‫Password policy problems now passwords are the key elements of an authentication system right there,
‫like the keys to open a door so the application should have a strong password policy.
‫But you do have to be careful.
‫I don't mean just password complexity with the word policy.
‫Password policy is way more comprehensive.
‫The complexity is just a property of this policy.
‫So a password policy sets how to transport and store passwords as well.
‫All right.
‫So here is Ben Testa's.
‫We got to figure out three things.
‫Password, complexity, rules.
‫Password transmission rules.
‫And password storage rules, so last thing is, is basically how the passwords are stored on the back
‫end.
‫So it's not directly a pen Testim, but passwords should be salted and encrypted and then stored.
‫See my meaning, because even you cannot bypass the login mechanism, but you can reach the database
‫over an actual injection and have passwords are not stored properly.
‫They're going to be dumped.
‫But we're going to talk about password, complexity and transmission.
‫So the first thing that we should check is to see if the target has a policy or not, because this is
‫going to shape how to attack the login mechanism of the application.
‫So if the target has password complexity rules, we should generate the dictionary based on these rules.
‫So not go to Caleigh and open up your terminal and we're going to use Krunch to generate a password
‫list.
‫And the simple usage of the help screen is printed.
‫So Krunch can create a wordlist based on, well, criteria that you specify, for example, if you type
‫Krunch four for a B1 the.
‫It will print for character words to the screen by using a uppercase B one and.
‫So now let's have a look at the man page of Krunch.
‫Grunty has a well planned fanpage with examples to scroll down to see some example uses.
‫And you can quit from here.
‫So let's use some options.
‫So it generates word lists based on a character set, and you need to provide crunchier char set to
‫star.
‫So thankfully, it has its prepared list in this directory already, and then you can choose one of
‫them or add a new one if you want.
‫OK, type crunch eight eight slash user slash share slash, crunch slash char set dot list L a l page
‫A and hit enter.
‫So it's going to produce a long output, but I'm going to stop it here.
‫And now I'm going to provide my custom, Char said.
‫So I was along output and I'll stop it here.
‫OK, so let's have a look.
‫As you can see, the output contains only the characters in my set.
‫So then you may want to add some special characters like.
‫Double quotes or space's.
‫And it will cause an error like this if you do that.
‫So you're going to need to escape like this.
‫Or you need to put your set in between devil quotes.
‫So also, I'm going to add a space like this.
‫And output is very long, so I'm going to stop it here.
‫So you can see the crunch is a very powerful command line, word list generator.
‫So it helps us to play with characters.
‫So by tapping this line.
‫T the parameter will produce a special output.
‫And the first two characters will be lower case, the next two characters will be upper case, next
‫to will be numbers, the last two will be special symbols.
‫Now, the order in which you specify the characters you want is important.
‫So it means that you need to specify your assets in order as lowercase character, uppercase, character
‫number and then symbol.
‫Now, if you aren't going to use a particular char set, you must use a plus sign as a placeholder.
‫So let me just add a plus sign instead of C, D and change it here to lower case.
‫So if I use a placeholder for uppercase letters, then I will use all uppercase letters in the English
‫alphabet.
‫OK, so we can also limit the number of duplicate characters.
‫That you just use a deep parameter to add a limit.
‫And this will limit duplicate lowercase letter to one.
‫Which means the winner will not present after the same letter.
‫Also, we can expand this to uppercase letters as well, numbers and symbols to.
‫So Krunch can also print the list after a specific word, so using the S parameter with a word B DC
‫one, two, it will trim words before a BDC one to.
‫And using the E parameter, we can trim the output from the end, like the.
‫Then the output from Krunch can be sent to the screen file or to another program.
‫Not having the whole parameter.
‫We can then save the output to a file called WORDLIST.
‫And I'll show you the generated output.
‫OK, so besides having a good password policy, the application can still have authentication issues.
‫One of them is default and weak credentials.
‫And it's very common to see these values in pre configured application platforms, hardwares, web interfaces
‫and in Internet environment.
‫Just for the sake of usability, they all come with default usernames or sometimes default passwords
‫or both.
‫And generally, companies have a standard structure of email addresses or any other text used to define
‫a user ridi.
‫So what this does is it helps us to predict username values and even passwords.
‫So what I'm saying is don't even hesitate to use the default values while testing.