Collaborate Disseminate
I have take a zip file from NFS port using sudo mount -t nfs 192.168.1.105/backup /tmp/kevgir .
After that, I got backup.tar.bz2.zip file in /tmp/kevgir directory. I crack the zip file using fcrackzip tool, but I also wanted to crack it us… Continue reading Problem in using zip2john tool to take hash values [migrated]
I’m currently learning about password cracking, and I have a set of passwords with their respective hash values. I used Hashcat to crack the hash values, just to see how it works, but I got different passwords. After some research, I found… Continue reading How can I identify the salt value used in a password hash?
Is it possible to generate a file with a given sha256sum checksum?
That is, reverse the process of a sha256sum checksum. That is, if we have a checksum, can we generate txt file data (need not be original) whose its checksum is equal to th… Continue reading Is it possible to generate a file with a given sha256sum checksum?
Today, on an official government website, I came across the following password rules:
"Your password has to be at least 8 characters long. It can’t have any blank spaces. It has to use characters from at least three of the following s… Continue reading Reasoning behind banning ‘#’ from the start of passwords? [duplicate]
For a while I’ve been pondering a user authentication protocol that aims to ensure that a client does some computational work before the server will attempt to authenticate the password.
The reason for this is to remove some of the asymmet… Continue reading Using Proof of Work to slow down login attempts
Given the following argon2 hash
$argon2id$v=19$m=65536,t=32,p=8$mJmKA5qamzXOPJZYw4wCEUKY$COkMH0RckaZ/3bhYCdCQjLuzoLKxcAmk4TzmHRRgTQ8
How should the hash be stored in a database? From the answers of this question it says you shouldn’t store… Continue reading How should an argon2 hash be stored? [duplicate]
How do websites check that password hashes saved in the database are the same as passwords hashed and sent by a client?
I know that client-side hashing is not secure.
While Argon2 seems to be recommended for password hashing, based on this twit Argon2 is worse than bcrypt at runtimes < 1000 ms.
Based on this answer:
You should tweak the parameters to your own use-case and performance
requirements, b… Continue reading Argon2 is worse than bcrypt at runtimes < 1000 ms? [duplicate]
Typically for user passwords we store their hashes and salt alongside in the database – one per user.
I wonder the security implications of hashing the same password twice and storing locally both.
hash(pwd, salt1) # => $digest1$salt1
… Continue reading Storing two hashes of same password?
I want to store a password hash in plain sight. If I am using a dictionary to crack an Argon2 hashed password that I am storing in plain sight, how long would it take (assuming my password is reasonably complex)? Further, are there any oth… Continue reading How long would it take to crack hashed password stored in plain sight?