In this article, I will explain what password hashing is and how to crack different types of hashes.
Password hashing is a process of using a hash function to convert a password into an unrecognizable series of characters like “1a1dc91c907325c69271ddf0c944bc72”.
This makes it difficult for malicious actors to gain access to the password, as the characters are not readable. Even if a hacker gets access to the database, he will not be able to see the passwords in clear text.
Now if passwords are kept in clear text, anyone with internal access can see them. Not to mention that if the database gets breached, hackers would also see the credentials in plain/clear text.
Storing in clear text means you’re directly tying your user’s identity to their password in a readable data format, as seen in the image below:
If a hacker is able to break into the server, he will have access to all of the passwords. With this information, bad actors can take these login credentials and use them across websites other than your own.
There’s no doubt that password hashing compared to plain/clear text is an improvement in security.
If a hacker gets access to the hashed passwords, he won’t be able to use them because they’re encrypted using different hashing algorithms.
There are many hashing algorithms like MD5, SHA1, SHA256, and so on. For this example, I will generate a hash with the MD5 algorithm for the password “letmein123” using an online tool.
4ca7c5c27c2314eecc71f67501abb724
Here is the MD5 hash for “letmein123”. This is how the password will look like in a database server instead of “letmein123”.
Similarly, I will generate another hash for “letmein123”. This time I will use the SHA256 algorithm.
9b0eb22aef89516d6fb4b31ccf008a68abe0d10a3fc606316389613eccf96854
And you can see the SHA256 hash for the password “letmein123”.
Crack the Hashes
The biggest problem with password hashing is that if you run a specific word like “letmein123” through a hashing algorithm, the hashed outcome for that word will always be the same.
So, hashes can be reversed using methods such as dictionary attacks which compares the given hash to the hashes of common words from a dictionary file. Now let’s see how to crack the hashes. To do that I will use a site called “crackstation.net”.
Here I will put both hashes, the MD5 and SHA256, then click “Crack Hashes”.
And you can see the hashes have been successfully cracked.
Conclusion
You can crack the hash if the password is short in length. To protect your password, use long words with digits and special characters, store them in a password manager, and don’t use the same password on different accounts.
Tags: ethical hacking, cybersecurity, penetration testing, web hacking, network security, wifi hacking, linux security, hacking basics.