Show HN：我花了四年时间专攻离线密码破解
1 分•作者: bojta-lepenye•大约 2 个月前
大家好，
我是Bojta Lepenye。首先，我要感谢Hashcat的核心开发者。根据我的经验，它绝对是目前市面上功能最强大的离线密码破解工具，适用于各种不同的应用场景。
在过去的四年里（从14岁到18岁），我一直在深入研究Hashcat及其相关工具，并且我将这段时间（从2022年1月18日开始）所学到的知识记录在了我的第一本书中。在此期间，我还不得不不断地更新和重写主要章节，因为这个领域发展得非常快。一个例子是Argon2和其他内存密集型密码哈希算法的GPU支持的引入，这极大地改变了一些破解工作流程。
我对这本书，或者说它的“快速入门指南”的热情，源于我在学校里进行的一次完全授权的、符合伦理的渗透测试。这件事让我既犹豫又自豪。
一开始，我只是把从YouTube视频和在线博客上学到的东西都写了下来。然而，在开始我的项目后不久，我意识到我实际上对密码安全一无所知，如果有人想找一本专业的密码破解指南，我写的这10到15页是远远不够的。
这本书的另一个主要推动力是，在网上搜索、浏览论坛、阅读学术论文和白皮书、观看视频、浏览博客、检查演示文稿和查看信息图表的过程中，我没有找到任何一个能够全面涵盖和解释离线密码破解所需的一切知识的单一来源。真的，一个都没有。
因此，我继续我的研究，学习了密码哈希算法、哈希函数的安全属性、高级哈希破解技术、密码分析、攻击优化等等。
从一开始，我就想把这些知识分享给社区，因为如果我刚开始学习密码破解时能有这样的资源，对我来说将会有很大的帮助。
我衷心希望这项工作对初学者和经验丰富的专业人士都有用，并期待听到您的想法和反馈。
我还制作了一个小视频，让您对这本书有一个初步的了解。它在Google Drive上。这是官方域名，您无需下载任何东西。链接如下：<a href="https://drive.google.com/file/d/13LeysSZO8Mx-LGKt8UQjUGBKOYH7MqiS/view?usp=sharing" rel="nofollow">https://drive.google.com/file/d/13LeysSZO8Mx-LGKt8UQjUGBKOYH...</a>
如果您有兴趣，这本书现在已在亚马逊上公开出版，并且可以通过Kindle Unlimited订阅免费阅读：<a href="https://www.amazon.com/dp/B0GX36XRCD" rel="nofollow">https://www.amazon.com/dp/B0GX36XRCD</a>
查看原文
Hi everyone,<p>I am Bojta Lepenye, and first of all, I want to thank the core developers of Hashcat. In my experience, it is quite literally the most capable tool available for offline password cracking across a wide range of use cases.<p>I have spent the last 4 years (from age 14 to 18) extensively working with Hashcat and the tools surrounding it, and I have documented what I have learned throughout that time (since January 18, 2022) in my first book. During that period, I also had to continuously update and rewrite major sections as the field evolved. One example was the introduction of GPU support for Argon2 and other memory-hard password hashing algorithms, which significantly changed some cracking workflows.<p>My passion for this book, or its “quick starter,” if you will, came from an ethically conducted penetration test I performed with full authorization at my school. This is something I am both hesitant and quite proud to acknowledge.<p>At the beginning, I simply wrote down everything I had learned from YouTube videos and online blogs. However, not long after starting my project, I realized I practically knew nothing about password security, and that small 10 to 15 pages I had written would never be enough if someone was looking for a professional guide to cracking passwords.<p>The other main driving force behind the book was the fact that while researching online, browsing forums, reading academic papers and white papers, watching videos, exploring blogs, inspecting presentations, and examining infographics, I did not find a single source that comprehensively covers and explains everything one needs to understand about offline password cracking. Literally. Not one.<p>Therefore, I continued my research and learned about password hashing algorithms, the security properties of hash functions, advanced hash cracking techniques, password analysis, attack optimization, and much, much more.<p>From the very beginning, I wanted to share this knowledge with the community because having access to a resource like this would have helped me tremendously when I first started learning password cracking.<p>I sincerely hope this work will be useful to both beginners and experienced professionals alike, and I look forward to hearing your thoughts and feedback.<p>I have also put together a little video to give you a little sneak peek into it. It is on Google Drive. It is the official domain, and you do not need to download anything. Here it is: <a href="https://drive.google.com/file/d/13LeysSZO8Mx-LGKt8UQjUGBKOYH7MqiS/view?usp=sharing" rel="nofollow">https://drive.google.com/file/d/13LeysSZO8Mx-LGKt8UQjUGBKOYH...</a><p>If you are interested, the book is now publicly available on Amazon, and can be read for free with a Kindle Unlimited subscription: <a href="https://www.amazon.com/dp/B0GX36XRCD" rel="nofollow">https://www.amazon.com/dp/B0GX36XRCD</a>