Password is one of the basic mechanism used for authenticating a user into a system. During our information gathering and enumeration phase, we may come across various services running on the target which are password-protected such as SSH, FTP, and so on. In order to gain access to these services, we will want to crack passwords using some of the following techniques:
- Dictionary attack: In a dictionary attack, we feed the password cracker a file with a large number of words. The password cracker then tries all the words from the supplied file as probable passwords on the target system. If matched, we are presented with the correct password. In Kali Linux, there are several word-lists which can be used for password cracking. These word-lists are located in /usr/share/wordlists as shown in the following image:
- Brute-force attack: If password isn't any of the words from the word-list we provided, then we might have to launch a brute-force attack. In a brute-force attack, we first specify the minimum length, maximum length, and a custom character set. The password cracker then tries all permutations and combinations formed out of this character set as a probable password on the target. However, this process is resource and time-consuming.
- Rainbow tables: A password is never stored on a system in plain-text format. It is always hashed using some kind of algorithm in order to make it unreadable. Rainbow tables have pre-computed hashes for passwords within the given character-set. If we have password hashes from the target system then we could feed them to the rainbow tables. The rainbow tables will try for a possible match in their existing hash tables. This method works very fast as compared to brute-force but requires a huge amount of computing resources and storage space to store the rainbow tables. Also, the rainbow tables get defeated if the password hashes are stored with a salt.