ISCS-3513

Information Assurance and Security

Password Cracking

Lab 3 100 Points

For this lab you will need access to a computer that has Internet access and on which you can install password cracking programs; or, you can use your virtual machine in the Computer Security Lab(CSL) where the password cracking programs are loaded. The lab is designed to acquaint you with methods used to encrypt password files and how these methods can be overcome.

I will email you some password files to cracka Windows password file and a Unix password file.

 -----BEGIN PGP PUBLIC KEY BLOCK-----

mQINBFpqQ4cBEAC/FinxbYveO/1Xdgy6JAcXor+dEBL5wFToR8seWijs2bUYeY1j

5p+SUhkryelaPhX0qTHgCI/9OjyEpHEy89ruHM49XxYNMVce01A5Bc6NICp2ET5d

SUKAoQ2OAo+ZhRsGh8/Yb4NO3SEHPnTsrddhHF7gBwmwSplzxcIpZnQPcb9xCL0P

ceAlPHlcZDgRTpUK0rFOgsN/5bMezHliZ8YlDdAiuabMl1j7ceAbaWEl8wE1ICYV

QRq3TmRb+NRT+aWiv2/IeD8bewXKEwPg9JP4Q6Zhk5wdNWuIfC3e2q6rPDZsKsbD

T9SBfzYRRwTiARKZ2MCpd5QXzSpQtej3vsvas4d67AZsf33HploJ33hzjloyJe5u

fP9WwEqjuJGurnkthpY5HnB5Abx13NAsWvh6umVtd4dUbndvXpZHFA3rT3AS/6DD

ICGa8e9Ua+yeCEO9HwmMYLJLydzK3yaAMgetVz982iZ82d2cqCGHcFRscYMM+Xxf

sWclJpEU5JXKwE+X/vEFRuC/hMWyxZIg4kKqpq5+ZvLHIArEtzLF3ExxtiWQP1Po

EVnkmE4sOXLn1cBakQP3IPohMCWytbPBmtQO1t8haO9XQcGO9KRIy0GCTU1wD2ph

m9K95hx2du4FcolFoR4ITzb8K+ddJEEuRVAQVwLbgI0BDRsc/FnI9ewmSQARAQAB

tC1EYXJyZW4gRnJhbnNlbGxhIDxkYXJyZW4uZnJhbnNlbGxhQGdtYWlsLmNvbT6J

AlQEEwEIAD4WIQQyBCdrLM1IrXSWW/n/94zn4t/pRQUCWmpDhwIbAwUJB4YfgAUL

CQgHAgYVCAkKCwIEFgIDAQIeAQIXgAAKCRD/94zn4t/pRVgmD/92XL0aV0mjlLDE

642JVzPuVMkXjv4IR60e8N8nJZ0GECJcAxvtbG4AKidiL3HimxiDw4F/upnk7T6B

OQ9Tu2uYnuQCQwuzu47JrLDU5+NtWuQhzqv4LoSX8+CaPvZb8dKNnsADmQ+pa9xE

FUav3mMaGLvdv9fAUPzSvquc/gSvZO86a0z70MYcIM5PtHW9NbX1L7PxA9s5HKYT

CIXN7O73jnAI0FwwKFnods/sPjfvGEfCFdEOIC2+qBd2BSAk85miEM4xgeaNVmTm

D1LhxAGn5G1i/eKf39YZHSIZF7c0o32AkU4DArIMEXCeFIhE0ezvkfKopsrhfsHn

6rIYGR+PJzD8V2zyp7O5Pf6uJsxfuYA5auPVSldL28is1vXLThtDpXI8zhXlCoA2

t1EdNXF8NY8NpEpiI73SHfME4x1RK9mp+HPM9e2Zy4Sudw5rGu4nQPg5fgMCvm2j

FNPo1b3I9rg0S+jx5L+lqHYtwTDMbI+JpHZE6Tmf322VT8muJ6RWtifg+7Vp+ci0

fz8N7lfu0AyZI5hLt152m0xoEHQca6Ydaz2U3yhSnKSEMA/JEuUEYPZdr2SAlNfg

59S/69KQsaSgN7bvcHJi/i2IPHpcpjF6TZNP2xzzp2HqHlpqnT9aGjyWHVNPaVtq

2NtjThSmYtLRcTBANU9FKf3GiMkQn7kCDQRaakOHARAAm3lZg06BagYYvlXm34zE

GODnkVIlpYwT8fWv88aVrjj6K6qs4Vz5csCyXRTStEqE3vjZrlj3yMzAL4XBWGKv

WOKUYIj/oe/IkkkPFb3J01px5zHmE/SQ5LM9ul/f+OIUpbj4gGchycFp1RBaRZO9

Fn6fMaEZQERsUVwD+Ci0VwAC+rYDx8Dy/Sk2Os7SZ/iaWLcuKg9Pwp2jedD1wdp1

dpU6v1kvtVCtYqv1Jj1vYJiWXB2TL2ddtxOMjUSQi+qSp3ZM1Tel1b3z+Ox+h3OK

0n1JkYMy2v7V+cQWOcAHwBDrnmN51yvTH89iaHfHiQSor+hZP8TeyQq02G4U/kTe

E5n+wCNOuKvGWG0r0ikiR8OBg9ucOp8YvTyVIzZuXjSn42beDaEtaOb+bMnouKmz

q7xVQckbZYJ9BuahqUHfSxIwW/Q7rYi1AOkwFVrq5T/9jSasQtNdKG2kJjOvL0Dx

Wtkyq8Sb9VlRDcV9xbmK2QVlJdpOha6022OBK12oEHmSJh16sv7yn7pG/SoUb0+G

YHDm3bdRD5aNAJkPJe7CMvh7gMfPL9Rfa7/FBGBq9Gs2u0z+Wqxt6HeOBP2JCSJx

SOeMrBfAkBGxG9GpODriiKoNUvleZCFIsuSB9iufc8z33diiB0CQD70DCNfnDCJY

3tJ1XWhiUxsoR6Tl1oUWXlMAEQEAAYkCPAQYAQgAJhYhBDIEJ2sszUitdJZb+f/3

jOfi3+lFBQJaakOHAhsMBQkHhh+AAAoJEP/3jOfi3+lF6OEP/1FBpCXbKCe+sArB

D6c+tw3gnT54JSBZsnEI33ZedwardkqkMLpgAe3Kb0doIn9S7D+FZ7Ly1voJmkPF

60Mbzo+d+C7ElbO3KQqR5amTUkfYZmEn4WhcCWiMqkA5sa154tMWctMMgCjWQKEy

dyJ98zv5gN6N31+H8pKa0+pAw1zf4qlEJOnV/+RHlzyPEFeSYAQEuNF7H8kEwdzb

7stptLaiq6A08p45bOObucV4G6+jjl1KF66JZV+QsLMkxLaSmyW815JQCYSG2Kej

L4994LlriumAeMF8bTrrQke6zqHsGzseDd7++8mOy1K4QWXXzv1bCw2V4NIGAq1o

RrXTkK4BkGSbOKlfTkPQFWoXprIeE1I5kDzSvJv6Hh5ZYe3L/OaVnj3WJlZM/rXb

UwkrcQLn/Xtx+SKrsmfaQmft8jGM9Lpz9mwMRQ/XEpnIFz+Ci4NT77oBckZ+hxfB

xR3oghd8QoArHNyvrbXYqowwMWsvbyz6pL27MCzWNIwEPTCCr+VFP9vY4K5e8HVF

gi7o3z9mwhxK688ixI9kdwbfid3/plLMlYRCWev0fZ+kCte734yBA/AHRFQMqM0U

lJ67BWqjPKM3mpZ73IDnmhWVGwNVVhPe/a5WOTlAKz8wizssBt+r5YqD3dTyQhpq

Za/8Hqxjp0u/rE6Do+CaicLvliy4

=TQ0t

-----END PGP PUBLIC KEY BLOCK-----

Download from the Internet at least two programs to crack the password file or use the ones in the CSL. There are a number of different programs in the public domain to do this. Pick a couple to try (you may need separate ones for the two different filesone for Windows, one for Unix).

Crack the files (note, you should be able to get all of the Windows passwords with the exception of one this will depend on the program you use.

Next find your computers password file

What is the filename?

Where is it located?

Can you copy it? Why? Why not?

Do you have any passwords that can be cracked in your password file? Why? Why not?

How can you crack the passwords in your password file?

Provide a report which will include

The lab setup you used and your initial plan on completing the lab

A discussion about the password cracker programs you used, where you found them, and any problems you may have encountered

The cracked passwords and a discussion as to why each individually may not have been a good password.

Answers to the questions step 4.

A discussion on what makes a good password policy, an assessment of the policy enforced in your work or school environment, and how passwords are related to identity access management systems.