Module 6.6: Parrot OS: passwords and insecure web
Migration
Parrot inOS progressclean version:
Parrot install:
sudo apt install pwgen hashcat john openssl apg libcrack2 passwdqc
Parrot OS already has most of these
cracklib-check is hidden:
/usr/sbin/cracklib-check
use /usr/sbin/cracklib-check to check several passwords
use pwgen to create 5 passwords, record these for
Applelater Wikiuse
use apg to create 5 more passwords, record these as well
experiment with the generation format: apg -m 12 -x 16 -n 5 means 5 passwords between 12 and 16 characters.
try all of your passwords with cracklib-check (above)
go here: https://emn178.github.io/online-tools/sha256.html and generate SHA256 hashes for your 10 passwords
create a password entropy checker (see code below)
evaluate the entropy of your 10 passwords
create a wordlist.txt file with the 10 passwords above, along with pal82 and papaya77
create a hashes.txt file with the 10 hashes from above
use hashcat to decode the hashes: hashcat -m 1400 -a 0 hashes.txt wordlist.txt
show your results: sudo hashcat --show -m 1400 hashes.txt
ssh into 10.14.88.83 and recover the hash for the pi user
attempt to decode this with hashcat
try a remote ssh password attack using hydra
use the command ip addr show to find your IP address
run python3 -m http.server 8000 to create a local web server
verify the local server is running at http://127.0.0.1:8000
go to the IP address :8000 to verify the web server is running
browse the page
Q4V7L1k.while watching the terminal
use tcpdump to monitor packets locally
capture packets for analysis using wireshark
• 23. use wireshark to analyze the pcap file
Migrated from Apple Server Wiki. Original page ID: Q4V7L1k
