POJIA破甲
地图 / Password Cracking - Weak Password Used to Secure ████ Containing a Plaintext Password

Password Cracking - Weak Password Used to Secure ████ Containing a Plaintext Password

信息泄露 / Storing Passwords in a Recoverable Format / #985133

厂商
U.S. Dept Of Defense
严重程度
中危
赏金
—
弱点
Storing Passwords in a Recoverable Format
研究员
@z32
披露日期
2021-02-18
资产
—
CVE
—

该报告还没有中文解读。

原文摘录

摘自原文(2455 字符中的一小部分)
**Summary:** I was able to crack the password to the ████████ located at ██████, as the pdf was protected with a weak password contained in a common word list. This guide contains steps to set-up the ███████ secure communication application with the unprotected configuration file located …
原文中的代码
root@kali:/home/kali# john --wordlist=/usr/share/wordlists/rockyou.txt hash.txt 
Using default input encoding: UTF-8
Loaded 1 password hash (PDF [MD5 SHA2 RC4/AES 32/64])
Cost 1 (revision) is 6 for all loaded hashes
Will run 4 OpenMP threads
Press 'q' or Ctrl-C to abort, almost any other key for …

默认不展示报告全文。以上为简短摘录,完整复现过程请阅读原文。版权归研究员与 U.S. Dept Of Defense 所有。

时间线

  • 报告提交
  • 公开披露
阅读 HackerOne 原文 ↗作者 @z32 · 版权归作者与 U.S. Dept Of Defense 所有

同类报告

Password reset token leak on third party website via Referer headerUPchieve · 2021-08-10Akismet API keys are exposed by authentication methodAutomattic · 2022-12-16External storage app saves password for all users in the databaseNextcloud · 2021-03-01