Summary

In this chapter, we took hashes from several major web-based CMSs and management products and put them through their paces. We saw that different applications could store passwords very differently, and as such, we need to carefully review any documentation, as well as have the appropriate level of access to obtain the hashes from a target system. Once we have them, good wordlists (coupled with good rules) are still vital, as some of these hash types can be very computationally complex, taking a long time to crack. Especially for our stated examples, bcrypt is particularly troublesome and may require the assistance of a GPU.

Furthermore, you have learned how to take these examples and extrapolate them to other applications by understanding where their password hashes are located, extracting them, and determining the right algorithm needed to select the proper cracking mode.

In the next chapter, we will turn to password managers—a great component for keeping passwords...