cybersecurity
Temper
A lab demonstration of hash cracking with John the Ripper/Johnny, plus pwaudit: a NIST SP 800-63B-4 password-policy auditor grounded in real HIBP breach data and real John the Ripper experiments.
46/46 (+1 real John integration test)
pwaudit: automated tests passing
0
pwaudit: Ruff lint issues
5/5 (100%)
pwaudit: legacy-composition passwords that are real confirmed HIBP breach hits
49,462 c/s vs. 3,147 c/s (~15.7x)
pwaudit: real John the Ripper hash-format throughput (md5crypt vs. bcrypt, real c/s)
A presentation-based lab demonstration walking through generating a dummy MD5 password hash, building a custom wordlist with CUPP, and cracking the dummy hash with both John the Ripper (CLI) and Johnny (GUI). Also covers cracking password-protected ZIP/PDF files (zip2john/pdf2john) and mitigations (salting, adaptive hashing like bcrypt/scrypt/Argon2, MFA, rate limiting), scoped explicitly to dummy hashes in a controlled lab. Added pwaudit: a password-security laboratory that audits verifier policy against the current NIST SP 800-63B-4 (July 2025), checks a frozen synthetic password dataset against real Have I Been Pwned breach data (live API, not invented), estimates pattern-aware guessability with zxcvbn, and measures real John the Ripper crack outcomes and hash-format throughput -- reporting all four dimensions separately rather than as one combined score.