APPLICATION OF HASH CRACKING METHODS IN INFORMATION SECURITY TESTING

Aigulim Bayegizova, Ainur Jumagaliyeva, Еlmira Abdykerimova, Asset Turkmenbayev, Venera Rystygulova

2025

Full text Open access: Hybrid Metadata (CSL-JSON)
DOI 10.52167/1609-1817-2025-138-3-187-202
Data confidence 70 medium
How this score is calculated

It is built from checkable properties of the record itself: whether the article has a DOI, how many independent sources confirmed its data, whether the required fields are filled in, and how recent the latest confirmation is. Disagreement between sources and a missing identifier lower it. A value of 80 or above means the record was published without further checking; 60 to 79 means it is published at reduced confidence, with a manual check advisable. A record verified by an editor by hand is never pushed below 90 by a recalculation. This scores our data about the article, not the article itself.

Abstract

The increasing reliance on password-based authentication makes cryptographic security a critical concern in modern cybersecurity. This study explores automated hash-cracking techniques and privilege escalation attacks, assessing their impact on system security through penetration testing. The research examines vulnerabilities in password hashing mechanisms, authentication protocols, and privilege management, demonstrating how attackers exploit these weaknesses to gain unauthorized access and escalate privileges. The methodology includes dictionary and brute-force attacks using Hashcat and CrackStation to evaluate the feasibility of breaking MD5, SHA-256, and SHA-512 hashes, both salted and unsalted. Additionally, privilege escalation techniques were tested by analyzing weak password policies, exposed SSH keys, and misconfigured SUID binaries. Results confirm that unsalted hashes are highly vulnerable to dictionary attacks, while salted hashes provide better protection but remain susceptible to brute-force attacks if weak passwords are used. Furthermore, authentication misconfigurations enable attackers to bypass security controls, leading to root or administrative control over the system. This study highlights the need for strong password hashing algorithms such as bcrypt or Argon2, multi-factor authentication, privilege access management, and continuous security audits. Addressing these vulnerabilities is essential for enhancing authentication security and reducing unauthorized access risks in modern systems.