I would like to check for weak passwords (they are dumped from Active Directory) without actually ever seeing the password (*). I just need to know that a given username has a weak password and inform him or her accordingly.
John the Ripper would be my first choice but I did not find a way to just list the cracked accounts.
I could parse the result file to extract the usernames but this still leaves open the possibility of seeing a password (inadvertly, by sending a
SIGHUP to the process etc.)
Is there a functionality of John the Ripper which could be used? (I did not see it in the docs)
Alternatively: is there cracking software with such functionality which could be used instead ?
(*) This is mostly to follow EU regulations on privacy which are not only restrictive but also vary from country to country. This is also the reason why I am looking for a bulletproof solution.