Re: pent-test a container file

I actually know that the used algo is AES... no more.
The minimum password length to use is 6 characters (including numbers
and special characters..)

Um, if you knew it was AES, why did you not mention this earlier?
You're not going to get much from the list if you don't give much.

If you know it's AES, do you know what key size (e.g.: 128, 192, 256)?
Once you know key size, you need to know how the 6+ character password
is converted to a key. Is it just NULL padded, or are they using
something more intelligent? There are published standards for this.

Do you know what mode it was encrypted with (e.g.: ECB, CBC, OFB, CFB,
or CTR)? You could check for repeating blocks. If you find any, it's
an indication it may be ECB. Otherwise, who knows...

There, have a bone. It ain't much, but it's kinda a pointless exercise
anyway.

tim

------------------------------------------------------------------------
This List Sponsored by: Cenzic

Need to secure your web apps?
Cenzic Hailstorm finds vulnerabilities fast.
Click the link to buy it, try it or download Hailstorm for FREE.

http://www.cenzic.com/products_services/download_hailstorm.php?camp=701600000008bOW
------------------------------------------------------------------------

Relevant Pages

  • Secure Password Policy?
    ... I noticed that "best practice" for Minimum password length policy is ... password if it is less than 8 characters. ... Cross site scripting and other web attacks before hackers do! ...
    (Pen-Test)
  • Re: Impact of changing group policy
    ... The password complexity and minimum password length ... >I currently have a group policy that is setup that the passwords have to be ... > characters, rotate every 45 days, and the last ...
    (microsoft.public.windows.group_policy)
  • RE: Secure Password Policy?
    ... > I noticed that "best practice" for Minimum password length ... > considered a weak password if it is less than 8 characters. ... Cross site scripting and other web attacks before hackers do! ...
    (Pen-Test)
  • Re: RE: auditing of chinese pwds
    ... Chinese, that means around 40.000 characters or so, they are double bite as Jeffory reminded and that makes me believe that "our" common tools,which based on romantic languages won't work. ... Cenzic Hailstorm finds vulnerabilities fast. ...
    (Pen-Test)
  • Re: Win2K Complex Password Enforcement
    ... They should have a support ... passfilt.dll that had a minimum password length of 12 characters and ... required characters from all four fields. ...
    (alt.computer.security)