How to cracking passwords without salt

Assignment Help Computer Network Security
Reference no: EM13326727

Problem 1: Cracking Passwords without Salt.  Insecuratics has just started a webmail service and has decided to store the hashes of user passwords in their database. Specifcally, when a user enters a password, it is hashed once using the SHA-1 hash function and compared to the hash value stored in the database. If the values match, the user is allowed access. No salting is used. Unfortunately, a hacker recently gained access to the database and posted some of the hashed passwords online. Use the file sha1hashes-sp13.txt containing hashes for 12 passwords. See how many you can crack. Put your answers and a detailed explanation of what you did to nd them in a textfile called prob1.txt. If you use any scripts,you must also attach those scripts. You will get 1 point for each password that you crack, with a maximum of 10 points possible. Important: you cannot just supply the passwords; you will not receive credit unless you provide explanations and any scripts you use.

Problem 2: Cracking Passwords with Salt on Linux.  Recently, an associate of yours got access to an Ubuntu Linux server. You  suspect users of this system (UST students) have a strong tendency to use the same passwords for everything (including their online banking). Thus, if you can crack their login passwords, then you can probably also steal money from their bank accounts. Because your  associate had physical access, he was easily able to obtain the /etc/shadow file. The file, renamed to shadow-sp13.txt, is available to you. Your task is to crack as many of the passwords as you can. Submit a file prob2.txt with the username, the cracked passwords, and a detailed explanation of how you found the passwords. Additionally, you should attach any scripts you used. You can use any means to find the passwords (other than copying from other students/groups). Each cracked password is worth one point, with a max of ten points possible. You will want to use the mkpasswd program and likely will want to use a bash script. Important: as in Problem 1, you need to explain how you cracked the passwords and attach any scripts you used to receive credit.

Problem 3: Timing Attacks and Password Entry. Your professor has posted (provided you with) an executable file badpass-sp13 that, when run, asks for a password. There is one correct eight character password consisting of all numbers (0 through 9). It is your job to find the password. To do this, you'll have to exploit the fact that the program is vulnerable to a timing attack. Professor Yilek is not releasing the C source code used to generate badpass, but he has revealed that the password checking routine looks something like this:

while (more characters to check)
{

if (next character of guess != next character of password)
{
break;
}
do some other stuff
}

You should submit a file prob3.txt with the password and a description of what you did to find it.

Problem 4: Bad Random Number Generation.  Instead of using bits from /dev/random or even /dev/urandom, the good people at Insecuratics have invented their own ways of generating random bit strings for use in cryptographic tools. To generate an AES key and IV to be used in aes-128-cbc, they are proposing two methods. You should break each method. You should submit a text file prob4.txt with your answers and also descriptions of the methods you used. You must also attach any bash scripts you write to solve the problem.

4.1. (Hash Process IDs.) To generate the key,

$ ps | grep "ps" | awk '{print $1,1}' | openssl dgst -sha256 -hex | head -c 32

and to generate the IV,

$ ps | grep "ps" | awk '{print $1,2}' | openssl dgst -sha256 -hex | head -c 32

Download the ciphertext prob4pidenc.txt encrypted with this method. The IV that resulted from the above was  b9a907f715e45cfe5d47b08662affa17. Your job is to find the key and the famous book the plaintext is from. You may want to read about awk, as well as Unix process IDs (PIDs). Specifically, you'll want to learn what values PIDs can take on. As stated above, put your answer and a detailed description of what you did in a file prob4.txt.

4.2. (Hash result of date command.) To generate the key,

$ date | openssl dgst -sha256 -hex | head -c 32

and then repeat immediately to generate the IV. Download the ciphertext prob4dateenc.txt encrypted with this method. The IV that resulted from the above was d0ce6f467761cabc11eae59a2f34a8a1.Your job is to find the key and the famous book the plaintext comes from. As above, put your answer and a description of your method in a file prob4.txt .

Hint: Just from the above information it should be possible to break the encryption in a reasonable amount of time. However, you can break it even faster by taking into account that for both methods Professor Yilek started up the the class Debian image and generated the key and IV soon after. It might also be useful to know that he usually works on creating assignments in the evenings on the last couple of days before posting the assignment. Also, check out the -d option of date.

Reference no: EM13326727

Write two command-line sockets programs

Write two command-line sockets programs – a client and a server – as follows. Define a Who-Am-I message as a UDP datagram containing the ASCII string “WHO AM I”

Strategies for developing secure software

You want to convince your software development manager that the team needs to include strategies for developing secure software. Your first step is to help your manager unders

Cracking password management protocols

Identify and describe any obstacles, and explain your solutions for them. Given the access policy, evaluate whether or not Extensible Access Control Markup Language (XACML)

Designate an appropriate class type for this attack

Designate an appropriate class type for this attack. Annotate your rules with comments describing what each component of the rule does, so other security specialists in your

Security domains of a typical it infrastructure

Analyze the seven security domains of a typical IT infrastructure and determine which two of the seven you would implement first for a nationwide bank. Explain your rational

Most difficult type of cyber attack to defend against

Consider how this information could be used by an organization for its security program. Was anything surprising to you - Post a message to the forum regarding your experience

Network design and analysis

You have been asked to design a Banking Network with two primary types of locations: a Branch location and a Campus location. The bank has a total of 2,220 branch locations an

Symmetric encryption algorithms

block cipher and a stream cipher, Caesar cipher, cryptanalytic attacks, mono alphabetic cipher and a poly alphabetic cipher, Mix Columns, Add Round key, PGP services, traffi

Reviews

Write a Review

 
Free Assignment Quote

Assured A++ Grade

Get guaranteed satisfaction & time on delivery in every assignment order you paid with us! We ensure premium quality solution document along with free turntin report!

All rights reserved! Copyrights ©2019-2020 ExpertsMind IT Educational Pvt Ltd