The best way to approach testing for password weaknesses in your organization is from an ethical hacking perspective. The first -- and perhaps most important -- thing this involves is obtaining permission from upper management. If you're a consultant, written sign-off from your clients is especially important. Also, work by the Golden Rule when testing for password weaknesses and respect the privacy of others by protecting and never sharing the information once passwords are uncovered. This is not only the ethical thing to do but it's also a good way to keep from losing your job or getting into legal hot water.
The next step is to determine how you're going to go about your testing. You could test from the outside -- a true hacker's-eye-view -- or as an authenticated user and administrator on the internal network. If you want to simplify things and jump right in, you can simply run a password cracking program against your domain controller or specific computer(s) you wish to test. However, that's only half the story since there are likely so many other passwords around. Therefore, I recommend both the external and internal tests.
The external view will show you how things really appear from the outside. In this type of testing you can try to crack the following types of passwords from the outside world:
- IIS/Web applications
- SQL Server
- E-mail (SMTP, POP3, OWA, etc.)
- Terminal Services
- Remote Desktop Connections via RDP
- VNC and other third-party remote access software
The internal views as both a regular user and an administrator are valuable as well. Running such tests as a regular user with minimal network rights shows what the average employee, contractor, and other insider can see on the network. Finally, a follow-up cracking test logged in as an administrator equivalent will find additional weaknesses you may have overlooked or not been able to access otherwise. In this type of testing you can try to crack the passwords mentioned above (since you'll likely have a different network perspective inside the firewall) and, in addition, the following types of passwords as well:
- Local accounts
- Domain accounts
- Service accounts
- Windows shares
- NT cached secrets
- Protected storage (i.e. cached Internet Explorer, Outlook, etc. passwords)
- PWL files
- File protection passwords (i.e. protected .doc, .xls, .pdf, .zip, etc. files)
- Passwords stored in cleartext files on local and network drives
As you can see, there are more than just Windows passwords that can introduce information security risks on your network. Note that some of these tests require you to be logged into the local machine. This is obviously not realistic for more than a dozen or so machines; however, you should run them on your servers and critical workstations at a minimum.
Cracking network passwords
Step 1: Ethical hacking methodology
Step 2: Tools you should use
Step 3: What good are your findings?
ABOUT THE AUTHOR
Kevin Beaver is an information security consultant, keynote speaker, and expert witness with Atlanta-based Principle Logic, LLC where he specializes in performing independent security assessments.
This was first published in December 2005