Gaining Access

The goal here is to collect enough information to gain access to the target.

Password Cracking: 

There are few basic methods of password cracking:

1. Bruteforce: trying all possible combinations until the password is cracked.

2. Dictionary attack: This is a compiled list of meaningful words, compared against the password field till a match is found.

3. Rule based attack: If some details about the target are known, we can create rules based on the information we know.

4. Rainbow table: Instead of comparing the passwords directly, taking the hash value of the password, comparing them with a list of pre-computed hash values until a match is found.

Rainbow table method gives an advantage to the attacker since no account lockout is enabled for wrong hashes against the password. To prevent rainbow table attack, salting can be used. Salting is a process of adding random numbers to the password so the attacker will not be able to crack the hash without that salt added.

Types of Password Attacks 

Passive online attacks

A passive attack is an attack on a system that does not result in a change to the system in any way.

The attack is to purely monitor or record data.

• Wire Sniffing

• Man in the middle

• Replay attack

Active online attack

An active online attack is the easiest way to gain unauthorized administrator-level access to the system

• Password guessing

• Trojan/spyware/keyloggers

• Hash injection

• Phishing

Offline attacks

Offline attacks occur when the intruder checks the validity of the passwords. Offline attacks are often time to consume. 

• Pre-computed hashes

• Distributed Network

• Rainbow

Non-electronic attacks

Non-electronic attacks are also known as non-technical attacks. This kind of attack doesn't require any technical knowledge about the methods of intruding into another system.

• Social engineering

• Shoulder surfing

• Dumpster Diving

How to defend against password cracking: 

• Don't share your password with anyone

• Do not use the same passwords during password change

• Enable security auditing to help monitor and track password attack

• Do not use cleartext protocols and protocols with weak encryption

• Set the password change policy to 30 days

• Monitor the server’s logs for brute force attacks on the user’s accounts

• Avoid storing passwords in an unsecured location

• Never use passwords such as date of birth, spouse, or child’s or pet’s name

• Enable SYSKEY with the strong password to encrypt and protect the SAM database

• Lockout an account subjected to too many incorrect password guesses.