Password Cracking Beyond 15 Characters on a Budget Under $500
Travis Palmer demonstrates advanced password cracking strategies tailored against 15+ character enterprise passphrase policies using sub-$500 GPU rigs.
Summary
The Shifting Paradigm of Password Length Requirements
As organizations increase minimum password length policies to 15 or more characters, traditional brute-force and short mask attacks become computationally infeasible.
Building a Cost-Effective GPU Cracking Rig Under $500
Travis Palmer shares hardware blueprints for assembling high-throughput, affordable password cracking hardware using consumer GPUs and second-hand components.
Designing Targeted Passphrase and Grammar Mask Attacks
Palmer details modeling human passphrase generation habits, combining wordlists, grammar templates, and combinatorial rules (Hashcat/John the Ripper) to crack long passphrases.
Revising Enterprise Authentication Guidelines
The presentation provides guidance for security teams on evaluating password entropy and migrating to multi-factor authentication and passkeys.
Related talks
Red Team Village·51 min
Lee Wangenheim
Lee Wangenheim presents a structured methodology for modern password cracking, leveraging GPU clusters, targeted rule generation, and behavioral wordlists.
Password Village·24 min
PNI
An introductory guide to setting up and running Hashcat for GPU-accelerated password recovery and hash analysis.
Password Village·24 min
PNI
A walkthrough demonstrating core Hashcat attack modes, rule manipulation, and dictionary optimization.