Cracking a Password Hash

-ok first off i dont know if this should be in cryptography or not so don't flame me if this topic shouldn't be here-

I was wondering how Cracking Password hashes is done, if its fairly basic stuff, and where i might find a good tutorial on how to do this,,

thnx for the help

Any perticluar cipher? Or just any?

1. Take a list of passwords.
2. Encrypt them with the same algorothim (hash type) and salts (if needed) as the original hash
3. If they match, then the plaintext that hashed correctly is the password.

Cracking hashes can be done in two ways. But, just in case you din't know, I'll cover the basics of hashes.

The problem with cracking a hash is that they are one-way - that is, once you've encrypted your text, there is no way to decrypt the hash and get the plaintext back. I found this confusing at first, but it does make sense.

So, you cannot decrypt a hash. So you have to crack it.

Like I said, there are two ways to do this - dictionary attack and brute forcing.

A dictionary attack takes a wordlist, which can often be of a very large size. It then encrypts each of these words, and checks them against the hash. If the hashes match, voila! Cracked!

However, the hash may not be of an actual word. This is where brute-forcing comes in. Brute forcing starts by taking a single character, encrypting it, and checking the hash. If it does not match, it goes to the next character. It keeps doing this, changing and adding more characters, until it finds a match.

Obviously, dictionary is the quickest way, but sometimes brute-forcing is unavoidable. A great way to understand is to code your own cracking program, but if you can't do that, simply download John the Ripper or Cain and Abel. Both great cracking programs.

I hope this cleared it up for you.

thanks bobbyb,, oh and just so i know what are the types of hashes,, and just to clairify its absolutly impossible to crack a hash manually right?

whats a salt? ive heard it before, but i dont what one is

There are many types of hash, and the 3 most common ones (arguably) are md5, SHA and DES. Look 'em up with google's define: function.

As for salts, and more on cracking hashes, check this page out. http://en.wikipedia.org/wiki/Salt_(cryptography)