Show HN: I Dedicated 4 Years to Mastering Offline Password Cracking
Hi everyone, I am Bojta Lepenye, and first of all, I want to thank the core developers of Hashcat. In my experience, it is quite literally the most capable tool available for offline password cracking across a wide range of use cases. I have spent the last 4 years (from age 14 to 18) extensively working with Hashcat and the tools surrounding it, and I have documented what I have learned throughout that time (since January 18, 2022) in my first book. During that period, I also had to continuously update and rewrite major sections as the field evolved. One example was the introduction of GPU support for Argon2 and other memory-hard password hashing algorithms, which significantly changed some cracking workflows. My passion for this book, or its “quick starter,” if you will, came from an ethically conducted penetration test I performed with full authorization at my school. This is something I am both hesitant and quite proud to acknowledge. At the beginning, I simply wrote down everything I had learned from YouTube videos and online blogs. However, not long after starting my project, I realized I practically knew nothing about password security, and that small 10 to 15 pages I had written would never be enough if someone was looking for a professional guide to cracking passwords. The other main driving force behind the book was the fact that while researching online, browsing forums, reading academic papers and white papers, watching videos, exploring blogs, inspecting presentations, and examining infographics, I did not find a single source that comprehensively covers and explains everything one needs to understand about offline password cracking. Literally. Not one. Therefore, I continued my research and learned about password hashing algorithms, the security properties of hash functions, advanced hash cracking techniques, password analysis, attack optimization, and much, much more. From the very beginning, I wanted to share this knowledge with the community because having access to a resource like this would have helped me tremendously when I first started learning password cracking. I sincerely hope this work will be useful to both beginners and experienced professionals alike, and I look forward to hearing your thoughts and feedback. I have also put together a little video to give you a little sneak peek into it. It is on Google Drive. It is the official domain, and you do not need to download anything. Here it is: https://drive.google.com/file/d/13LeysSZO8Mx-LGKt8UQjUGBKOYH... If you are interested, the book is now publicly available on Amazon, and can be read for free with a Kindle Unlimited subscription: https://www.amazon.com/dp/B0GX36XRCD
Discussion Highlights (17 comments)
gabrielsroka
Great job. The book is 427 pages. Why not put the video on YouTube?
raphman
Thanks for sharing. This looks interesting. Impressive achievement. This book is currently not really relevant for me, so I just skimmed the samples on Amazon. I found the technical content to be reasonably accurate and interesting although sometimes a little bit verbose (e.g., the section about 'what is a password') or slightly imprecise. In general, I think this book might have benefited from a thorough copyediting pass. There are quite a few grammar errors and unpolished sentences in the book, e.g.: > The reason why Linux is imperative is that well, for one, most of the tools we will use, while indeed have builds for other systems, like Windows, in this book we will work with Linux. Wishing you success and keep on writing!
sijmen
Congratulate on finishing such a big project on a complicated topic, and putting in all this effort so that others can learn as well. I enjoyed reading the first few pages on Amazon
andai
Congratulations! The book looks great. I would love to hear more about the process of writing and preparing it for publishing. It's self-published? How did you do the typesetting and the diagrams?
kelsey98765431
can you discuss your coverage of password mask attacks, specifically is there any advances since EBM
eigenrick
This is an amazing achievement for someone of any age, but to publish a book with this much research at 18 is phenomenal. I heartily congratulate you. I've hopped through the book and it seems carefully laid out and organized. I may come back at you with questions once I've read further. Cheers.
Footprint0521
The video url is down? This sounds super interesting!
saberience
There’s a reason there are no books about this, because most people are not interested in cracking local/offline passwords. In fact, the people most interested in password cracking are usually criminals. But good luck with the book. It’s just not a hugely in demand topic.
nilirl
I love the book cover! Great job, Bojta.
latchkey
when i was running 150k amd gpus... i really wanted to use the cluster to run hashcat to help people recover lost things. i couldn't convince management that that was a profitable business to run.
paulpauper
relevant https://en.wikipedia.org/wiki/2022_LastPass_data_breach probably a lot of ppl lost crypto this way.
aqsa_sajjad
This is a really impressive project, especially starting at 14. The point about there being no single comprehensive resource rings true, I've tried to learn about password security before and always ended up jumping between five different tabs just to understand one concept.
ViAchKoN
Nice job! It is a massive achievement to publish a book let alone to be start a career so early at age! Now need to find time read the book. It seems it be quite interesting.
amelius
Ok, so what should we use instead of passwords?
mmastrac
I've got an old datacenter KVM with a root password I've been unable to crack, even though it's an ancient DES one. Does anyone have a good cloud-hosted password cracker? I can't seem to brute force it, no matter how long I let John the ripper run.
gettingoverit
Nice to see someone going the same path as me! Haven't read the book or used Hashcat, I have a question. Is there anything yet to generate rainbow tables out of password regex?
chadbennett
I just bought the book and look forward to reading it. I also started in cyber at 14. These are the kinds of real-world constraints where you actually learn how tools like Hashcat work under pressure. You are going to do big things in the industry!