So at the moment I've configured and enabled password of Cisco no service password encryption is configured.
Which means that the password is shown showing clear text the advantage of an enable password is when
I type enable I'm asked to enter a password.
When you connect to a live router by default you're in user mode and if an enable password hasn't been
configured you are immediately able to access privilege mode or OK mode.
But when a password is configured you'll be prompted to enter the password before you can access that
mode.
Now Cisco recommend that you use enable secret rather than an able password.
And that's because this uses a better encryption Jesus empty five hashing to hash a password.
I'll show you a demonstration of hashing in a moment.
In a similar way to the Enable password we can enter is zero which means we entering the password as
unencrypted or 5 which means that the password that follows is encrypted.
You don't have to enter Zerah by default either.
So I'm just going to say enable secret Cisco.
But notice what happens I'm told that the Enable secret you have chosen is the same as the Enable password.
This is not recommended.
Re-enter the Enable password when I type show run pipe include enable.
You'll notice it did except the secret password but I'm told that I should re enter the password.
So let's follow Cisco's advice and I'll set the password to Hello.
So enable secret Hello.
Now when I typed controls that are control Z and disable and top enable I'm actually typing Hello rather
than Cisco to access the privilege mode or enable mode when I type show run will do the full running
config so that you can see it in the output.
Notice nocive is possible encryption is configured but the secret password is hashed.
It's encrypted by default.
You can't decrypt that in the same way that I showed you using the hacking tool.
The hacking tool only works with type 7 passwords and this is a lot more secure than Top 7.
Now I've shown you how to hack.
Type seven password.
It's not as easy to do that with a empty five password.
This tool is also available as part of the cost.
Look below the video to use it.
This is a hashing application that shows you empty five hashing versus Shaugh hashing versus Shaar 256
schaw 512 and Shaw 384 M.D five hashes 128 Butson lengths and it's actually recommended for VPN or virtual
private networks that you don't use empty five hashes.
But Cisco routers are still using M.D five hashes for the secret password.
If I can figure a password of Cisco and then click hash this application will show me the hexadecimal
hash of that password the binary hash as well as the Shaw hashes of that password.
And what you'll notice is the sharp passwords are a lot longer.
These are hex values.
So each of value that you see here is four binary ones.
These are going to be a lot longer and a lot more secure than an empty five hash of 128 bits.
But for now keep your eye on the binary and the empty five.
And all I'm going to do is add one more character.
So at a one at the end and click hash again and what you should have noticed is that the hash changed
quite dramatically from the previous example.
Notice that the is 0 8 1 6.
When I put another character in and I'll just put in a dot click hash.
Notice the entire number has changed.
So even a minor change in the source text will cause the hash to change entirely.
So in other words if you change your password the whole hash changes.
So it's much more difficult for someone to try and crack this password than say using service password
encryption.
So once again recommend that you use a secret password rather than an enable password.