Ophcrack – A Password Hack Tool to Crack Almost Any Windows Password

There are a lot of different reasons why one would want to use any number of password hack tools to hack a Windows password. Of course, there are the good-hearted reasons, like helping your grandpa because he forgot his password and is locked out of his own computer. Then, there are the more dubious reasons, like spying on your accountant.
In the past, MakeUseOf has published other password-cracking related articles. Those who are interest should check out T.J. Miniday’s 3 Ways to Reset Forgotten Windows Administrator Password.
However, there might be circumstances in which you’d need unnoticed access – being able to use the terminal without literally changing the password.

Ophcrack

That’s where Ophcrack comes in. Ophcrack is one of the more effective password hack tools that runs via Windows, Mac and Linux installations or on a Live CD, and it can be used to crack almost any Windows password.

To manage this, Ophcrack uses rainbow tables to guess the password. When a working one is encountered, it is presented to you, and you can simply log in with it. One would think this “guessing” takes a lot of time, but that’s just where the power of rainbow tables lies.

Rainbow Tables in a Nutshell

Operation systems don’t store the user passwords in plain text — that’d be highly insecure, and even right out stupid. Instead, they calculate the hashes of the passwords by putting the passwords through a one-way hash function and store those. When one would obtain these hashes, they would still be rather useless; the password needs to be entered, after which the hash needs to be calculated and compared to the stored password hash.

e.g. ‘makeuseof.com’ would become ‘9fb883363640e11970be10a5936a37fc:b35f6f8268073d2242e0cd8b72554d8a’ when converted to Windows XP’s LM hash.

A rainbow table is basically an enormous list of passwords — basically every password a brute force attack would try — with their respective hashes included. Although this table takes a lot of time to generate, it can reduce the cracking of passwords to minutes, or even seconds.

Downloadable Tables

Ophcrack supplies a few of these rainbow tables, free, for your use. They’re included in the Live CD, can automatically be retrieved from the Windows executable, or downloaded from the Ophcrack website. We’ll quickly look over the available tables, and their possibilities.
For Windows XP, Ophcrack supplies two alphanumeric tables. With these, you can crack 99.99% of all passwords under 14 characters, consisting of a combination between letters and numbers — abcdefghijklmnopqrstuvwxyz0123456789. Because the LM hash used by Windows XP is insensitive to capitalization, these hash tables contain 80 billion different hashes, corresponding with 12 septillion possible passwords.

You can choose between the XP free small and the XP free fast tables. These can both be used to crack the same passwords, but because the XP free fast table is twice as large, you can crack them in half the time.
The downside of both tables is their unability to crack passwords with special characters — these can only be cracked using the premium XP special tables.
For Windows Vista, which abandoned the weak LM hash, and moved on to the stronger NT hash, there are less possibilities. Currently, Ophcrack only gives away a table with dictionary-words and variations (hybrids) for free. If you’re willing to cough up a lot of money (about 99$), they also provide alphanumerical tables – including special characters.

Because the NT hash is subjective to capitalization, and allows a much greater password length (whereas the LM hash simply splits large sequences up in multitudes of smaller strings), these premium rainbow tables can range in size from 8GB to over 130GB.
And that’s the essence of it. There’s some more technical information (a real how-to) in the Ophcrack help files (included in the downloads).
If you’re shivering in your boots after reading this article and thinking,”Gosh, everyone’s going to know how to hack my password. What shall I do?” Then it may be a good time to create a stronger password. Stefan wrote about 5 free password generators that will help you make nearly unhackable passwords, no matter what password hack tools a hacker tries to use. It’s a good start.
So, what do you think? Is Ophcrack really the pot of gold at the end of the rainbow, or hardly worth one’s attention? — Let us know your experiences, opinions and questions in the comments section below.

A trio of practical anonymous torrenting options have arrived

It was only a matter of time before the P2P community came up with some workable options for anonymizing our activities. Sure, Tor has been able to do it for quite some time, but torrenting is very taxing on the network and transfers can be painfully slow. Recently, however, three new services have appeared that could provide the privacy protection we've been waiting for.

iPredator VPN - We've known this one was coming for a while. The beta launch date got pushed back quite a bit, but that little courtroom skirmish may have slowed things down a little. In a blog post yesterday, the iPredator team announced that the first 3,000 beta invites have been sent out. If you're in the queue, don't start drooling just yet. There are 179,999 others names lined up.

Furk (pictured) - Find a torrent, paste it into Furk, and you're provided a direct download link. Even with the free account, I still averaged about 275k/s, which isn't much slower than what I typically manage on a straight torrent download (thanks to my ISP). Download links are also passed to you with SSL encryption. Just don't use it to download stuff like what's in the capture - it's there for illustration purposes only, of course...

Paid accounts are just under 10 Euros a month or 24/three months.

BitBlinder - Jay posted about this service the other day. The open source project aims to anonymize not only torrent downloads but also your web browsing. How does it work? Think of your Internet traffic as the fruit in a smoothie. Now take all your friends' fruit, chuck it all into a blender, and press 'liquify'. Pour it into a glass, and all you see is smoothie - you can't tell what's your fruit and what belongs to your friends.

As with iPredator you may be waiting a while to get your invite and download link.

5 disposable email services with RSS support

If you're looking for a little anonymity and security when signing up for download links or invite codes, a disposable email service is a good option. Instead of providing one of your working email addresses, just grab a meaningless temporary one from any of these sites and keep your identity hidden.

These five sites all provide RSS feeds for your address, which is handy. No need to return to the site after registration, just subcribe with your favorite newsreader.

MailCatch - Choose your own address or roll the dice. MailCatch also provides an iGoogle gadget and creates a subdomain (using your address) for quick access to your web inbox. MailCatch also provides temporary forwards, and they've got an FAQ and forums.

MyTrashMail - Offers password protected temporary accounts in addition to the traditional public variety. Note that the Firefox "toolbar" they offer requires you have the Google toolbar installed first. FAQ and about links are prominently displayed.

FilzMail - Sports a clean interface featuring puffy, web 2.0 images. Create your own address or generate a random one and messages are available for 24 hours (which can be extended).

Incognito Mail - The option for minimalists. Choose or generate your address, and it's valid for 60 minutes. No FAQ or TOS is posted. There are a number of other services that look very similar to Incognito Mail, offering different time limits.

DodgeIt - Ok, maybe this is the one for minimalists. You pick the address (no random generator), you check for messages - they're deleted after seven days.

Do you use a different service? Share it with us, but stay on topic - make sure it supports RSS!

Doc Scrubber removes hidden data from your documents

Every Word file can contain a fairly large amount of metadata. This is stuff like the revision logs (for tracking changes), name of the author, last time edited, and last time printed. All that information is there for a reason, but embarrassing incidents have been known to occur when people don't realize what they're sending in their metadata. If you want to avoid that, you could delete it all by hand, or you could get Doc Scrubber, a free metadata-removal app.

Doc Scrubber can quickly tell you what all the "hidden info" on your docs says, or just delete it for you. It'll handle multiple docs at once, and is compatible with Word 97, 2000 and XP files. It doesn't do DOCX files, but those also don't handle metadata the same way, so they're less likely to expose your info.