1

I need to brute force Last Pass since I forgot my master password. Anyone know how is the format of the local storage of the extension?

I was logged into it so it must have local data. I see words.dic and LPMPMU in local storage.

schroeder
  • 129,372
  • 55
  • 299
  • 340
cswl
  • 111
  • 1

1 Answers1

1

Lastpass uses PBKDF2 for password hashing with 5000 iterations and SHA-256 (reference).

So if you have actually forgotten your password I doubt that you will be successful using brute force.

If you want to estimate your success probability get hashcat and run it in benchmarking mode. It will figure out how many hashes/second it can try and if you tell it what you are looking for (maybe you still have a vague idea what the password was) even how many possibilities there are and how long it will take.

Elias
  • 1,970
  • 1
  • 11
  • 17
  • Can you tell me what the local storage data means? https://imgur.com/evX9N3h – cswl Jan 27 '18 at 10:18
  • I'm 99% sure I know what keywords are used in my pw but I must've made some weird iteration of it (or lastpass has a bug?). Is it possible to do a dictionary attack using my keywords? – Joe Phillips Aug 28 '18 at 14:17