Skip to main content

Entering Password Protected Windows Computer without the Password

 If you have a windows laptop and you don’t know the password for some reason (!) (Maybe it’s not yours ?) and want to login without entering the password, here’s a simple way to hack it without being too technical.


You just need to bypass the password protection.


I didn’t try this method on other windows versions, you can give it a try but for windows 10 and windows 11 it works perfectly fine.

(You need an empty physical pen drive to bypass)


Step 1:

Download Hiren Boot ISO file:

https://www.hirensbootcd.org/


Step 2:

Mount the iso file to your USB (You will lose all of the data)

You can use RUFUS to do this.

I will skip this step.



Step 3:

Start the windows computer you want to bypass the password, and open the BIOS menu.

Depends on the manufacturer the BIOS menu can be opened with F12, ESC or Delete buttons from the keyboard during system boot.

Step 4:

Select the USB from BIOS menu to boot.


Step 5:

It will open live os, similar to a windows environment but it’s not… We will use this to delete the password.

From here, you need to delete the password of the user by following these steps:

1) from start menu search and start


Lazesoft Password Recovery


Follow the steps after launching recovery tool:




Select the windows user you wanna break into and “REMOVE” the password.



Click that big blue button.



Done, now let’s enter to the user’s windows account.
Click to restart button from the menu and remove the pen drive from the usb input.


As you can see, it didn’t ask for a password.


Done.

And this my friends, is how you can unlock a windows laptop without actually using other complicated hacking methods. I think even a kid can do this.

You can do this on Linux too but it’s a little different…

On corporate environments you can exploit computers in many ways, you can actually exploit anything without having physical access but that’s for another post…


Phoenix

Labels:

Comments

Post a Comment

Popular posts from this blog

Beyond the Pentest: Why We Do What We Do

  “We had a two-week pentest. They gave us a 40-page report. We fixed the high-severity issues. Are we secure now?” This is a line I’ve heard far too many times from CISOs and security leads and I always give them the same answer: No, you’re not secure. Not even close. I’m a penetration tester, but not the kind you’re used to. Let me explain. The Old Red vs Blue Paradigm Is Dead We’re no longer living in a world where attackers show up, hit your network hard for a few days, and disappear. Real adversaries stay there and observe you for months. Even for Years . They don’t follow rules of engagement. They evolve. They study you. And they compromise you slowly. The traditional red team-blue team separation, and the "2-week pentest, fix top 5 CVEs" checklist approach? It’s outdated. It gives a false sense of security . We don’t play by those rules at Gl1tch | Risk. Offensive Security as a Service – A Different Approach In our practice, we go beyond traditional penetration testing...
Post a Comment
Read more

Stop the Scammers. Detection of Homoglyph Attack Attempt using KQL (Kusto Query Language)!

  Phishing attempts are getting sneakier, often leveraging homoglyph attacks or unusual characters to trick employees. I put together a simple but effective query to scan for new users created with "weird" characters in the email domain that indicates a potential sign of a spoofed or malicious account creation attempt. KQL Breakdown: This query scans 7 days of CloudAppEvents for the `Create user.` action, then checks the new user's email domain for any non-ASCII characters (characters outside the standard English keyboard set: $\text{U+0000}$ to $\text{U+007F}$) . This is a great starting point for spotting internationalized domain name (IDN) abuse or other sophisticated L3 attacks. CloudAppEvents | where TimeGenerated > ago(7d) | where ActionType == "Create user." | extend Email = tostring(parse_json(RawEventData).EmailAddress) | extend Domain = tostring(split(Email,"@")[1]) | where Domain matches regex @"[^\u0000-\u007F]" | project Ti...
Post a Comment
Read more