Welcome in this video
I'm going to talk about downloading the haveibeenpwned password list and then querying against it on a computer
So I'm doing this on a Mac the procedure I'm using will work on Linux
Also, it could work on Windows
If you have the proper utilities installed if you're not familiar with how I've been poned
It's a website where you can search for a password and you can type the password in here and hit pwned and it will tell
you that the password is in data breach data and
This password I just typed in has been to use three million three point six million times
So I had typed in password there and you may not feel comfortable
Typing in your own password to here because maybe this site is collecting them
Although I trust that they're not this seems like a very legit service but say you are nervous about that
You can download this data down below here. So they have the data in four different formats
It's two of them are sha-1 and two of them are ntlm and they are ordered by prevalence and hash so I downloaded this
Here so the file downloaded here and if we go to our terminal we can say CD space
Downloads and we'll see this file here. So I want to make sure this file wasn't modified in transit transit to my computer
So I'll type shasum
space and then the name of the file and we'll let that run and we'll check to see if that matches up with the
Sha-1 hash here. This will probably take in a second
Okay, so this finished up and we see here that the hash here is matched up with the hash
They gave us here we can continue on now. This is a this is a nine point eight gigabyte file. So it's huge
So we could unzip this you'll need the 7-zip program to do that and on a Mac
I install that using Mac ports and to do that. I type in sudo space port space install space
p7zip and if I run that it's already installed. So if you're on a boat, too, you should be able type sudo space apt
Space install space p7zip and that will install the command-line utility
So if I type in 7z space X or space L and then the name of this file, you'll see here
They'll tell us that this is 24 gigabytes. So I really don't want to uncompress this
I just want to query it as is so I'll walk through the procedure to do that if we type
7z space X and the name of the file and then type -so this sends the
File to standard out. So it'll print it on my screen in my terminal here
So if I hit enter you'll see this comes up in my terminal
So this file is a bunch of hashes of passwords that have been found in
Exploits and breaches and things like that in order to query it. We'll have to convert a password to a sha-1 hash
So I'll walk through that
So the first thing I'm going to do is we're going to be entering
Passwords on the terminal here and we don't want those stored in history
If you type history, you'll see a history of everything that's happened during a session
But what we can do is we can type in unset space and then this is in capitals. We type HISTFILE
We run that and this will disable the history when you're done. You can type in history and confirm that it hasn't been storing
What you've been doing, so that's a good idea to keep you from putting passwords in your history file
We'll want to to start off. I'll type echo space
- and quote and then password and
I'm checking the word password to see if it's in this file and we know it is because I just searched it online
So the -n will remove the line feed from this echo and then we want to do a sha-1 hash
Of it. So we'll just say shasum and 1 is the default
So if we run that right now we get this and that looks ok
but if you notice that this is in all caps and this here is in a
Lowercase and then you have this two spaces and a dash
so I'll push up and go back up to my command and I'll do another pipe and I'll first cut off the dash at the
End so I'll type cut space dash D space quote space quote
Space dash F 1 so what this is doing is D is the delimiter
So I said a spaces are delimiter and I want field 1
So when I run this I will just have the sha-1 hash
so I'll go back up again and I'll pipe this to TR and I'll do left bracket and then I'll say lowercase a
- lower case z right bracket and then I'll do the same thing with upper case the upper case A and Z
So uppercase A uppercase Z. If I run that now I end up with the sha-1 hash
In the same format. It's in the file
So I'm going to copy this now and then I'm going to type
7z X in the name of the file and then i'ma type -so
so this is
sending to standard out and then I'm going to pipe that to grep and then I'm going to type the left tick
Which is to the left of your 1 it looks like a quote mark
But it's kind of angled back and then I'm going to type left parenthesis. I'm going to paste in the commands
We typed up to create the sha-1 and then I'm gonna say right
Parenthesis, and then the tick again
And now when I run this at this will the first thing here will pass this file
Through to standard out and then it will repipe it through grep to filter it and it will filter by the sha-1 of password
So if I hit enter this will take a little while to run. I'll probably speed up the video
Okay, so that's finished now it took a while but this isn't a fast approach
It's just the one where you're not gonna compress the file
well we end up here is with the sha-1 hash and then it has the count which
Matches up with the one we looked up earlier so you can then hit the up arrow and go in here and type in another
Password and do it again and again and again like say this is not very fast
So, you know, you might want to hit it and then go I don't know watch a movie or something or you know
Watch a TV show or going to walk and then come back to it and then run a second one so you could also
Change this password here to be a shell variable and then just pass in you know
Change the variable value and then run the command again. So that was how to
Check out this pwned passwords list and run it against your password to check and see if it's in there
You have any questions, please leave it in the comments
If you liked this video, please click like if you haven't subscribed my channel
I appreciate if you could do that and thanks for watching until next time. Goodbye