3

I would like to check for weak passwords (they are dumped from Active Directory) without actually ever seeing the password (*). I just need to know that a given username has a weak password and inform him or her accordingly.

John the Ripper would be my first choice but I did not find a way to just list the cracked accounts.

I could parse the result file to extract the usernames but this still leaves open the possibility of seeing a password (inadvertly, by sending a SIGHUP to the process etc.)

Is there a functionality of John the Ripper which could be used? (I did not see it in the docs)

Alternatively: is there cracking software with such functionality which could be used instead ?

(*) This is mostly to follow EU regulations on privacy which are not only restrictive but also vary from country to country. This is also the reason why I am looking for a bulletproof solution.

Improve this question
6
  • 2
    You don't see the password tried, if you don't look at it. There is no way for the program trying to find a hash collision[1] not to know which weak password it just tried. ([1] ... may be a significant difference: you can't be sure that's the password of the user, just one that gives the same hash)
    – DaniEll
    Sep 23, 2016 at 9:08
  • An alternative would be to implement a check upon login, when the plaintext password is available, then alert users at that time. You'd also want to enforce password strength on password change, obviously, else they could just set it back to the weak one.
    – Matthew
    Sep 23, 2016 at 10:25
  • 1
    @DaniEll: You don't see the password tried, if you don't look at it -- I am not interested in the password, only in the fact that it matches one of my cracking rules. Of course the cracking software will know what the password was but it does not have to display it to me, that's all. For regulatory reasons I do not want the found password to be stored anywhere.
    – WoJ
    Sep 23, 2016 at 12:29
  • @Matthew: that would be indeed a possibility, but an intrusive one (the Windows GINA would have to be modified everywhere)
    – WoJ
    Sep 23, 2016 at 12:30
  • 1
    @WoJ It might be worth putting the requirement for it to break Windows passwords in the question. For most web applications, it would be relatively simple to modify the login process to allow enforcing of strong passwords, but it's harder (although not impossible) with Windows login passwords
    – Matthew
    Sep 23, 2016 at 12:42

4 Answers 4

Reset to default
3

I am not a lawyer, and my answer assume that you are in a professional context, meaning that what you are trying to crack testing are professional accounts given by an organization to its employees. As the general security of the organization could be weakened by poor passwords, I think that it can ask its employees to use not too weak passwords. I do not know a technical way to only disclose account with weak passwords without actually disclosing the password, so I would use a more than 2 eyes procedure:

  • at least 2 persons (a technical admin and a senior manager) must be involved in the operation, each one controling what the other does

  • you run john that way (assuming a Unix or Linux system):

    john password_file > /dev/null 2>&1
john --show password_file | sed -e 's/:.*//' > user_list.txt
rm ~/.john/john.pot

The user_list.txt file will contain only the name of the users for which the password was discovered by John The Ripper, but none of the persons running it has ever seen any password.

Improve this answer
2

Does your company enforce regular password changes? If so, when the password change comes around you could simply apply the transformation rules and wordlist you would have used with John the Ripper or HashCat or whatever, but instead of cracking a hash try to derive the plaintext new password being created as part of (or all of) the new password validation checks.

Improve this answer
1
  • That would be a possibility (and yes, the regular password changes are unfortunately enforced for compliance reasons (compliance to dumb standards)) - but as I mentioned in a comment, it would be very intrusive for the systems which are used (various MS Windows)
    – WoJ
    Sep 23, 2016 at 12:33
1

You could write a small python wrapper parsing the output of JTR and printing only what you want to print to stdout. That would do the trick I believe.

Improve this answer
0

You could download a wordlist, create hashes for each word, and store those hashes in a database. Then inform the people who have their hashes inside the database.

Or create a password policy and ask everyone to change their password.

Improve this answer
2
  • This is more or less what John the Ripper (the solution I mentioned in my question) does on the fly.
    – WoJ
    Sep 23, 2016 at 16:00
  • The extra benefit is that you could automate this check on the database if you create a new password. But you are absolutely right.
    – CaptainJack
    Sep 23, 2016 at 17:07

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .