Let’s have a bit of fun with password cracking (can’t wait, uh?). In one of my last projects I have to deal with hashcat to crack hashed passwords but, most important, I had to understand how a good Open Source INTelligence (OSINT for friends) activity can make a significant difference in this activity.

First step: thanks to a cool Python script designed by my good friend Zstaigah, we’ve generated 1000 fake profiles with relative passwords hashed with the SHA-512 algorithm. Then, using a tool called PassGPT we’ve obtained a first wordlist to try to crack the passwords. In this screenshot you can see the results:

first-hashcat

So, basically just 12 passwords were discovered. Promising, but yet non satisfactory.

Second step: we’ve decided to include rockyou, a list of over 14 million plaintext passwords from the 2009 RockYou hack (more info on this here). But…

second-hashcat

Another pass bites the dust.

Third step: at this point we’ve used a wordlist based on the personal information of the profiles and…

third-hashcat

BANG! All passwords cracked. So, what can we learn from this?

  1. Ensure your password are a robust mix of randomness and length
  2. Passwords alone are not sufficient; always utilize Multi-Factor Authentication (MFA) to secure your accounts, especially for sensitive corporate information. Always remember: don’t be the weak link that could lead to significant security setback.