I'm busy with the crack program for the hacker 2 assignment. I wrote a dictionary attack which works well for some of the passwords. I also wrote a brute force attack for the other passwords that the dictionary didn't work on, and by a stroke of luck I managed to crack the passwords while I was testing it.
I don't want to give too much away and spoil it for everyone else, I'll just say that I left out some characters and those that were left were enough to break the passwords. When I included the full search space for a more realistic tool, I noticed the speed dropped drastically, as expected.
The specification for hacker 2 is a bit thin on implementation advice, and I'm left wondering what algorithms are used in industry grade password crackers. There must be tried and tested ways of doing these sorts of things, considering the proliferation of password strength checkers and the like.
What sort of optimisations might be used to keep the algorithm efficient and quickly search simpler passwords, and incrementally expand the search space. The trick seems to be to avoid duplicating effort.
For instance, the brute force search will at some point generate the same character sequences as in the dictionary, but how would the program know to avoid re-checking these same values without searching the dictionary?
Or let's say it starts with a reduced set of alphabetical characters. If no password is found then it needs to expand the set to include punctuation and symbols. When the expanded character set is used, it should check all the permutations of all the characters, but not waste effort re-checking the permutations from the smaller character set.
I'm interested in algorithmic solutions, hardware optimisations such as multithreading are less informative.