From: Matthew Webster (awakenings@mindspring.com)
Date: Fri Mar 02 2007 - 15:12:17 EST
Folks,
For domain accounts, the passwords are not kept on a system. The verification is salted and hashed with md4 twice. I am trying to assess the following risks. 1) What is the danger that that verification could be misused on another system? 2) From that salted, hashed verification, can the password be derived? How likely is this?
Also, how would one perform a pen test against those salted, hashed verifications? Lets assume in the registry no one was ignorant enough to put the registry key which provides the password.
Thanks,
Matt
------------------------------------------------------------------------
This List Sponsored by: Cenzic
Need to secure your web apps?
Cenzic Hailstorm finds vulnerabilities fast.
Click the link to buy it, try it or download Hailstorm for FREE.
http://www.cenzic.com/products_services/download_hailstorm.php?camp=701600000008bOW
------------------------------------------------------------------------
This archive was generated by hypermail 2.1.7 : Sat Apr 12 2008 - 10:57:37 EDT