From: GuidoZ (uberguidoz@gmail.com)
Date: Mon Dec 20 2004 - 03:13:39 EST
> If you have the time and disk space, Rainbow Crack is another very fast
> cracker. It creates tables of possible hashes based on the parameters
> you set, such as "lower-case, numeric". It takes about 640 megs for
> letters and numbers. It takes about 200 GIGS for special and alt chars.
>
> When you crack, it is incredibly fast because the work is already done
Something to add to this - frequently when doing pen-tests, you'll
find that weak passwords are only alphanumeric. Generating the rainbow
tables and popping them onto a CD or large USB thumb drive (or usb
hdd) works wonders. Then you can take them with and crack passwords
on the spot in minutes. (RainbowCrack will also run from a USB drive.)
-- Peace. ~G On Tue, 14 Dec 2004 09:30:35 -0800, John Forristel (SunGard-Chico) <John.Forristel@sungardbi-tech.com> wrote: > > If you have the time and disk space, Rainbow Crack is another very fast > cracker. It creates tables of possible hashes based on the parameters > you set, such as "lower-case, numeric". It takes about 640 megs for > letters and numbers. It takes about 200 GIGS for special and alt chars. > > When you crack, it is incredibly fast because the work is already done. > > > -----Original Message----- > From: Dan Connelly [mailto:connellyd@gmail.com] > Sent: Tuesday, December 14, 2004 4:25 AM > To: Jeffrey M. Miller CISSP > Cc: pen-test@securityfocus.com > Subject: Re: Password Audit tools > > Internet Scanner does a good job of enumerating accounts on a Windows > Domain(using netbios and null sessions) but if you tried to brute > force/dictionary every account that it found the scan would take a > VERY long time to complete. If you are trying to pw crack through a > service (ftp,telnet,http...), use hydra otherwise use LC or John the > Ripper. > BTW, Nessus also does a good job enumerating accounts, and its free ;) > Dan > > On Mon, 13 Dec 2004 19:10:29 -0600, Jeffrey M. Miller CISSP > <jmiller@acumeninfosec.com> wrote: > > I've used Internet Security Scanner from ISS and really like it's > > ability to pull users from NT domains and test common passwords, such > > as username=password, password=password, etc. > > > > I've considered purchasing the consultant version of l0phtcrack LC5. > > > > Has anyone used LC5 and can anyone compare it to ISS? Also are there > > any OpenSource tools that can do these sorts of checks? > > > > Thanks > > > > J_ > > > > > >
This archive was generated by hypermail 2.1.7 : Sat Apr 12 2008 - 10:54:11 EDT