

Play nice, support each other and encourage learning. We are not tech support, these posts should be kept on /r/techsupportĭon't be a dick. Low-effort content will be removed at moderator discretion from security firms/pen testing companies is allowed within the confines of site-wide rules on self promotion found here, but will otherwise be considered spam. Spam is strictly forbidden and will result in a ban. Sharing of personal data is forbidden - no doxxing or IP dumping No "I got hacked" posts unless it's an interesting post-mortem of a unique attack. "How does HSTS prevent SSL stripping?" is a good question. Intermediate questions are welcomed - e.g.

"TeenagerĪrrested in Computer Crime Scandal", "Hacker Arrested after Bank Tampering". Guides and tutorials are welcome here as long as they are suitably complex and most importantly legal!īans are handed out at moderator discretion.Īnother one got caught today, it's all over the papers. This sub is aimed at those with an understanding of hacking - please visit /r/HowToHack for posting beginner links and tutorials any beginner questions should be directed there as they will result in a ban here. What we are about: quality and constructive discussion about the culture, profession and love of hacking. One of JtR's rules transformed the presumed password AWB3604 into 3604, and that turned out to be the actual password.A subreddit dedicated to hacking and hacking culture. And then I let JtR use all of its built-in rules on this "dictionary":

I used zip2john to create a hash for the sample, and created a password list file with a single line: AWB3604. Since it's a ZIP file, I first used my zipdump.py tool: it has a leightweight password cracking feature. This could be a mistake by the malware authors, or it could be deliberate: 7zip is able to decompress a ZIP file with extension 7z.Īnd I confirm that AWB3604 is not the password.

Just like Jan noticed, I saw that the sample is not actually a 7zip file, but a ZIP file. Jan's diary entry " One way to fail at malspam - give recipients the wrong password for an encrypted attachment" got my attention: it's an opportunity for me to do some password cracking :-) I asked Jan for the sample.
