Hacking Complex Passwords with Rules & Munging
Source: YouTube · John Hammond · published May 8, 2023 · 16:57
This video demonstrates how to crack complex password hashes by generating targeted wordlists based on a user's interests (e.g., Marvel) and utilizing mutation rules or standalone munging tools to account for character substitutions 14:42-14:48.
Key Takeaways:
• Targeted Wordlists: Tools like CeWL scrape websites relevant to the target (e.g., marvel.com) to create custom wordlists, moving beyond generic dictionaries like rockyou.txt 1:53-2:06.
• List Refinement: Raw scraped lists can be filtered (e.g., using ChatGPT) to remove common English words, making the list more relevant and manageable 3:40-3:47.
• Advanced Rulesets: Password crackers like John the Ripper utilize complex rulesets like "One Rule to Rule Them All" to mutate words (leet speak, case changes) and defeat simple obfuscation 6:02-6:07.
• Pre-Munging: Tools like the "Munge" Python script pre-generate mutated versions of dictionary words (adding numbers, symbols) before feeding them into the cracking engine 11:38-11:44.
• Successful Crack: Combining a targeted Marvel wordlist, pre-munging, and advanced rules successfully cracks the complex password "G@l@xy77" 14:42-14:46.
The video concludes by warning against pattern-based passwords and recommending the use of password managers like Passbolt for robust security 9:22-9:27.
Sources:
Generate CPE Credits
Generate a professional CPE document from this video's transcript.
Estimated credit: 0.5 CPE hours
Estimate uses the video runtime (1 hour ≈ 1 CPE, rounded to the nearest 0.5, minimum 0.5, maximum 2.0). The final amount can be lower after review, never higher.
Topic: Penetration Testing. Commonly maps to: Security Assessment and Testing, Security Operations. Exact CISSP domains are assigned during generation.
Free account. One generation at a time, with a daily limit.
CPEBuddy is independent and not affiliated with or endorsed by ISC2, ISACA, or any certification body. Exports are formatted for common CPE submissions; acceptance is at your certification body's discretion.
Transcript Preview
First 800 characters of the transcript
in a previous video we took a look at how we could crack password hashes inside of C Linux with tools like John the Ripper or hashcat and we took the assumption that the victim the Target that we're trying to crack the password hashes for would use a simple easy like English dictionary word something that you might see like apple or microphone or Western it could be anything just a simple word and we were using things like rock you. text to be able to crack those through a list of dictionary words but most people are at least a little bit smarter than that they might add in some numbers within their password or some special characters like an exclamation point asterisk whatever so in this video we're going to take that example a little bit further assuming that the user is using a relative…