The problem lies with the ever increasing abilities of computers to process larger amounts of data in a smaller amount of time. A password is just a string of characters, typically only keyboard characters, which a person must remember and type into a computer terminal when required....
Have a laptop, or a wireless internet card in your PC? Have you ever been in the position that where you lost your WEP / WPA key, and you interested on retrieving it back? Well with Aircrack you can.
Security issues with the online PC PlayStation Store may have allowed the unauthorized access of personal account information, Sony Computer Entertainment announced on the official UK and US PlayStation sites....
A study conducted recently has found that nearly 50 per cent of Wi-Fi networks could be hacked. The study conducted in six cities and derived that out of 40,000 Wi-Fi network nearly 20,000 did not have passwords assigned to them....
There are two ways to configure an ADSL modem for broadband connection. One in PPPoE (Point to Point Protocol over Ethernet) and the another is Bridge mode.
PPPoE Mode........
Scapy is a powerful interactive packet manipulation program. It is able to forge or decode packets of a wide number of protocols, send them on the wire, capture them, match requests and replies, and much more. It can easily handle most classical tasks like scanning, tracerouting, probing, unit tests, attacks or network discovery (it can replace hping, 85% of nmap, arpspoof, arp-sk, arping, tcpdump, tethereal, p0f, etc.). It also performs very well at a lot of other specific tasks that most other tools can’t handle, like sending invalid frames, injecting your own 802.11 frames, combining technics (VLAN hopping+ARP cache poisoning, VOIP decoding on WEP encrypted channel, …), etc.
What makes Scapy different from most other networking tools
First, with most other tools, you won’t build someting the author did not imagine. These tools have been built for a specific goal and can’t deviate much from it. For example, an ARP cache poisoning program won’t let you use double 802.1q encapsulation. Or try to find a program that can send, say, an ICMP packet with padding (I said padding, not payload, see?). In fact, each time you have a new need, you have to build a new tool. {......}
Ever seen the movie gone in 60 seconds? Well in the same way it is easy to steal a car, it is just as easy to steal passwords off a corporate network. Since the vast majority of corporate networks run Microsoft software such as Windows, it makes the task easy. Most enterprises are slow to upgrade even in situations where Microsoft told them to upgrade to Active Directory and that they will no longer be supported. Their lack of aggressiveness turns into an opportunity for those who want to crack a network in 60 seconds.
Lets look at the fastest way this can be accomplished...
Let me stand on my soapbox for a moment. If you are still running Windows NT and are a network administrator and/or responsible for IT security, go to your boss and ask him/her to fire you immediately!
The best way to attack a Windows network is to get hold of the Windows SAM file. The SAM file holds username, user ID (SID) and hashed passwords for all users. Once you have gotten a copy, you can use tools such as l0phtCrack and Cain & Abel. These tools can crack passwords in about eight hours. While not sixty seconds it is sufficient for most needs.
I have to keep my promise of telling you how to do it in sixty seconds though. In order to understand how it will be accomplished, you need to understand a little about how the SAM file is protected. First of all, the hashing routine used by SAM is based on the DES algorithm. Essentially, a 32 byte hash is generated from the password as follows:
Convert the password to uppercase
Truncate the password to 14 characters. If shorter then pad
Split the password into two 7 character halves and generate two 16 byte hashes using DES algorithm
Concatenate the two 16 byte hashes to form the 32 byte hash
If you understood the above steps, you would realize that cracking is reduced to cracking on or possibly two 7 character passwords without regard to case. This makes the number of combinations incredibly small.
To make the problem space even smaller, there are two different approaches one can use. The first is a dictionary-based approach where weak passwords are defined as any dictionary word or lame permutation of a dictionary word such as "password9". Precomputed hashes can be compared since the vast majority of users will use real words in their passwords instead of random character sequences (Security folks don't think for a second that changing your security policy is the answer). Secondarily, if you are on a non-switched network, a clever individual can use NetMon to sniffer the hashes off the wire.
Using this technique on a Pentium 4 3.2 Ghz machine (I have a Gateway), it takes 10 seconds to load the dictionary into memory but less than one second to actually crack the password. Subsequent runs will also take less than one second!
If you want to make it more difficult to perform this type of attack on your network, please see the following Microsoft Knowledge base articles.
Local Security Policy - 147706
Disabling hashing - 299656
Group policy enforcement of strong passwords - 225230
© Blogger template Webnolia by Ourblogtemplates.com 2009
Back to TOP
