The next step is to determine how you're going to go about your testing. You could test from the outside -- a true hacker's-eye-view -- or as an authenticated user and administration on the internal network. If you want to simplify things and jump right in, you can simply run a password cracking program against your domain controller or specific computer(s) you wish to test. However, that's only half the story since there are likely so many other passwords around. Therefore, I recommend both the external and internal tests.
The external view will show you how things really appear from the outside. In this type of testing you can try to crack the following types of passwords from the outside world:
- IIS/Web applications
- SQL Server
- E-mail (SMTP, POP3, OWA, etc.)
- Terminal Services
- Remote Desktop Connections via RDP
- VNC and other third-party remote access software
- Local accounts
- Domain accounts
- Service accounts
- Windows shares
- NT cached secrets
- Protected storage (i.e. cached Internet Explorer, Outlook, etc. passwords)
- PWL files
- File protection passwords (i.e. protected .doc, .xls, .pdf, .zip, etc. files)
- Passwords stored in cleartext files on local and network drives
Cracking network passwords
Step 1: Understanding the limitation
Step 2: Tools you should use
Step 3: What good are your findings?
|ABOUT THE AUTHOR:|
| Kevin Beaver is an independent information security consultant, author and speaker with Atlanta-based Principle Logic LLC. He has more than 17 years of experience in IT and specializes in performing information security assessments. Beaver has written five books, including Hacking For Dummies (John Wiley & Sons, Inc.), the brand new Hacking Wireless Networks For Dummies and The Practical Guide to HIPAA Privacy and Security Compliance (Auerbach Publications). He can be reached at firstname.lastname@example.org.
Copyright 2005 TechTarget