Looking for a tool or utility to crack password?

Security >> Looking for a tool or utility to crack password? We are trying to educate our users the importance of using complex password
and i am looking for a utility or any software available on the market to
demonstrate to them how easy to crack their password if using simple
password. They will just enter their password and it will show how fast it is
decoded. The utilty is not intented to run against the domain logon account.
They will just key in their password and the tool will either shows how
quick it is easily cracked because it is not complex.

Appreciate if you know the avaiability of such tool. Thks

Windows OS229

Security >> Looking for a tool or utility to crack password? Let me get this right, you will have your users go to some
tremendously well secured interface where they will be asked
to enter their password. You then want some tool that looks
at the password and says how hard it is to crack it?

Hmmmm. So we train the users to go and enter their password
on pages that do not look like system login pages. We have that
password travel to the server is a less well securied way than it
ever does when the OS remotely challenges for authentication.
And finally, we guess how difficult it would be to crack into that
password once it has been hashed. Is that about right ?

People usually just get one of the cracking tools, free or for low
cost, and then run that against the account store and then notify
the people of how long it took to find their password.

--
Roger Abell
Microsoft MVP (Windows Server : Security)
MCDBA, MCSE W2k3+W2k+Nt4
"Guy" <EMail@HideDomain.com> wrote in message
news:EMail@HideDomain.com...
> We are trying to educate our users the importance of using complex
> password
> and i am looking for a utility or any software available on the market to
> demonstrate to them how easy to crack their password if using simple
> password. They will just enter their password and it will show how fast it
> is
> decoded. The utilty is not intented to run against the domain logon
> account.
> They will just key in their password and the tool will either shows how
> quick it is easily cracked because it is not complex.
>
> Appreciate if you know the avaiability of such tool. Thks
>

Security >> Looking for a tool or utility to crack password? Hi Roger,

Thanks for the reply, May be i did not ask the question properly. It will be
just an interface on a laptop not connected to the network that the user will
key in the password where the tool will demostrate if the password has passed
complexity else it will show that it is cracked within a split of a second.

I do understand that we are using Kerberos protocol for password
authentication since we are all XP and 2003 but my main concern is that some
of our users will still not follow the rule of password complexity. Some of
them are still using names of their children with some numbers for domain
logon.

Thks,
Guy

"Roger Abell [MVP]" wrote:

> Let me get this right, you will have your users go to some
> tremendously well secured interface where they will be asked
> to enter their password. You then want some tool that looks
> at the password and says how hard it is to crack it?
>
> Hmmmm. So we train the users to go and enter their password
> on pages that do not look like system login pages. We have that
> password travel to the server is a less well securied way than it
> ever does when the OS remotely challenges for authentication.
> And finally, we guess how difficult it would be to crack into that
> password once it has been hashed. Is that about right ?
>
> People usually just get one of the cracking tools, free or for low
> cost, and then run that against the account store and then notify
> the people of how long it took to find their password.
>
> --
> Roger Abell
> Microsoft MVP (Windows Server : Security)
> MCDBA, MCSE W2k3+W2k+Nt4
> "Guy" <EMail@HideDomain.com> wrote in message
> news:EMail@HideDomain.com...
> > We are trying to educate our users the importance of using complex
> > password
> > and i am looking for a utility or any software available on the market to
> > demonstrate to them how easy to crack their password if using simple
> > password. They will just enter their password and it will show how fast it
> > is
> > decoded. The utilty is not intented to run against the domain logon
> > account.
> > They will just key in their password and the tool will either shows how
> > quick it is easily cracked because it is not complex.
> >
> > Appreciate if you know the avaiability of such tool. Thks
> >
>
>
>

Security >> Looking for a tool or utility to crack password? There is a free tool called Cain password cracker available at the link
below.

http://www.oxid.it/

You can not enter a password but you install it, logon as an administrator,
and dump the hashes from the SAM. Then you can select passwords to crack.
Note that by default lm hashes are stored which are easy to crack. Once you
disable storage of lm hashes and change your password it will be more
difficult. In addition to password complexity it is a great idea to have a
long minimum password length such as 15 characters and train users to think
pass phrases instead of passwords. The passphrase should include spaces
between words instead of all run together as in My dogs name is bud! . To
you and me it looks like a simple easy to remember password but try to crack
it. Another interesting thing you will find is how Cain can instantly
display protected storage password such as those used my your email account
for OE, etc which is why a user should NEVER user their logon password for
anything else as that is one of the first things an attacker will do is to
try and use passwords found in protected storage. --- Steve

"Guy" <EMail@HideDomain.com> wrote in message
news:EMail@HideDomain.com...
> We are trying to educate our users the importance of using complex
> password
> and i am looking for a utility or any software available on the market to
> demonstrate to them how easy to crack their password if using simple
> password. They will just enter their password and it will show how fast it
> is
> decoded. The utilty is not intented to run against the domain logon
> account.
> They will just key in their password and the tool will either shows how
> quick it is easily cracked because it is not complex.
>
> Appreciate if you know the avaiability of such tool. Thks
>

Security >> Looking for a tool or utility to crack password? It would be much more simple to just crack against the saved,
live passcode store and submit the cracked ones for action,
whether that is setting password age so next login change is
required, plus an email of corp policy and that is why they are
being required to change password, plus count of times they
have gone through the process.

In my experience, as Byron indicates also, requiring users to
do something aimed at getting them to do something else that
they are not doing is not really going to bear fruit.

"Guy" <EMail@HideDomain.com> wrote in message
news:EMail@HideDomain.com...
> Hi Roger,
>
> Thanks for the reply, May be i did not ask the question properly. It will
> be
> just an interface on a laptop not connected to the network that the user
> will
> key in the password where the tool will demostrate if the password has
> passed
> complexity else it will show that it is cracked within a split of a
> second.
>
> I do understand that we are using Kerberos protocol for password
> authentication since we are all XP and 2003 but my main concern is that
> some
> of our users will still not follow the rule of password complexity. Some
> of
> them are still using names of their children with some numbers for domain
> logon.
>
> Thks,
> Guy
>
> "Roger Abell [MVP]" wrote:
>
>> Let me get this right, you will have your users go to some
>> tremendously well secured interface where they will be asked
>> to enter their password. You then want some tool that looks
>> at the password and says how hard it is to crack it?
>>
>> Hmmmm. So we train the users to go and enter their password
>> on pages that do not look like system login pages. We have that
>> password travel to the server is a less well securied way than it
>> ever does when the OS remotely challenges for authentication.
>> And finally, we guess how difficult it would be to crack into that
>> password once it has been hashed. Is that about right ?
>>
>> People usually just get one of the cracking tools, free or for low
>> cost, and then run that against the account store and then notify
>> the people of how long it took to find their password.
>>
>> --
>> Roger Abell
>> Microsoft MVP (Windows Server : Security)
>> MCDBA, MCSE W2k3+W2k+Nt4
>> "Guy" <EMail@HideDomain.com> wrote in message
>> news:EMail@HideDomain.com...
>> > We are trying to educate our users the importance of using complex
>> > password
>> > and i am looking for a utility or any software available on the market
>> > to
>> > demonstrate to them how easy to crack their password if using simple
>> > password. They will just enter their password and it will show how fast
>> > it
>> > is
>> > decoded. The utilty is not intented to run against the domain logon
>> > account.
>> > They will just key in their password and the tool will either shows how
>> > quick it is easily cracked because it is not complex.
>> >
>> > Appreciate if you know the avaiability of such tool. Thks
>> >
>>
>>
>>

Security >> Looking for a tool or utility to crack password? Just want to thanks everybody for their suggestion. I totally agree that we
should keep on educating the end users on using strong password as part of
the company's policy.

May be my option for a tool might be irrelevant as an additional exercise.
I am not a security expert and is thankful to your suggestions.

"Steven L Umbach" wrote:

> There is a free tool called Cain password cracker available at the link
> below.
>
> http://www.oxid.it/
>
> You can not enter a password but you install it, logon as an administrator,
> and dump the hashes from the SAM. Then you can select passwords to crack.
> Note that by default lm hashes are stored which are easy to crack. Once you
> disable storage of lm hashes and change your password it will be more
> difficult. In addition to password complexity it is a great idea to have a
> long minimum password length such as 15 characters and train users to think
> pass phrases instead of passwords. The passphrase should include spaces
> between words instead of all run together as in My dogs name is bud! . To
> you and me it looks like a simple easy to remember password but try to crack
> it. Another interesting thing you will find is how Cain can instantly
> display protected storage password such as those used my your email account
> for OE, etc which is why a user should NEVER user their logon password for
> anything else as that is one of the first things an attacker will do is to
> try and use passwords found in protected storage. --- Steve
>
> "Guy" <EMail@HideDomain.com> wrote in message
> news:EMail@HideDomain.com...
> > We are trying to educate our users the importance of using complex
> > password
> > and i am looking for a utility or any software available on the market to
> > demonstrate to them how easy to crack their password if using simple
> > password. They will just enter their password and it will show how fast it
> > is
> > decoded. The utilty is not intented to run against the domain logon
> > account.
> > They will just key in their password and the tool will either shows how
> > quick it is easily cracked because it is not complex.
> >
> > Appreciate if you know the avaiability of such tool. Thks
> >
>
>
>