Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm after a tool to test how long a password could stand up to a hacking/cracking technique such as brute force as two passwords that are critical to a work system is one word that is in the dictionary, and another is a word in the dictionary with a capital letter and a number instead of a letter.

I'd prefer it to be offline and free that you can run on a computer to see how long the password will hold out. Maybe even at the windows login prompt but I realise such programmes may be shady and erring on the side of illegal.

Anybody have any suggestions?


locked by HopelessN00b Feb 14 '15 at 2:42

This question exists because it has historical significance, but it is not considered a good, on-topic question for this site, so please do not use it as evidence that you can ask similar questions here. This question and its answers are frozen and cannot be changed. More info: help center.

closed as off-topic by HopelessN00b Jan 26 '15 at 0:38

This question appears to be off-topic. The users who voted to close gave this specific reason:

If this question can be reworded to fit the rules in the help center, please edit the question.

up vote 3 down vote accepted

If you're the administrator and you have permission to use it on your own network, they're not illegal.

If you already have the password you could easily estimate a rough figure of how secure it is. If it's a Windows domain, you can set the policy to lock out the account after X number of incorrect tries and specify how long to lock out the account; this makes brute forcing extremely infeasible. Second, if the password isn't based on a word (or words) in the dictionary, you are ahead of the game. Combination of uppercase, lowercase, numbers, maybe even symbols will keep it from being easily cracked.

Seeing how long the password holds out isn't a good estimate, since you don't know if a potential attacker has distributed computing power at their disposal or what kind of horsepower they'd have anyway. And if you already have a non-dictionary based password that is regularly changed, combined with lockout policies, then your bigger worry moves to people shoulder-surfing or social engineering your system or using keystroke loggers or sniffers, all of which renders the password @##$%@FFFES#@12 about as secure as a house walled with cellophane anyway.

well, Junior Sysadmin, but on my way ;). The thing is, the thee places I have worked (public and private) schools, the administrator password wasn't regularly changed because it was used for so many things it would have been a pain to change it for login, VNC, and support accounts. They just dont seem to worry about security in that respect. You have a point about shoulder surfing, being in a school with teachers and projectors, sometimes they type tier passwords in their username box and hope the pupils won't notice. – tombull89 May 20 '10 at 0:03

Lockout policies are much more effective than harsh password policies: if you allow people relatively easy passwords, they're less likely to write them on a sticky note, and attach them to the underside of their keyboard.

Just lock the account after three tries, and set it to automatically unlock after 90 minutes or so. 48 password attempts a day isn't enough to run a simple dictionary attack, more less any sort of complicated brute forcing. And log parsing should tell you if someone is actually trying to brute force a password long before they succeed.

as I'm in a school I'd have to jump through all sorts of hoops to get a lockout policy in effect but currently there is nothing of the sort. TBH we've got more important things to worry about than checking the server logs, although admittedly this is something I should do more often (and will from now on) – tombull89 May 20 '10 at 0:05

Turn off LM hashes and make your passwords as long as you can stand them, preferrably with passphrases (to mitigate against rainbow table attacks).

The LANManager scheme has several weaknesses, including converting all characters to uppercase, splitting passwords into 7-byte chunks, and not using a salt.

NTLM and NTLMv2 is significantly harder to crack: a passphrase such as "This password is pretty darn solid!" is alot harder to crack than "P4$$w0rd" by length alone.

Take a look at the following for more reasons why:

crikey, that's quite an article. Thanks for the link, will be very useful. – tombull89 May 19 '10 at 23:55
It is, it's a research paper, really. I strongly recommend reading it top to bottom though: it does a great job explaining why we go through all the trouble of strong passwords in the first place. – gravyface May 20 '10 at 0:03

Not the answer you're looking for? Browse other questions tagged or ask your own question.