Password cracking concepts in a lab: length beats complexity

// Introduction

When it comes to password security, the debate between length and complexity often leads to polarizing opinions. In a controlled lab environment, you can empirically demonstrate why longer passwords generally outperform complex ones in terms of cracking resistance. This article will guide you through setting up a lab to explore this phenomenon.

// Setting Up Your Lab

To perform this experiment, you’ll need a disposable lab range where you can run password cracking tools without repercussions. If you haven’t set one up yet, refer to our Building a disposable lab range for practicing network attacks.

Tools Required

• Hashcat: A robust password recovery tool.
• John the Ripper: An open-source password cracking software.
• A variety of password hashes to work with.
• A machine capable of running these tools, ideally with a decent GPU.

// Creating Your Test Passwords

For your lab, create a set of passwords with varying lengths and complexities. Here’s a simple Bash script to generate a sample password list:

#!/bin/bash

for i in {1..5}; do
  for j in {1..9}; do
    echo $(tr -dc 'A-Za-z0-9' < /dev/urandom | head -c $j)
  done
done > passwords.txt

This will generate random alphanumeric passwords of lengths 1 to 9 and save them to passwords.txt.

Password List Sample

Your passwords.txt may look something like this:

A
AB
ABC
ABCD
ABCDE
123456789
1qaz2wsx
password123
12345678

// Hashing the Passwords

Next, you need to hash these passwords using a suitable algorithm. For demonstration, let's use SHA-256:

while read -r password; do
  echo -n "$password" | sha256sum | awk '{print $1}'
done < passwords.txt > hashes.txt

This will create a file hashes.txt containing the SHA-256 hashes of your generated passwords. Keep the original passwords handy, as you’ll need them for comparison later.

// Cracking the Passwords

Using Hashcat

To test the passwords against Hashcat, use the following command:

hashcat -m 140 -a 0 hashes.txt passwords.txt

• -m 140: Specifies the hash type (SHA-256).
• -a 0: Sets the attack mode to dictionary.

Observing the Results

After running the command, Hashcat will begin processing. You can monitor its progress and see how many passwords are cracked using:

hashcat -m 140 -a 0 --session=my_session hashes.txt passwords.txt
hashcat -s 0 --show --session=my_session

Using John the Ripper

Alternatively, you can use John the Ripper for comparison:

john --format=raw-sha256 hashes.txt --wordlist=passwords.txt

// Analyzing the Findings

As you run these commands, pay attention to:

• The number of passwords cracked in a given time frame.
• The length versus complexity of the cracked passwords.

You’ll likely find that shorter, simple passwords are cracked much faster compared to longer but seemingly complex ones, particularly when the complexity does not significantly increase entropy.

Mistakes to Avoid

• Inadequate password variety: Ensure your generated passwords cover a range of lengths and patterns.
• Not using a proper hashing algorithm: Stick to established algorithms like SHA-256 for more realistic scenarios.

// Defensive Implications

The experiment illustrates a critical takeaway: systems relying solely on complex passwords may overlook the importance of length. Users often gravitate towards shorter, memorable passwords when complexity is prioritized. Security policies should enforce minimum length requirements alongside complexity rules.

Recommendations

• Set a minimum length for passwords (e.g., 12 characters).
• Encourage users to create passphrases rather than complex strings.
• Regularly audit password policies and adjust based on findings from testing.

// Conclusion

Understanding the password cracking landscape is essential for implementing effective security measures. The results from this lab experiment demonstrate that while complexity has its place, password length can be a more reliable defense. As always, conduct this research within a lab environment you control. The DaemonCore Academy curriculum offers more resources to enhance your skills in this area, completely free. Take these insights and apply them to your security strategies.