Minimum investment on a descent rig for 16+ character NTLM passwords
#8
(05-08-2018, 10:21 PM)phildo Wrote: "brute force" means "try a, try b, try c, ... try aa, try ab, try ac, ... aaa, aab, aac" all the way to 16 characters. The "get a calculator" comment refers so the possibility space being way way way way too large to accomplish w/ 16 characters, regardless how fast you can crack (within earthly constraints). to put it clearly: length matters here, 16 is way too large.

a "dictionary" attack (unless I'm misunderstanding something...) implies you have a list of passwords to try: "mypassword123", "dogsRcute!", etc... Here the length of the password doesn't matter. The number of passwords in your dictionary _does_.

disclaimer: I really don't know what I'm talking about. but I'm pretty dang confident that if you're _really_ brute forcing 16- you're screwed.

Thanks for clearing that up. That's also what I assumed - I just didnt know how many guesses hashcat can do per second. I have now removed the word "brute force" from my original question - so hopefully the question makes more sense now Smile


Messages In This Thread
RE: Minimum investment on a descent rig for 16+ character NTLM passwords - by eriden - 05-08-2018, 10:27 PM