HOPE Wiki - User contributions [en]

Password Superpowers workshop

2020-07-12T23:10:00Z

Tech Learning Collective: Add duration.

{{Infobox workshop
|title=Password Superpowers: How to Crack Hashes and Stump Hackers
|presenters=[[User:Tech Learning Collective]]
|duration=1 hour and 30 minutes
|imagefile=Workshop.password-superpowers-how-to-crack-hashes-and-stump-hackers.rectangle.jpg
|participant_limit=20
}}

'''Password Superpowers''' is a workshop slated to be included in the HOPE 2020 conference calendar that teaches password recover (hash cracking) techniques as well as secrets management (password manager) software. It was created by Tech Learning Collective cybersecurity trainers and features both demonstration and hands-on portions. Students are provided with a "practice lab" that they can run inside of a virtual machine, where numerous hash cracking software utilities are pre-installed for them.

== Abstract ==
This workshop teaches you how to use “password recovery” tools like John the Ripper and hashcat to find out what the password of a given user account or password-protected file is. By using free software programs that automates a technique called hash cracking, you can find out exactly how strong (or not) your own passwords are. Also in this workshop, you’ll learn about equally free password and secrets management apps like KeePass that help you practice good password hygiene so that you don’t reuse passwords or use weak passwords that don’t offer as much protection as you might have thought before you learned how easy it can be to “crack” encrypted passwords yourself. We'll also provide an automated lab environment for you that you can spin up on your laptop so that you can follow along with the instructor and get cracking immediately.

== Full Description ==
Have you been “pwned”? For years, security researcher Troy Hunt has been running a website at HaveIBeenPwned.com that lets you check to see if your online accounts have been pwned—that is, if your personal information such as your password has been leaked, accessed, or (worst of all!) “cracked.” Go on, check for yourself!

If you’ve been “pwned,” this workshop is your chance to learn exactly what the risk might be, and what you can do about it. Derived from one portion of [[Tech Learning Collective https://techlearningcollective.com/]]’s popular “Hacking with Mr. Robot” (Security 101) course, this class will clarify the basics of cryptography and encryption within a context that actually applies to your day to day life online.

Learn what websites do with your password when you log in to them, and why using free password management software can make you both safer and more productive. On the flip side, learn professional techniques for recovering passwords from their “encrypted” (hashed) representation, such as using optimized wordlists, word-mangling rulesets, and employing basic doxing techniques for creating personally targeted password-cracking attacks.

== Registration ==
Registration information TBD.

== Pre-requisite knowledge ==
This workshop presumes no pre-existing knowledge on the subject. This is a beginner-friendly workshop. That being said, the following knowledge will be useful for students who want to take the workshop's training to the next level more quickly:

* Basic command line experience in a POSIX environment (Bash on GNU/Linux, for instance), to work with the tools.
* Basic understanding of computational resources, such as CPU clock speeds, to understand how to optimize hash cracking speeds.
* Familiarity with the use or, optionally, development of login systems such as Web-based authentication flows. This is very much not required but adds a lot of context to the workshop discussion.

== Preparation ==
Workshop attendees must have a laptop capable of participating in the Web video stream, but nothing more.

=== Preparation for optional hands-on lab ===
If attendees want to try out the hands-on exercises along with the instructor, they must have:

* A laptop capable of running Oracle VirtualBox, which means they need physical hardware with support for the Intel VT-x instruction. This excludes many low-end tablet-style devices such as models of Microsoft Surface, netbooks, and so forth. To check your system for hardware virtualization support:
** macOS: <code>sysctl -a | grep -E --color 'machdep.cpu.features|VMX'</code>
** Linux: <code>grep -E --color 'vmx|svm' /proc/cpuinfo</code>
** Windows: <code>systeminfo</code>, then ensure "Hyper-V Requirements" features are marked "Yes" in the output.
* HashiCorp Vagrant version 2.2.9 or later.
* A broadband Internet connection (for timely downloading of the Vagrant base box virtual machine lab environment).
* No less than 10GB free hard disk space in which to install the lab environment and associated wordlist assets. (15GB recommended.)
* At least 1GB free RAM (2GB recommended).

To prepare, attendees must perform the following steps:

# Install Oracle VirtualBox.
# Install HashiCorp Vagrant.
# Download the workshop lab materials (which can be provided on request).
# Navigate to the workshop lab materials folder (<code>cd /path/to/lab/folder</code>) in their terminal program of choice.
# Spin up the lab environment by invoking the <code>vagrant up</code> command.

Once Vagrant completes, they can use the <code>vagrant ssh</code> command to log in to the lab environment, which will provide them with numerous hash cracking utilities and some hashes to crack.

Template:Infobox workshop

2020-07-12T23:08:00Z

Tech Learning Collective: Document duration parameter.

<includeonly>
{|style="float: right; max-width: 50%;"
!colspan="2"|{{{title}}}
|-
!colspan="2"|[[File:{{{imagefile|Hope2020 v1.png}}}|150px]]
|-
!Presenters:
|{{{presenters}}}
|-
!Duration:
|{{{duration}}}
|-
!Participant limit:
|{{{participant_limit}}}
|}
[[Category:HOPE 2020 workshops]]
</includeonly><noinclude>
This template is intended to be used to create a "glance-able" overview of a workshop.

Use the template like so:

<pre>
{{Infobox workshop
|title=How to Hack: For Fun and Profit
|presenters=Hacker McHackypants
|duration=1 hour and 30 minutes
|imagefile=ExampleImage.jpg
|participant_limit=15
}}
</pre>
</noinclude>

Template:Infobox workshop

2020-07-12T23:07:29Z

Tech Learning Collective: Add duration parameter.

<includeonly>
{|style="float: right; max-width: 50%;"
!colspan="2"|{{{title}}}
|-
!colspan="2"|[[File:{{{imagefile|Hope2020 v1.png}}}|150px]]
|-
!Presenters:
|{{{presenters}}}
|-
!Duration:
|{{{duration}}}
|-
!Participant limit:
|{{{participant_limit}}}
|}
[[Category:HOPE 2020 workshops]]
</includeonly><noinclude>
This template is intended to be used to create a "glance-able" overview of a workshop.

Use the template like so:

<pre>
{{Infobox workshop
|title=How to Hack: For Fun and Profit
|presenters=Hacker McHackypants
|imagefile=ExampleImage.jpg
|participant_limit=15
}}
</pre>
</noinclude>

File:Workshop.world-wide-wars-introduction-to-exploiting-web-applications.rectangle.jpg

2020-07-12T23:02:02Z

Tech Learning Collective:

File:Workshop.gone-phishing-how-to-recognize-fake-websites-and-other-online-scams.rectangle.jpg

2020-07-12T23:01:31Z

Tech Learning Collective:

Password Superpowers workshop

2020-07-12T22:59:11Z

Tech Learning Collective: First draft of workshop page.

{{Infobox workshop
|title=Password Superpowers: How to Crack Hashes and Stump Hackers
|presenters=[[User:Tech Learning Collective]]
|imagefile=Workshop.password-superpowers-how-to-crack-hashes-and-stump-hackers.rectangle.jpg
|participant_limit=20
}}

'''Password Superpowers''' is a workshop slated to be included in the HOPE 2020 conference calendar that teaches password recover (hash cracking) techniques as well as secrets management (password manager) software. It was created by Tech Learning Collective cybersecurity trainers and features both demonstration and hands-on portions. Students are provided with a "practice lab" that they can run inside of a virtual machine, where numerous hash cracking software utilities are pre-installed for them.

== Abstract ==
This workshop teaches you how to use “password recovery” tools like John the Ripper and hashcat to find out what the password of a given user account or password-protected file is. By using free software programs that automates a technique called hash cracking, you can find out exactly how strong (or not) your own passwords are. Also in this workshop, you’ll learn about equally free password and secrets management apps like KeePass that help you practice good password hygiene so that you don’t reuse passwords or use weak passwords that don’t offer as much protection as you might have thought before you learned how easy it can be to “crack” encrypted passwords yourself. We'll also provide an automated lab environment for you that you can spin up on your laptop so that you can follow along with the instructor and get cracking immediately.

== Full Description ==
Have you been “pwned”? For years, security researcher Troy Hunt has been running a website at HaveIBeenPwned.com that lets you check to see if your online accounts have been pwned—that is, if your personal information such as your password has been leaked, accessed, or (worst of all!) “cracked.” Go on, check for yourself!

If you’ve been “pwned,” this workshop is your chance to learn exactly what the risk might be, and what you can do about it. Derived from one portion of [[Tech Learning Collective https://techlearningcollective.com/]]’s popular “Hacking with Mr. Robot” (Security 101) course, this class will clarify the basics of cryptography and encryption within a context that actually applies to your day to day life online.

Learn what websites do with your password when you log in to them, and why using free password management software can make you both safer and more productive. On the flip side, learn professional techniques for recovering passwords from their “encrypted” (hashed) representation, such as using optimized wordlists, word-mangling rulesets, and employing basic doxing techniques for creating personally targeted password-cracking attacks.

== Registration ==
Registration information TBD.

== Pre-requisite knowledge ==
This workshop presumes no pre-existing knowledge on the subject. This is a beginner-friendly workshop. That being said, the following knowledge will be useful for students who want to take the workshop's training to the next level more quickly:

* Basic command line experience in a POSIX environment (Bash on GNU/Linux, for instance), to work with the tools.
* Basic understanding of computational resources, such as CPU clock speeds, to understand how to optimize hash cracking speeds.
* Familiarity with the use or, optionally, development of login systems such as Web-based authentication flows. This is very much not required but adds a lot of context to the workshop discussion.

== Preparation ==
Workshop attendees must have a laptop capable of participating in the Web video stream, but nothing more.

=== Preparation for optional hands-on lab ===
If attendees want to try out the hands-on exercises along with the instructor, they must have:

* A laptop capable of running Oracle VirtualBox, which means they need physical hardware with support for the Intel VT-x instruction. This excludes many low-end tablet-style devices such as models of Microsoft Surface, netbooks, and so forth. To check your system for hardware virtualization support:
** macOS: <code>sysctl -a | grep -E --color 'machdep.cpu.features|VMX'</code>
** Linux: <code>grep -E --color 'vmx|svm' /proc/cpuinfo</code>
** Windows: <code>systeminfo</code>, then ensure "Hyper-V Requirements" features are marked "Yes" in the output.
* HashiCorp Vagrant version 2.2.9 or later.
* A broadband Internet connection (for timely downloading of the Vagrant base box virtual machine lab environment).
* No less than 10GB free hard disk space in which to install the lab environment and associated wordlist assets. (15GB recommended.)
* At least 1GB free RAM (2GB recommended).

To prepare, attendees must perform the following steps:

# Install Oracle VirtualBox.
# Install HashiCorp Vagrant.
# Download the workshop lab materials (which can be provided on request).
# Navigate to the workshop lab materials folder (<code>cd /path/to/lab/folder</code>) in their terminal program of choice.
# Spin up the lab environment by invoking the <code>vagrant up</code> command.

Once Vagrant completes, they can use the <code>vagrant ssh</code> command to log in to the lab environment, which will provide them with numerous hash cracking utilities and some hashes to crack.

Template:Infobox workshop

2020-07-12T22:56:04Z

Tech Learning Collective: Extend infobox width.

<includeonly>
{|style="float: right; max-width: 50%;"
!colspan="2"|{{{title}}}
|-
!colspan="2"|[[File:{{{imagefile|Hope2020 v1.png}}}|150px]]
|-
!Presenters:
|{{{presenters}}}
|-
!Participant limit:
|{{{participant_limit}}}
|}
[[Category:HOPE 2020 workshops]]
</includeonly><noinclude>
This template is intended to be used to create a "glance-able" overview of a workshop.

Use the template like so:

<pre>
{{Infobox workshop
|title=How to Hack: For Fun and Profit
|presenters=Hacker McHackypants
|imagefile=ExampleImage.jpg
|participant_limit=15
}}
</pre>
</noinclude>

Template:Infobox workshop

2020-07-12T22:55:14Z

Tech Learning Collective: Add participant limit parameter.

<includeonly>
{|style="float: right; max-width: 300px;"
!colspan="2"|{{{title}}}
|-
!colspan="2"|[[File:{{{imagefile|Hope2020 v1.png}}}|150px]]
|-
!Presenters:
|{{{presenters}}}
|-
!Participant limit:
|{{{participant_limit}}}
|}
[[Category:HOPE 2020 workshops]]
</includeonly><noinclude>
This template is intended to be used to create a "glance-able" overview of a workshop.

Use the template like so:

<pre>
{{Infobox workshop
|title=How to Hack: For Fun and Profit
|presenters=Hacker McHackypants
|imagefile=ExampleImage.jpg
|participant_limit=15
}}
</pre>
</noinclude>

Template:Infobox workshop

2020-07-12T22:51:22Z

Tech Learning Collective: Correct documentation. :P

<includeonly>
{|style="float: right; max-width: 300px;"
!colspan="2"|{{{title}}}
|-
!colspan="2"|[[File:{{{imagefile|Hope2020 v1.png}}}|150px]]
|-
!Presenters:
|{{{presenters}}}
|}
[[Category:HOPE 2020 workshops]]
</includeonly><noinclude>
This template is intended to be used to create a "glance-able" overview of a workshop.

Use the template like so:

<pre>
{{Infobox workshop
|title=How to Hack: For Fun and Profit
|presenters=Hacker McHackypants
|imagefile=ExampleImage.jpg
}}
</pre>
</noinclude>

Template:Infobox workshop

2020-07-12T22:50:10Z

Tech Learning Collective: Documentation.

<includeonly>
{|style="float: right; max-width: 300px;"
!colspan="2"|{{{title}}}
|-
!colspan="2"|[[File:{{{imagefile|Hope2020 v1.png}}}|150px]]
|-
!Presenters:
|{{{presenters}}}
|}
[[Category:HOPE 2020 workshops]]
</includeonly><noinclude>
This template is intended to be used to create a "glance-able" overview of a workshop.

Use the template like so:

<pre>
{{Infobox workshop
|title=Password Superpowers: How to Crack Hashes and Stump Hackers
|presenters=[[User:Tech Learning Collective]]
|imagefile=Workshop.password-superpowers-how-to-crack-hashes-and-stump-hackers.rectangle.jpg
}}
</pre>
</noinclude>

Template:Infobox workshop

2020-07-12T22:43:08Z

Tech Learning Collective: First draft of workshop infobox template.

<includeonly>
{|style="float: right; max-width: 300px;"
!colspan="2"|{{{title}}}
|-
!colspan="2"|[[File:{{{imagefile}}}|150px]]
|-
!Presenters:
| {{{presenters}}}
|}
[[Category:HOPE 2020 workshops]]
</includeonly><noinclude>
This template is intended to be used to create a "glance-able" overview of a workshop.
</noinclude>

File:Workshop.password-superpowers-how-to-crack-hashes-and-stump-hackers.rectangle.jpg

2020-07-12T22:38:29Z

Tech Learning Collective:

Main Page

2020-07-12T20:19:41Z

Tech Learning Collective: /* HOPE 2020 is Happening! */ Simpler wikilink.

= HOPE 2020 is Happening! =

HOPE 2020 will be a NINE DAY EVENT, beginning on Saturday, July 25th and running through Sunday, August 2nd, 2020. The event will be entirely online, and will include scheduled talks, workshops, keynotes, concerts, and more! Registered attendees will be able to interact live with presenters and each other.

Information about HOPE is available online at [https://www.hope.net www.hope.net]. This wiki will be supporting conference planning and implementation.

* [[Knowledge Base]]: Entry to information for attendees, presenters and volunteers
* [[Presenting at HOPE]]: Guidelines for speakers and workshops
* [[Graphics and Logos]]: Official HOPE artwork

= Hackers Helping to Fight COVID-19 =

The unprecedented health threats and global response to the COVID-19 pandemic
have impacted everyone.<br>Many hackers, makers, educators, and others have put
their skills to use by contributing to solutions to a wide range of challenges.

These contributions are the essence of the hacker spirit: People using their
skills, intelligence and energy to help other people. Hackers are helping by
designing, making and distributing much-needed medical supplies. They are
helping by creating communication forums, informative websites, software, and
safe entertainment. They are helping by fighting disinformation, and doing
research and experimentation to investigate solutions and mitigations.

'''On [[Helping#Hackers_Helping_to_Fight_COVID-19|this page]], we have collected links to some of the projects,
products, groups, and activities that highlight how hackers are helping.'''

Knowledge Base

2020-07-12T20:18:09Z

Tech Learning Collective: /* Presenters */ Use wikilink.

This is the entry point for information and documentation for HOPE attendees, presenters and volunteers.

== Attendees ==

'''Q''': I bought my ticket. What's next?

'''A''': There will be some emails and announcements in the days leading up to the conference with links and instructions on how to participate. Meanwhile, visit https://www.hope.net to see the schedule of events and other information about the HOPE program.

'''Q''': Since HOPE is online, what do I need to watch and participate?

'''A''': Watching should work on any device (computer, phone, tablet...) that can watch any regular online video. To participate you might benefit from a computer so you can more easily participate in chats and other forums - however, phones and tablets should work ok, too, for most people. Some workshops have specific requirements, which are part of the workshop description.

== Presenters ==

'''Q''': What do I need to do to prepare for my session?

'''A''': All presenters should have received emailed guidance specific to their session type (i.e., talk, workshop, performance, etc.). If not, email back to the session coordinators who contacted you initially about your proposal.

'''Q''': What are specifics for my session?

'''A''': See [[Presenting at HOPE]]

== Volunteers ==

'''Q''': I'm interested in volunteering for HOPE. What opportunities are available?

'''A''': See https://www.hope.net/volunteer.html