RE: Display User Password?

[CWilt@xxxxxxxxxxxx]

Dan,

The cracking program they appear to be talking about requires a copy of the
file with the encrypted passwords.

The cracking program simply encrypts each guess and compares it to the
encrypted passwords in the file.  If there is a match, it spits out the
plain text.

Charles



> -----Original Message-----
> From: Dan Bale [mailto:dbale@xxxxxxxxxxxxx]
> Sent: Wednesday, September 29, 2004 9:05 AM
> To: Midrange Systems Technical Discussion
> Subject: RE: Display User Password?
> 
> 
> > So a prerequisite is that you need to be able to know when 
> the correct
> > answer is discovered.  To do that offline (e.g., with the 
> program Phil
> > and I are talking about), you need the encrypted version of the
> > password and the program needs to know the correct encryption method
> > to use so it can compute a potential ciphertext and compare to the
> > desired ciphertext.
> 
> This is an interesting topic.  I know the horse has been 
> beaten before, but
> I've never understood the bruteforce method.  How does the 
> password cracker
> program *know* when it has found the "clear text" password?  
> How does it
> know that "WHNPIGSFLY" is correct and "$YEAHRIGHT" or 
> "eW_O7q&-8" or any
> other result is not?  Does not each permutation generate a 
> result, even if
> it's full of hex bytes we'd never be able to type?
> 
> db
>