Pa$$v0rt0

28th June 2021

Motivation

The employed encryption scheme majorly impacts the duration of any password cracking task. For instance, running Hashcat mask attack over 8 characters long ASCII password would take in the worst case (i.e., testing all combinations of characters):

Format Speed Time
MS Office 2003 4 696 MH/s              16d   8h 23m
MS Office 2007 2.192 MH/s     95y 343d   8h 47m
MS Office 2010 1.097 MH/s   191y 273d 20h 30m
MS Office 2013 0.174 kH/s 1206y 342d   6h   7m


These numbers take into account our dedicated Tansy2 platform equipped with 8 high-end nVidia GeForce 2080Ti cards. Therefore, dictionary-based attacks are a necessity as modern cryptography adds more complexity and obstacles when relying only on a brute-force attack.

Overview

Passvorto application enables you to:  
1. create custom dictionaries according to user specified rules from curated data-sets; (e.g., build a new dictionary from 8 and longer character passwords related to Russian gaming community)
2. find username and corresponding passwords in public leaks; (e.g., return all passwords and list of known exploited services connected with this email address).
3. import your data and manage them in frame of Passvorto.  

Tech

Passvorto leverages a unique database engine that guarantees fast processing even when searching through terabytes of data.
Passvorto offers a command-line application that would help you to accomplish your task.
Passvorto is installed locally on your infrastructure in order to secure the confidentiality of your work with the system. Netsearch delivers periodic updates of the leaks databases to keep your
installation on the edge of extensivity.

 

Metrics

Taking into account current 302 large archives packed with username:passwords tuples, Passvorto knows following unique resources:

Resource Count
Passwords 542 371 970
Usernames 1 400 078 590
Username-Password Links 3 190 436 944

Passvorto data sources includes various database leaks (e.g., LinkedIn), exploited services (e.g.,
CoinGate) and domain-specific dictionaries (e.g., gaming, shopping, city names, porn). Moreover, a lot of sources are tailored for language or region, where notable representation
have:

  • China
  • Russia
  • India
  • Japan
  • UK, USA, Canada
  • Poland
  • Netherlands
  • Italia
  • Germany
  • France