I downloaded (and paid for) John the Ripper without knowing that I needed a basically college-level education in order to use it. Hey guys, I made a post on here a couple of weeks ago asking for help to brute force this DMG on my high school laptop. We teach you how to do it, use it at your own risk. - See upcoming events and writeups from past CTFs.
- Privilege escalation over SSH, web exploitation.- Learn-as-you-go web exploitation game made by a redditor.- Interactive privilege escalation with browser-based bash shells (and much more).The whole idea is that a password which is sufficiently random (more correctly, a password which is generated from a sufficiently random process) will bring the probability of an attacker getting lucky sufficiently low to be neglected (if the attacker has only one chance in 14 millions to get the password within one week of computations, then you can even out the chances by buying a lottery ticket, which has one chance in 14 millions to make you rich enough to ignore those trivial matters of stolen passwords). For any given password, you can only reason on averages and pray for the best. The strength of a password is a property of how you generate it, not of the password itself. Or, said otherwise: no, John the Ripper is NOT the much fabled "password meter" which will give an absolute "strength value" to your password. Sometimes the attacker was faster sometimes he was slower. This means that if you generate one million such passwords, and each time get the attacker to crack the chosen password, and then sum up all the times taken and divide by one million, then you will find that average times. If your password is chosen "at random" (uniformly) in a set of N possible passwords, then the average attack time will be the time it takes to compute N/2 hashes (with whatever hash function is used in your specific situation). John the Ripper will use the provided word list, and then try "variants" of the said words, in some order which may or may not be representative of what an attacker will do. The attacker will try a lot of passwords, and may be lucky. The important thing to understand is that password cracking time is an average.
0 kommentar(er)
