AspNetCoreCracker

2017

AspNetCoreCracker is a proof-of-concept tool that attempts to recover passwords from ASP.NET Core Identity hashes through a dictionary attack, written to illustrate that the framework’s default of 10,000 PBKDF2 iterations was, in my opinion, too low to withstand an opportunistic offline attack.

The tool supports the version 3 hash format and dynamically extracts and reuses each hash’s parameters (key derivation function, salt, subkey size and iteration count). It is a defensive research tool, meant to help developers assess the strength of their stored credentials and choose appropriate hashing parameters.