eb70898e549b63 - Everything after Password1 = hashes = 2ac9cb7dc02b3c0083eb70898e549b63
Hashes.com cracking hashes Form
Conclusion
In conclusion, the Ethical Hacking - Password Cracking lesson has equipped me with a comprehensive understanding of password security and its vulnerabilities. Through hands-on experience, I've gained valuable insights into the techniques and methods employed by ethical hackers to crack passwords. This journey has enabled me not only to crack passwords but also to recognize how passwords can be susceptible to hacking and hijacking. The lesson's exploration of password interception using Wireshark has been particularly illuminating. As a result of this lesson, I now possess a robust skill set for assessing and enhancing password security, enhancing my ability to defend against potential cyber threats. In addition to this newfound knowledge, I've also learned best practices for securing passwords, including: - Never share passwords with anyone. - Utilizing strong, memorable passwords without writing them down. - Employing multiple passwords to mitigate the impact of a potential breach. - Always use HTTPS for password entry and avoid HTTP to ensure encryption. - Implementing salted password hashes. - Leveraging multi-factor authentication for added security. - Considering the use of a password manager. - Strengthening the security of my email account, as it is often the gateway for password resets. - Vigilantly safeguarding physical access to my workstation, recognizing that unauthorized access can compromise stored passwords in web browsers.