YubiKey-Guide
naive-hashcat
Our great sponsors
YubiKey-Guide | naive-hashcat | |
---|---|---|
112 | 16 | |
10,735 | 1,160 | |
- | - | |
8.3 | 0.0 | |
10 days ago | over 2 years ago | |
HTML | C | |
MIT License | MIT License |
Stars - the number of stars that a project has on GitHub. Growth - month over month growth in stars.
Activity is a relative number indicating how actively a project is being developed. Recent commits have higher weight than older ones.
For example, an activity of 9.0 indicates that a project is amongst the top 10% of the most actively developed projects that we are tracking.
YubiKey-Guide
-
Can I use Security Key C NFC as backup for 5C NFC if I use OpenPGP?
Instead, most people generate keypair(s) on an airgapped machine and write them to two Yubikeys. Or write subkeys to a single Yubikey and keep a backup in encrypted form. See https://github.com/drduh/YubiKey-Guide
-
Ask HN: Why does YubiCo need my private key?
I'd recommend using the Yubikey as a GPG smartcard[1]. The private key stays on the Yubikey. I also use it for ssh. But make sure you have a backup key or two, just in case the primary Yubikey gives out. FIDO2 and all other regular Yubikey functionality still works with it.
[1]: https://github.com/drduh/YubiKey-Guide
-
An Opinionated Yubikey Set-Up Guide
The excellent guide by drduh should be mentioned here: https://github.com/drduh/YubiKey-Guide — I've been using this approach for years to store my OpenPGP keys on Yubikeys and use them for SSH.
I don't generate my keys on devices. That lets me be flexible and keep backups, as well as use the same keys on multiple physical devices. Using a single yubikey is a bad idea, as you're bound to eventually lose it or break it. Hasn't happened to me yet in 5 years, but I expect it to happen.
-
How to use Yubikey to login into a server
I followed this guide to generate a master key and three subkey.
- Guide to Using Yubikey for GPG and SSH
-
GnuPG Private Key storage on YubiKey: Why are the private keys still present in my .gnupg/ folder?
See https://github.com/drduh/YubiKey-Guide . Also google for OpenPGP card specifications, they will answer your question
-
Got myself Yubikey and set it up for my password manager and email. What next?
Regarding GPG/SSH keys, there is a great howto: https://github.com/drduh/YubiKey-Guide
-
Some guidance from those who use their Yubikey to protect their SSH connections.
I'd be lying if I said I understood all of that. I'm definitely going to do some research ahaha. Someone else on this post sentence this like which they said was very good guide. https://github.com/drduh/YubiKey-Guide
-
When it comes to storing PGP keys what is the difference between a YubiKey and a standard USB key
When storing the key on a Yubikey, however, all you need is just the PIN in order to use the key. It can contain numbers, letters, symbols, etc. and can be quite long, so you can treat it as a passphrase for all intents and purposes. There are actually two PIN codes: one regular one, for a read access, and another administrative one, for write access for when you want to modify the gpg applet settings or the key on the Yubikey. There is also a limit to how many times in a row you can enter pins incorrectly, after which the gpg applet gets locked and the only thing you can do is reset it, erasing the PGP keys. See https://github.com/drduh/YubiKey-Guide for more information.
-
Issues moving OpenPGP encryption & authentication keys to YubiKey 5C
Try follow this guide from DrDuh https://github.com/drduh/YubiKey-Guide/blob/master/README.md
naive-hashcat
-
Notes from competing in my first CTF
For this, I downloaded wordlists such as the rockyou wordlist and used tools such as Hashcat and John the ripper.
- word lists
-
Hack WiFi using Kali Linux
For decrypting the .cap file, we've different techniques. We'll use simple technique using aircrack-ng only. It'll help us crack the password using a wordlist. You can use rockyou.txt wordlist which is most commonly used & is updated on regular basis.
-
LPT: Time to change your GatorLink password? Make it a scientific name of an animal or plant that you like.
First, any sort of password that uses an actual word (English or otherwise) has a far greater chance of being cracked. This is due to the fact that common password lists (e.g. the rockyou list) contain millions of unique entries from sites around the web. Many people share a favorite animal or plant as well, so unless your favorite animal is something unique like Mustela erminea there's a good chance that it's an entry in a list somewhere.
-
Is brute force password cracking ever actually a threat?
Most of the time a DB of hashed passwords is leaked/stolen and the attacker has unlimited attempts to brute force that. What's also commonly done is that they run it against dictionaries (and there are some pretty good dictionaries for that and some of them are easily accessible online) and if the DB is large enough, they're practically guaranteed to get hits immediately.
-
How to get my Password from a .hc22000 file with Hashcat?
Looking at the GitHub page for naive hashcat, it appears as though it only takes at most three arguments. Is there a reason you're using it over regular hashcat?
-
Cracking a hashed password with hashcat
First, it is important to know how the process works. Hashing is a process essentially different from encryption - you can only do it once. It means that we cannot really recover the plaintext of a hashed password; instead, we can only compare its hash with our guesses. So, it's like hashing several words and seeing which of them matches exaclty our hash. Then, it must be the password. We can automatize this process with two tools: hashcat and a dictionary of potential passwords. This kind of dictionary is easy to find on internet, so we are going to use rock you.
-
Favourite Lists
I use only SecLists (https://github.com/brannondorsey/naive-hashcat/releases/download/data/rockyou.txt)
-
Twitch.tv got leaked. Like, the entire website; Source code with comments for the website and various console/phone versions, references to an unreleased steam competitor, payouts, encrypted passwords that kinda thing.
rainbow table ("dictionary") plaintext or broken list of common passwords (i.e. Rockyou) leaked from many sources ^ those give you an idea of what people think are "clever" passwords
-
password management with pass and git
It's important to choose strong passwords. That's because there are lists of millions passwords like rockyou.txt which can be used to brute force your Linux system using hydra.
What are some alternatives?
solo1 - Solo 1 firmware in C
thc-hydra - hydra
wsl2-ssh-pageant - bridge between windows pageant and wsl2
SecLists - SecLists is the security tester's companion. It's a collection of multiple types of lists used during security assessments, collected in one place. List types include usernames, passwords, URLs, sensitive data patterns, fuzzing payloads, web shells, and many more.
sops - Simple and flexible tool for managing secrets
rockyou2021
wsl-ssh-pageant - A Pageant -> TCP bridge for use with WSL, allowing for Pageant to be used as an ssh-ageant within the WSL environment.
wifi-cracking - Crack WPA/WPA2 Wi-Fi Routers with Airodump-ng and Aircrack-ng/Hashcat
secretive - Store SSH keys in the Secure Enclave
Narthex - Modular personalized dictionary generator.
IsoApplet - A Java Card PKI Applet aiming to be ISO 7816 compliant
AnonAddy - Anonymous email forwarding