Dictionary attack

From TheAlmightyGuru
Revision as of 11:30, 16 October 2017 by TheAlmightyGuru (talk | contribs)
Jump to: navigation, search

A dictionary attack is form of lookup attack used to crack passwords even when the passwords have been obscured with a hash function. The attack is conducted by first obtaining the hashed passwords, then comparing them against the hashes in a dictionary (a table of popular passwords that have already been hashed using the same function). For example, in the table below, some commonly used passwords have been sent through an MD5 hash function. The result is a long string of hexadecimal values that cannot be reversed back to their original passwords. However, even though they can't be reversed, it's still possible to determine what they are by running your own hash and comparing the results.

Password MD5 Hash
abc123 E99A18C428CB38D5F260853678922E03
admin 21232F297A57A5A743894A0E4A801FC3
god A4757D7419FF3B48E92E90596F0E7548
password 5F4DCC3B5AA765D61D8327DEB882CF99
password1 7C6A180B36896A0A8C02787EEAFB0E4C
secret 5EBE2294ECD0E0F08EAB7690D2A6EE69

Note that MD5 is not a cryptographically secure hash function and should never be used to store password.

Dictionary attacks are made more difficult to use if the hash function employs a salt value, but the if the salt value is discovered, the dictionary can be regenerated with the same salt.