Nowadays, passwords are an integral part of our daily lives as we need them for our accounts. In order to create an account on any website, you need to have a username and password. Your username is what you are recognised with on the website. Usernames are usually email addresses because they are unique and they are easy to remember, but passwords might be any combination chosen by the user. Your username can be viewed by other users, but your password cannot be viewed by them. If anyone manages to access your password on the website, in fact they have managed to access your identity on that website. But what are ways one can use to access someone’s password or hack passwords? In this article, I will explain all the methods that can be used for hacking passwords.
Methods to hack passwords
A hacker can implement a number of different methods to access someone’s personal data. Guessing the password, getting the password from the victim, attacking the victim’s computer and using password hacker apps are among the most common methods that a hacker might use to hack passwords. Before we talk about all the methods which are used for hacking passwords, we first need to know some basics.
How passwords are saved
Passwords are not saved the way that we type them. In fact, if a system saves a password exactly the way that the user types it, it considers to be a security flaw for that system. All the passwords on any system must be stored in the form of hash codes. Hash codes are a type of one-way encryption which creates only one output for every input. The most common protocols used for this encryption are MD5 or SHA.
On Windows, passwords are stored in a file named SAM and in the form of hash codes. In Linux, passwords are saved in etc/shadow and you need to have admin rights to access that folder. Hackers try to access the password folder by creating admin rights.
Different types of attacks to hack passwords
Generally, there are four types of attacks that hackers might use to access someone’s passwords and the most famous one is the brute force attack. These methods attack the files where passwords are saved or tries to implement several techniques to guess the password.
Dictionary attack is the simplest and fastest attack which can be used to hack passwords. It is called a dictionary attack because it uses a directory of words and numbers to start the attack. As you know, one of the most common passwords is 123456. There are other phrases and words which are common as well and a great number of people use them as their password. The chances that people use these common phrases as their passwords are very high and the Dictionary attack uses this weakness to crack a password. This attack examines the most common combinations for passwords and tries to guess the password.
In order to prevent a dictionary attack, many websites only allow users to choose a safe password which is a combination of upper case and lower case letters, numbers, and symbols. By choosing a reliable password, the chances that the hacker manages to hack passwords with a dictionary attack are very low.
As I mentioned earlier, there is a location on operating systems where passwords are stored in form of hash codes. This means that if you manage to access the file some how, all you will find is hash codes. One way to access passwords from hash codes is to change all the passwords to hash codes and compare them with the available codes. The difference between this type of attack and the previous one is that the rainbow table method is more time consuming.
Brute force attack
One of the most time consuming methods to hack passwords is the brute force attack. In this method, hacker tries all the possible combinations to finally find the password. The brute force attack is among the last options that a hacker might use to hack passwords because it is very difficult and time consuming.
This method is much similar to dictionary method. The difference is that it tries passwords which contains symbols as well. For example, if this method tries (password), it will try (P@$$w0rd123) as well. This means that all the possible combinations will be tried.
This post is also available in: العربية (Arabic)