I was thinking last night after reading an article about pen testing and security audits, why would you get a list of all the passwords for the company you are auditing and put them through a piece of software to analyse ?
You wouldn't get a list of all the passwords. Any company that could or would produce such a thing would fail any reasonable security audit.
You might get a list of all the password hashes which could then be run through a tool that attempts to determine what the password is. The ease with which the password hashes can be broken and the types of passwords that are broken will be a good guide to figuring out what password complexity policies need to be addressed. If, for example, you're able to crack half of the password hashes because users are entering 6 character passwords that use all lower case letters, then you'd probably recommend increasing the minimum length and imposing some requirements about the use of uppercase letters, numbers, punctuation and other characters.
To test for potentially weak passwords that can be cracked easily by a malicious attacker.
This could give an indication of the state of the password policy of the particular company, which might be an issue in certain circumstances.
If there are plenty of weak passwords found, the pen tester could suggest to the company to change and enforce a better password policy.
Of course, i see no reason to ask the company to hand over a list of passwords. Perhaps it could be a list of passwords found after compromising a user database, or a linux shadow file.
If you do this from the same ip number and for root account and you have firewall switch off and sshd started up - this is definitely dangerous :-)
ps. Passwords should not be used in plain text, it should be stored only in the memory of users. Dealing with lists of user passwords would be seriously no good.
The best is to enforce a nice policy on password change and expire them, so after users will be asked to change the password, so then you will know that it's all fine and the passwords are strong. And they should be stored as salted hash, preferably 100.000 times hashed.