I recently wrote a website for my company and have been asked to Pen test it as well as the server. Have run SQL map and no vulnerabilities there, however I want to check if my hash and things are good enough as well as any vulnerabilities to the server its self. When I trained we had a working copy of L0phtcrack. Downloaded the trial to see if it was still as good.
I set it to the following:
> · Retrieve passwords by sniffing the local network · Perform > 'Strong' password audit · Display domain password belongs to · > Display passwords when audited · Display password hashes · Display > time spent auditing each password · Give visible notification when > done auditing · Show method used to crack password
However this gets me:
No encrypted passwords were imported. The l0phtcrack 6 wizard cannot continue. Please try another password retrieval.
So I run the wizard again to check my local PC just to see if there is a problem, And I get the same response I cannot do anything.
So I have two questions:
1: What am I doing wrong? It has been a fair few years since I properly pen tested and am very rusty.
2: Anything better out there currently to detected and crack packets? I know about wireshark for sniffing.
I do now realize that it has stopped being supported and developed, in that case good alternatives for packet sniffing and cracking