tools to check password security

Question

I'm after a tool to test how long a password could stand up to a hacking/cracking technique such as brute force as two passwords that are critical to a work system is one word that is in the dictionary, and another is a word in the dictionary with a capital letter and a number instead of a letter.

I'd prefer it to be offline and free that you can run on a computer to see how long the password will hold out. Maybe even at the windows login prompt but I realise such programmes may be shady and erring on the side of illegal.

Anybody have any suggestions?

Answer 1

If you're the administrator and you have permission to use it on your own network, they're not illegal.

If you already have the password you could easily estimate a rough figure of how secure it is. If it's a Windows domain, you can set the policy to lock out the account after X number of incorrect tries and specify how long to lock out the account; this makes brute forcing extremely infeasible. Second, if the password isn't based on a word (or words) in the dictionary, you are ahead of the game. Combination of uppercase, lowercase, numbers, maybe even symbols will keep it from being easily cracked.

Seeing how long the password holds out isn't a good estimate, since you don't know if a potential attacker has distributed computing power at their disposal or what kind of horsepower they'd have anyway. And if you already have a non-dictionary based password that is regularly changed, combined with lockout policies, then your bigger worry moves to people shoulder-surfing or social engineering your system or using keystroke loggers or sniffers, all of which renders the password @##$%@FFFES#@12 about as secure as a house walled with cellophane anyway.

Answer 2

Lockout policies are much more effective than harsh password policies: if you allow people relatively easy passwords, they're less likely to write them on a sticky note, and attach them to the underside of their keyboard.

Just lock the account after three tries, and set it to automatically unlock after 90 minutes or so. 48 password attempts a day isn't enough to run a simple dictionary attack, more less any sort of complicated brute forcing. And log parsing should tell you if someone is actually trying to brute force a password long before they succeed.

Answer 3

Turn off LM hashes and make your passwords as long as you can stand them, preferrably with passphrases (to mitigate against rainbow table attacks).

The LANManager scheme has several weaknesses, including converting all characters to uppercase, splitting passwords into 7-byte chunks, and not using a salt.

NTLM and NTLMv2 is significantly harder to crack: a passphrase such as "This password is pretty darn solid!" is alot harder to crack than "P4$$w0rd" by length alone.

Take a look at the following for more reasons why: http://www.ethicalhacker.net/content/view/94/24/