DEMO: Brute-Force Password Cracking

We're going to talk about brute force attacks and how we brute force attack a password. I've created this video only for educational and hacking purposes only. Please only use this to protect systems, not to compromise them.

What a brute force attack is

Brute force attacks are just trial and error. That is, we're just trying a bunch of things, but we're trying them systematically. So we're systematically guessing passwords. In other words, we start with a zero and then we try a one and then a two and a three and so on and so forth. And we keep trying until we get to two characters, and then we keep trying until we get to three characters. So we keep trying all these combinations systematically.

So let's say I'm trying to hack an account. I'm trying to hack Techno DJ's account here on this bruteforce.htm page here. So what I'm going to do is I'm going to just start out with a zero and try that. And when I don't get it, then I'm going to try a one and try that out. And I'm just going to keep going down the line trying every single combination. When I run out of single digits, I'll move on to double digits and triple digits and so on and so forth.

But we're not always trying to hack a website. Sometimes we have a file with usernames and passwords, and remember, these passwords right here have some sort of hashed value to them. So how do we hack a hashed value?

The cracking program

I created a brute force cracking program. So let's take a look at the program first. It's going to try all numbers, it's going to try all lowercase letters and all uppercase letters. What it'll do is it'll bring in a hash value. So the input will be a hash value, and then this will work up to five characters. So it'll check this hash that it brings in and look for the password for that hash. So that's what this program does. And then at the end, it'll actually spit out the elapsed time, so we can see how long it took.

First of all, I need a hash that I'm going to crack. So I'm going to do echo, and we're just going to use the password of a. So I'll do a, and we're going to pipe that into the MD5 sum. And now we're going to create an MD5 hash out of this. So I'm going to hit enter. And there's the MD5 hash for the password a.

Now we're going to pump this into our program. So we've got to run our program. We're going to do bash and brute force.sh. And this is going to be what we're piping into it, or going to use as the variable. So I'm going to copy this and we're going to paste it here, and then hit enter. And so now you see it checks it all. It took one second to do, and it came up with, well, the hash is of a. And what you see is that it's just trying every single hash. So it starts out with 0, 1, 2, 3, 4, 5, 6 and so on and so forth, and then figures out, oh well, here's the hash. So a is the hash for that.

Let's try one more. In this case I'm going to do a a, so we'll do a a, and then this is the MD5 hash for the password aa. So now I'm going to run that same program again, but instead of that hash, we'll paste in our new hash here and hit enter. And it's running through it. You can see all of the combinations it is trying. It just keeps counting up. It's on the two digits now, the two-digit range, until it finds — well, there we go, we've found it. Now it's the double capital A there. So it took 18 seconds to find that.

Rainbow tables and salting

Now, if we were to store the hash of just the password, the problem is that then it would be susceptible to rainbow tables. That is, let's say we have a hash in here. We could generate this rainbow table for that and then be able to look it up and figure out what the password is. So what we have to do is we have to do salting. We add a bit of salt to this password, and that will change the hash. And therefore, since every salt is different, we no longer can create just a single rainbow table to be able to interpret the passwords here. Now instead, we're going to have to check and figure out each password separately because of that salt value.

So the problem that we have with this program right here is it's just checking the hash of the password. Just the password. It doesn't take into account any kind of salt. So I've got another program that we're going to take a look at. So we'll take a look at the second program. It's brute force 2.sh, and see what it looks like. This program is pretty much the same thing, but it takes in one other piece of information, the salt value. So it takes in the salt value, and then it adds the salt value to the beginning of the password that it's testing out, and it's just going to reiterate through that. So it's going to check the same salt value with a lot of different password variations to try to come up with the MD5 hash that's going to match the one that we give it.

So let's generate a new hash value. What we're going to do is we're going to echo, and in this case we'll do dash N. But what we're going to do is we're going to do a salt value. So maybe it's just some sort of random salt value. So QN4 maybe is the salt value. So QN4, and then our password. So we're just taking the salt and we're adding it to the beginning of the password. And so maybe the password is just capital A — actually, let's do capital A capital A. So A A is going to be our password. And then what we're going to do is we're going to pipe that into our MD5 sum and hit enter. And then here is the hash of both the salt value and the password together.

Now what we're going to do is we're going to run that second bash file. So that is bash, and then we're going to do brute force 2 this time.sh, and then we are going to paste this hash into here. So I'm going to copy this selection and we'll paste it here. So paste from clipboard, and then we'll hit enter with that. And what it's going to do — and it is asking for the salt. I did forget to add that variable in there. So we're going to add the salt at the beginning of this. And the salt is QN4. So we'll add QN4 to the beginning of this, and hit enter. And then it runs through this. So it'll run through it, and you can see that it's doing the brute force by counting up until we get to that capital A capital A, and it's doing it by adding the QN4 to everything it's testing. So it's adding this QN4 to the beginning of each one of these here. And there you have it. It added it to it, and it found the password, and the password is A A.

So now what we've just done is we've shown how to hack these passwords, even though there's a salt value to it. It makes a rainbow table, which would go a lot faster with cracking a bunch of passwords that we have. But since we don't have that, since there's a salt added to this, then we are having to brute force attack this password.

It's not always as simple as just adding the salt to the beginning of the password. We could add it to the end of the password, or somewhere in between the password, or perhaps we do something different to that entirely based off of what hashing algorithm we're using. So just realize that that's not how all salting works, where we add it to the very beginning, but it's a good example of how a salt can drastically change what our output is going to be for this — the output side of this, which would be the hash value, how the hash value changes with it.

Password length

To combat a brute force attack, it really has to deal with the password length. Let's see what that looks like. Let's say we have 75 different possibilities that we could have. That would be all lowercase a through z, and that would be 26 letters of the alphabet. Now we add another 26 for capital letters. Now we've got 52 different characters we could use for each position that we have. Now let's say that we are adding 0 through 9 to that. Now we're at 62. Then we add some special characters to it. So now we're going to end up around 75 different characters that we have for each position.

If we just have one position, that would be 75 to the first power. And so that equates to 75, which makes sense: we go through all characters to find if there's a match to it. Now, if we have two, 75 to the second power, so we have two positions there, a two-character password — now there's over 5,000 possibilities there. Now we add another position to it, another character to it, now we have 421,000. We add another one. So these exponentially get larger to a crazy amount. And so now when we start getting into these bigger numbers, it takes longer for our password to try to crack that password.

We saw how this took 19 seconds to crack. When it was one character, it just took 1 second, and now this takes 19 seconds to crack. Let's see what happens if we have a longer password. Let's add another character to this. So we're going to do triple A with this. And this is not even towards the end of what it's going to test. So let's figure out what the hash value is of that. And then what we'll do is we will do a bash brute force 2.sh, QN4 is our salt for this — we're using the same salt — and then we will have this hash right here. So let's copy this hash and paste it here and hit enter. And now it's going to go through and check all of that, and we're going to see the timing it takes to check three characters. It was 1 second for one character, 19 seconds for the two-character password. Now let's take a look and see what the three-character password is going to look like.

All right, it's been running quite a while and we're coming up on our password. And there it is. It found it. So it's 1,071 seconds to find that. That's almost 18 minutes that it took when we added one more character. So we went from just 19 seconds to almost 18 minutes to be able to calculate this. So that's quite a drastic difference. You can see the password length is very critical on how secure your password is.

So brute force attacks are really not all that common anymore, because we are requiring our users to have stronger passwords. At the time of this recording, the recommendation is around 12. I usually try to at least get 16 characters in there, and that makes it so it's not susceptible to these brute force attacks and just makes them not really effective at all.

Brute force versus related attacks

There is something I need to bring to your attention. What we're covering here is the brute force attack and what the brute force attack looks like. We'll also be taking a look at a mask attack, and what a dictionary attack is, and a spraying attack. These are all different types of attacks. So what we're doing with the brute force attack is we're starting at zero and working our way all the way up. So we're just trying every combination with this brute force attack.

There is some confusion out there, and that is: the brute force attack is systematically trying every single type of combination till it finds the right password. And so that's the brute force attack. But when you take a look at a mask attack, what you're doing is you're trying all sorts of combinations, but you're specifying some parameters around it. And so it's a little more specific than a brute force attack, but you are trying a bunch of different passwords to it. Also, a dictionary attack — you're trying a lot of different dictionary words, and so you're systematically trying a bunch of stuff. And so these kind of look like types of brute force attacks. There's something there different, but they also look like they're a variation of the brute force attack.

Because of this, I've seen brute force listed out separately from mask attack, dictionary attack, password spraying, but I've also seen it as being a category of these types of attacks. I've even seen the same article reference that this brute force attack is different, and specifically define it as starting at zero and working your way up all the way till you find the right password, and also that it is a category with these different subcategories as part of it, or subtypes of attacks as part of it. And I've heard it called categories, I've heard it called types, I've heard it called hybrids where you're doing a brute force mask attack. Really, for the purpose that we are doing, we're defining them as separate — brute force as being its own thing, that it's not a hybrid, and that a mask attack is going to be something separate. But you could encounter times when a mask attack is categorized as a type of brute force attack.

The attack card

So here's the attack card on the brute force attack, and I've put on here "password," because there are other types of brute force attacks as well. We're specifically talking about passwords, and usually that's the context, at least within cybersecurity, that it's going to be referring to.

So what we have here is we're just trying to guess a bunch of passwords, and we're doing that systematically. We are probably best off starting with a minimum number of characters. If we know that the system requires at least eight characters, then that's where we would start out, because it takes a lot of time just getting up to those eight characters. So why waste computational power if it's just not something that the system is going to accept anyways? And there is usually a max amount of characters that we can test because of computational power — there's limitations in our systems.

So the easy way to get over brute force attacks is just by having longer passwords. And it also could be considered a category of types of password attacks. And what are we doing with this? We're just starting at something and we're counting up and systematically just pretty much trying everything with this.