Re: Password Breaking Applications

"Will" <westes-usc@xxxxxxxxxxxxxx> wrote in message news:_a2dna4gbuQQwDfeRVn-sw@xxxxxxxxxxxxxxx
I'm thinking of investing in one of the applications that will attempt to
break passwords when given a sam file as input. This is both to help get
access to old machines when no one remembers what a valid administrator
account password is, as well as to test the strength of passwords for local
accounts. Which of the applications available offer the best features at
the best price? 

There are only four programs of that kind:

John the Ripper
http://www.openwall.com/john/

LC5
http://www.symantec.com/

Proactive Password Auditor
http://www.elcomsoft.com/ppa.html

SAMInside
http://www.insidepro.com/eng/saminside.shtml

However, John the Ripper is not able to get password hashes directly
from SAM -- to break/audit passwords, you should already have the
dump file (generated by some 3rd party program). Also, that program
works only from the command-line and not very easy to use. However,
it is free.

About LC5 : the company that developed this software (@Stake) has
been acquired by Symantec a few months ago. I was not able to find
any information on LC5 on Symantec web site; it seems that this
product is still available, but only in U.S. and Canada:

http://www.theregister.co.uk/2005/11/25/symantec_l0phtcrack_export_controversy/

SAMInside and PPA are both good, but I'm not going to compare them
because of the ethical reasons: PPA is our (ElcomSoft) product :) I can
only say that SAMInside is much cheaper ($40 only), while PPA price
starts at $299 (the cost depends on the number of accounts to audit).

--
Sincerely yours,
 Vladimir

Vladimir Katalov
CEO
ElcomSoft Co.Ltd.
mailto:vkatalov@xxxxxxxxxxxxx
http://www.elcomsoft.com 

.

Relevant Pages

  • Re: cracking Y2k DC Admin password
    ... the hashes have been created, they are encrypted with a DES variant ... if you have the SAM file, you should also have taken the system file. ... anyone and you have your passwords. ... >> - rescue in windows folder and backup sam file from it, it has admin ...
    (Pen-Test)
  • Re: Windows Audit
    ... >>> machine so that people can possibly crack other peoples passwords? ... You have a choice of importing the SAM file or simply checking the passwords ... These fancies arise in the soul, ... is but a dream within a dream. ...
    (alt.os.windows-xp)
  • Re: Hacker seems to know FTP usernames
    ... If they've grabbed the SAM file then ... >>seeing in the security logs that someone is trying to log ... >>havent figured the passwords yet so authentication fails. ... > accounts are way too obvious, like the FTP account for the sample.com ...
    (microsoft.public.inetserver.iis.security)
  • Re: Hidden Sam (passwords) File on XP/2000 FileSystem
    ... Hidden Sam (passwords) File on XP/2000 FileSystem ... but if you launch a ... > cmd.exe via at scheduled AT job, then the shell since it is launched ... > is the SAM file for the machine. ...
    (Focus-Microsoft)