Problem solve Get help with specific problems with your technologies, process and projects.

Step 1: Ethical hacking methodology

Weak passwords can be a huge security vulnerability. You can mitigate this risk by attempting to find your weaknesses before a malicious hacker does. Contributor Kevin Beaver provides a step-by-step guide on how to crack your own network passwords.

The best way to approach testing for password weaknesses in your organization is from an ethical hacking perspective. The first -- and perhaps most important -- thing this involves is obtaining permission from upper management. If you're a consultant, written sign-off from your clients is especially important. Also, work by the Golden Rule when testing for password weaknesses and respect the privacy of others by protecting and never sharing the information once passwords are uncovered. This is not only the ethical thing to do but it's also a good way to keep from losing your job or getting into legal hot water.

The next step is to determine how you're going to go about your testing. You could test from the outside -- a true hacker's-eye-view -- or as an authenticated user and administrator on the internal network. If you want to simplify things and jump right in, you can simply run a password cracking program against your domain controller or specific computer(s) you wish to test. However, that's only half the story since there are likely so many other passwords around. Therefore, I recommend both the external and internal tests.

The external view will show you how things really appear from the outside. In this type of testing you can try to crack the following types of passwords from the outside world:

  • IIS/Web applications
  • SQL Server
  • E-mail (SMTP, POP3, OWA, etc.)
  • Terminal Services
  • Remote Desktop Connections via RDP
  • VNC and other third-party remote access software

The internal views as both a regular user and an administrator are valuable as well. Running such tests as a regular user with minimal network rights shows what the average employee, contractor, and other insider can see on the network. Finally, a follow-up cracking test logged in as an administrator equivalent will find additional weaknesses you may have overlooked or not been able to access otherwise. In this type of testing you can try to crack the passwords mentioned above (since you'll likely have a different network perspective inside the firewall) and, in addition, the following types of passwords as well:

  • Local accounts
  • Domain accounts
  • Service accounts
  • Windows shares
  • NT cached secrets
  • Protected storage (i.e. cached Internet Explorer, Outlook, etc. passwords)
  • PWL files
  • File protection passwords (i.e. protected .doc, .xls, .pdf, .zip, etc. files)
  • Passwords stored in cleartext files on local and network drives

As you can see, there are more than just Windows passwords that can introduce information security risks on your network. Note that some of these tests require you to be logged into the local machine. This is obviously not realistic for more than a dozen or so machines; however, you should run them on your servers and critical workstations at a minimum.

Cracking network passwords

 Home: Introduction
 Step 1: Ethical hacking methodology
 Step 2: Tools you should use
 Step 3: What good are your findings?

Kevin Beaver is an information security consultant, keynote speaker, and expert witness with Atlanta-based Principle Logic, LLC where he specializes in performing independent security assessments.

Dig Deeper on Windows Server troubleshooting