Short Bytes: Password cracking is an integral part of digital forensics and pentesting. Keeping that in mind, we have prepared a list of the top 10 best password cracking tools that are widely used by ethical hackers and cybersecurity experts. These tools–including the likes of Aircrack, John the Ripper, and THC Hydra–use different algorithms and protocols to crack the passwords on a Windows, Linux, and OS X system.

What is password cracking?

In the field of cybersecurity and cryptography, password cracking plays a very major role. It's basically the process of recovering passwords to breach (or restore) the security of a computer system. You can easily relate it to repeatedly guessing your phone's unlock pattern or pin.

So, why do we need to learn about password cracking and the tools used to do so? The purpose of password cracking revolves around recovering the forgotten passwords of our online accounts, computers, and smartphones. Password cracking is also used by system administrators as a preventive measure. They keep checking them on the regular basis to look for the weak links.

Talking about the process of password cracking, most methods involve the use of a computer that generates a vast set of password candidates. A desktop computer tests more than hundreds of millions of passwords per second. A password cracking tool performs this task easily and checks these candidates to reveal the actual password.

The time needed to crack a password is proportional to the length and strength of that password. That's why users are advised to use complex passwords that are harder to guess. The password cracking speed of a tool also depends heavily on the cryptographic function that's used to generate password hashes. Thus, a potent hashing function like bcrypt is preferred over the likes of SHA and MD5.

Types of password cracking attacks:

Here's I'll be listing various types of password cracking attacks that are generally used by attackers:

• Dictionary attack: This attack uses a file that contains a list of words that are found in the dictionary. This mode matches different combinations of those words to crack your device open.
• Brute force attack: Apart from the dictionary words, brute force attack makes use of non-dictionary words too.
• Rainbow table attack: This attack comes along with pre-computed hashes. Thus, this method is faster.

There are lots of other password cracking techniques like phishing, spidering, social engineering, shoulder surfing etc. Soon, I'll be discussing them in detail in another article. So, let's get started with our list of the best password cracking tools of 2016.

Best Password Cracking Tools Of 2016:

Disclaimer: fossBytes is publishing this list just for educational purposes. We don't promote malicious and unethical practices.

John the Ripper Best Password Cracking Tools Of 2016

John the Ripper is one of the most popular password cracking tools available around. This free password cracking tool is chiefly written in C programming language. Encompassing a customizable password cracker, John the Ripper comes as a combination of many password crackers into one suite.

Its ability to autodetect password hashtypes, makes it a preferred choice of ethical hackers to ensure security. A pro version of this tool is also available, offering better features and more effectiveness. Just like the popular hacking tool Metasploit, John also belongs to the Raspid7 family of security tools.

Supported platforms: John the Ripper is available for all major platforms, including Linux, Windows, DOS, and OS X.

Download link: John the Ripper

Love Hacking And Pentesting? Get Started Here

Aircrack-ng Best Password Cracking Tools Of 2016

Aircrack-ng (ng stands for new generation) is one of the best password cracking tools that hackers use to bump their annoying neighbors off their own Wi-Fi. Note that just like John the Ripper, Aircrack-ng is not a single tool. Instead, it's a complete software suite that's used to play with Wi-Fi networks.

In this free suite, you get a tool named aircrack that hackers use to crack WPA or WEP passwords. After analyzing the encrypted password packets, aircrack uses its cracking algorithm to break the passwords.

Using the well know attack techniques like FMS, this password cracking tool makes your job easier. Recently, a new attack named 'PTW' has been included in the suite, which reduces the number of initialization vectors to break a WEP key.

Supported platforms: Aircrack is available for Linux, OpenBSD, FreeBSD, OX X, Windows, Android

Download link: Aircrack-ng

RainbowCrack Best Password Cracking Tools Of 2016

As the name suggests, RainbowCrack makes use of rainbow tables to crack password hashes. Using a large-scale time-memory trade-off, RainbowCrack performs an advance cracking time computation. According to your convenience, you are free to use the command line or graphical interface of RainbowCrack.

Once the pre-computation stage is completed, this top password cracking tool is about hundreds of times faster than a brute force attack. You also don't need to prepare the rainbow tables yourselves. The developers have made different rainbow tables for LM, NTLM, MD5 and SHA1 available for free.

RainbowCrack's GPU acceleration is another key feature that allows this free password cracking tool to offload the runtime computation to GPUs, reducing the cracking time even further.

Supported platforms: RainbowCrack is available for Windows and Linux

Download link:RainbowCrack

Cain and Abel Best Password Cracking Tools Of 2016

This renowned password cracking tool is a dependable software to recover various types of passwords using multiple techniques. Cain and Able lets you easily perform Dictionary, Brute-Force, and Cryptoanalysis attacks to crack encrypted passwords.

This multi-purpose hacking tool also comes with the ability to sniff the networks, record VoIP conversations, recover network keys, decode scrambled passwords, and analyze routing protocols.

Cain and Abel has two components. While Cain is the frontend application to recover your passwords and perform sniffing, Able is a Windows NT service that performs the role of traffic scrambling.

Supported Platforms: Cain and Abel is available for Windows

Download link:Cain and Abel

THC Hydra Best Password Cracking Tools Of 2016

Compared to other top password cracking tools, THC Hydra performs hacking attacks using numerous network protocols, including the likes of Asterisk, FTP, HTTP-Proxy, MYSQL, XMPP, Telnet, and more. Using these protocols, THC Hydra performs super fast brute-force and dictionary attacks against a login page.

This free-to-use tool helps the pentesters and security researchers to know how easy it would be to gain remote access to a system. This tool also lets you add new modules to increase the functionality. Via its GitHub page, you can also participate in the development process of THC Hydra.

Supported Platforms: THC Hydra is available for Windows, Linux, Solaris, FreeBSD, OS X

Download link: THC Hydra

Find Best Courses On Hacking And Pentesting Here

HashCat Best Password Cracking Tools Of 2016

HashCat claims to be the fastest and most advanced password cracking software available. Tom jones greatest hits rediscovered free download. Released as a free and open source software, HashCat supports algorithm like MD4, MD5, Microsoft LM hashes, SHA-family, MySQL, Cisco PIX, and Unix Crypt formats.

This password cracking tool comes in both CPU-based and GPU-based versions, HashCat and oclHashcat/cudaHashcat, respectively. Using a well-documented GPU acceleration, many algorithms can be easily cracked using this tool.

Different types of attacks performed by this tool include brute force attack, combinator attack, fingerprint attack, dictionary attack, hybrid attack, mask attack, table-lookup attack, PRINCE attack, permutation attack etc.

Supported Platforms: HashCat is available for Windows, Linux, OS X

Download link:HashCat

Crowbar Best Password Cracking Tools Of 2016

Crowbar is a brute forcing tool that's widely popular in the pen testing scene. It gives you the control to decide what's submitted to a web server. While most brute forcing tools use username and password to deploy SSH brute force, Crowbar makes use of SSH keys obtained during penetration tests.

This free tool is created to support the protocols that are rarely supported by other popular password cracking tools. Currently, Crowbar supports VNC key authentication, OpenVPN, SSP private key authentication, and Remote Desktop Protocol with NLA support.

Supported Platforms: Crowbar is available for Windows, Linux, OS X

Download link:Crowbar

OphCrack Best Password Cracking Tools Of 2016

Just like RainbowCrack, OphCrack is another popular and free password cracking tool that uses rainbow tables to crack the password hashes. It's widely used to crack Windows log-in passwords. Thanks to its ability to import and use hashes from multiple formats and sources, OphCrack is known to crack the passwords of a Windows computer in few minutes.

Available conveniently as a Live CD, a pentester can use it and leave no trace behind. For cracking Windows XP, Vista, and 7, one can also grab freely available rainbow tables. For professional use, larger tables are available for purchase.

Supported Platforms: OphCrack is available for Windows

Download link:OphCrack

L0phtCrack Best Password Cracking Tools Of 2016

Just like OphCrack, L0phtCrack is known for easily cracking Windows passwords. Using a wide set of attacks like dictionary, hybrid, brute force, and rainbow tables, this password cracking tool can also be deemed useful in sniffing hashes.

It's a great way to target Windows desktops, networked servers, Active Directory, and primary domain controllers. Its schedule routine audit functionality lets you perform scans at a convenient time.

Supported Platforms: L0phtCrack is available for Windows

Download link:L0phtCrack

DaveGrohl Best Password Cracking Tools Of 2016

For Mac OS X, DaveGrohl is an open source password cracking tool that's preferred by the Apple security experts. With a completely modern object-oriented codebase in Version 3.0, DaveGrohl has been made more useful for developers and users.

With the help of dictionary and incremental attacks, this tool lets you crack a password in minutes. Its distributed mode allows you to perform attacks using different computers and crack the same password hash for faster results.

Supported Platforms: DaveGrohl is available for OS X

Download link:DaveGrohl

Did you find this article helpful? Don't forget to drop your feedback in the comments section below.

Bonus: Top 10 Best Hacking Tools 2017 Edition

I’m wondering where I can find good collections of dictionaries which can be used for dictionary attacks?

I've found some through Google, but I’m interested in hearing about where you get your dictionaries from.

10 Answers

Nice list collected by Ron Bowes you can find here:
http://www.skullsecurity.org/wiki/index.php/Passwords.

Other list is from InsidePro:
https://web.archive.org/web/20120207113205/http://www.insidepro.com/eng/download.shtml.

An important one that hasn't been added to the list is the crackstation wordlist

The list contains every wordlist, dictionary, and password database leak that I could find on the internet (and I spent a LOT of time looking). It also contains every word in the Wikipedia databases (pages-articles, retrieved 2010, all languages) as well as lots of books from Project Gutenberg. It also includes the passwords from some low-profile database breaches that were being sold in the underground years ago.

Best thing is, its free, although you can (and should!) make a donation!

Some additional ones to add to those already suggested

• ftp://ftp.ox.ac.uk/pub/wordlists/ - Lists by language, may be an important point depending on the locations of the users..
• http://www.openwall.com/passwords/wordlists/ - The openwall project lists.
• While not strictly a dictionary site (although it does have some) http://sites.google.com/site/reusablesec/Home/presentations-and-papers has some good presentations on improving the performance of password crackers in general and john the ripper in particular

Try the CrackLib dictionaries: https://web.archive.org/web/20161225012801/http://linux.maruhn.com/sec/cracklib-dicts.html

I tested the likelihood of collisions of different hashing functions. To help test, I tried hashing

• all 216,553 words in the English language. Start with those 17.7 bits.

• then the list of all 2,165,530 English words with one digit after it. (21.0 bits)

• then the list of all 21,655,300 English words with two digits after it. (24.4 bits)

• then the list of all 524,058,260 English words with a possible capital as the first letter, and followed by zero, one, or two digits. (29.0 bits).

With one list of English words you'll cover nearly everyone's password.

Note:XKCD is always relevant

Another good source is here http://blog.g0tmi1k.com/2011/06/dictionaries-wordlists/

snippet:

[Analysis] Dictionaries & Wordlists
In general, it's said that using a GOOD 'dictionary' or 'wordlist' (as far as I know, they're the same!) is 'key'. But what makes them GOOD? Most people will say 'the bigger, the better'; however, this isn't always the case.. (for the record this isn't my opinion on the matter - more on this later).

You'll find lots of words in lots of languages on the download page for the English Wiktionary. enwiktionary-latest-all-titles-in-ns0.gz contains just page titles, including phrases - it might have underscores instead of spaces though. (we have English definitions of words from many languages).

And of course there's also WordNet.

(sorry but as a newbie I can only include one link)

All the posts so far have great information, but remember you can always generate word lists yourself with a utility like crunch.

If you have an idea of what the password parameters are (for example, has to be 8-10 chars with only letters and numbers, no symbols), you can pipe crunch to most bruteforce programs with the tailored parameters.

This is one that I have found useful over the years:

It includes popular passwords, fuzzing based on attack type and popular user names.

Have you considered instrumenting OpenSSH to log password attempts. Its common to log thousands of attempts every day for an internet connected host. That will give you a list of several thousand common passwords that have some track record of success AND hint at users other than root which are common targets (e.g. nagios, db admins etc). Once you have a list then you can then use cewl to generate many more variations of these basic passwords.

I'd also recommend looking up lists of male/female names: a huge number of passwords are based on name. Again, once you have a basic list using cewl on it will generate many variations.

protected by Jeff Ferland♦Jul 13 '15 at 20:50

Thank you for your interest in this question. Because it has attracted low-quality or spam answers that had to be removed, posting an answer now requires 10 reputation on this site (the association bonus does not count).
Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged authenticationpasswordsattacksbrute-forcedictionary or ask your own question.