Password Audit

Table of Contents

1. Project Overview
2. Learning Objectives
3. Why Password Audits Matter
4. Understanding Password Security
5. Legal & Ethical Considerations
6. Password Audit Methodology
7. Tools for Password Auditing
8. Auditing Active Directory Passwords
9. Auditing Local Account Passwords
10. Analyzing Password Hashes
11. Password Policy Review
12. Reporting Findings
13. Remediation Recommendations
14. Sample Audit Scenario
15. Deliverables Checklist
16. Quick Quiz

Project Overview

In this project, you will conduct a simulated password audit. You'll learn how to extract and analyze password hashes, test password strength, review password policies, and create professional audit reports. This project teaches both the technical skills needed for password auditing and the ethical framework required to perform these assessments safely.

Scenario

You are a security consultant hired by TechFlow Inc., a software company with 150 employees. Management suspects weak password practices after a recent near-miss incident. You have been authorized to conduct a password audit (with written permission) to identify weaknesses and recommend improvements.

** Free Lab Setup**: All tools used in this project are 100% free and open source:

• Hashcat (free, GPU-accelerated cracking)
• John the Ripper (free, CPU-based cracking)
• rockyou.txt wordlist (free, included in Kali Linux)
• DSInternals (free PowerShell module for AD hashes)
• No paid tools required!

Practice safely: Create your own test hashes or download sample hash files. NEVER attempt to crack passwords without explicit written permission.

📋 Your Step-by-Step Task:

1. Read the legal & ethical guidelines FIRST (critical section below)
2. Download & install Hashcat or John the Ripper (free)
3. Download the rockyou.txt wordlist (free)
4. Create a practice hash file (or use sample hashes provided)
5. Run a dictionary attack: hashcat -m 1000 hashes.txt rockyou.txt
6. Try rule-based attack: add -r best64.rule for more coverage
7. Analyze cracked passwords — document patterns and weaknesses
8. Review current password policy against NIST SP 800-63B
9. Write an audit report using the provided template
10. Complete the deliverables checklist and take the quiz

Learning Objectives

After completing this project, you will be able to:

• Understand password hash storage and retrieval methods
• Use password auditing tools (John the Ripper, Hashcat, etc.)
• Analyze password strength and identify weak patterns
• Evaluate password policies against industry standards
• Create professional password audit reports
• Recommend remediation measures

Why Password Audits Matter

The Password Problem

Passwords remain the primary authentication method for most systems, yet they are often the weakest link. Common issues include:

• Weak passwords: "password123", "CompanyName2024"
• Password reuse: Same password across accounts
• Default credentials: Never changed from manufacturer defaults
• No MFA: Single factor authentication on critical systems
• Stale accounts: Former employees' accounts still active

Impact of Weak Passwords

Understanding Password Security

How Passwords Are Stored

BAD STORAGE METHODS:
  Plain text: "MyPassword123"                 ← Immediate compromise
  Base64: "TXlQYXNzd29yZDEyMw=="              ← Easily reversible
  MD5 Hash: "a1234567890abc..."               ← Fast to crack
  SHA1 Hash: "b1234567890abc..."              ← Fast to crack

GOOD STORAGE METHODS:
  bcrypt: "$2a$10$N9qo8uLOickgx2ZMRZoMye..."  ← Slow, built-in salt
  Argon2: "$argon2id$v=19$m=65536,t=3,p=4..."  ← Modern, memory-hard
  PBKDF2-SHA256: "10000$salt$hash..."          ← Adjustable work factor
  scrypt: "N=16384, r=8, p=1$salt$hash..."     ← Memory-hard

Hash Cracking Fundamentals

PLAINTEXT → HASH FUNCTION → HASH VALUE
"password" → MD5 → "5f4dcc3b5aa765d61d8327deb882cf99"

CRACKING METHODS:
1. Brute Force: Try every possible combination
   - "a", "b", ... "aa", "ab", ... "password"
   - Time: Exponential — "z" takes 26 tries, "zz" takes 676

2. Dictionary Attack: Use wordlists of common passwords
   - rockyou.txt: 14 million real compromised passwords
   - Time: Minutes to hours

3. Hybrid Attack: Dictionary + mutations
   - "password" → "Password1!", "P@ssw0rd2024!"
   - Time: Hours to days

4. Rule-Based Attack: Apply transformation rules
   - Append year: "password" → "password2024"
   - Leetspeak: "password" → "p@ssw0rd"
   - Capitalize: "password" → "Password"

Cracking Speed Reference (RTX 4090)

Key Insight: Fast hashing algorithms (MD5, SHA1, NTLM) can be cracked at billions of attempts per second. Always use slow, memory-hard hashing algorithms.

Legal & Ethical Considerations

CRITICAL: Before Conducting a Password Audit

☐ Written authorization from system owner/management
☐ Clearly defined scope (which systems, which accounts)
☐ Defined rules of engagement (what you will and won't do)
☐ Data handling procedures (how hashes will be secured)
☐ Incident response plan (if you find active compromise)
☐ Legal review of authorization and methodology
☐ NDA in place (if third-party auditor)
☐ Insurance coverage (cyber liability)

Rules of Engagement

DO:
  ✓ Work only on systems you own or have written permission to test
  ✓ Use hash files, not live password capture (when possible)
  ✓ Store hash files encrypted
  ✓ Report findings professionally and confidentially
  ✓ Destroy hash files after audit completion

DON'T:
  ✗ Attempt to access accounts without authorization
  ✗ Share cracked passwords with anyone except the security team
  ✗ Use cracked passwords for anything beyond the audit
  ✗ Store plaintext passwords in reports
  ✗ Crack passwords belonging to users outside scope

Password Audit Methodology

The 7-Step Audit Process

Step 1: PLANNING
  └─ Define scope, get authorization, select tools
Step 2: EXTRACTION
  └─ Obtain password hashes from target systems
Step 3: ANALYSIS
  └─ Identify hash types, assess cracking difficulty
Step 4: CRACKING
  └─ Apply various cracking methods
Step 5: ANALYSIS
  └─ Evaluate cracked password strength
Step 6: POLICY REVIEW
  └─ Assess password policies against standards
Step 7: REPORTING
  └─ Present findings and recommendations

Sample Scope Document

PASSWORD AUDIT — SCOPE OF WORK
─────────────────────────────────
Organization: TechFlow Inc.
Date: [Current Date]
Auditor: [Your Name]

IN SCOPE:
  • Active Directory domain: techflow.local
  • All enabled user accounts (150 users)
  • Service accounts (15 accounts)
  • Local admin accounts on 50 workstations (sampled)
  • Password policy review

OUT OF SCOPE:
  • Cloud application passwords (Google Workspace, Salesforce)
  • Personal accounts
  • Customer or partner accounts
  • Root/certificate authority keys

TIMELINE: 5 business days
REPORT DUE: [Date]

Tools for Password Auditing

Tool Comparison

Recommended Setup

PRIMARY TOOL: John the Ripper (CPU-based — runs on ANY computer)
ADVANCED:     Hashcat (GPU-accelerated — faster but optional)
EXTRACTION:   DSInternals (AD hashes) or secretsdump.py (Impacket)
WORDLISTS:    rockyou.txt (primary), SecLists (additional)

SYSTEM REQUIREMENTS:
  - OS: Windows, Linux, or macOS (any)
  - CPU: Any processor (no GPU needed — John runs fine on CPU)
  - RAM: 4GB minimum (8GB recommended)
  - Storage: 10GB free (for wordlists)

 No GPU? No problem! John the Ripper works perfectly on any computer.
    GPU acceleration (Hashcat) is optional — you can crack many passwords
    with CPU-only using John's wordlist and rule-based modes.

Installing the Tools

# On Kali Linux (pre-installed):
hashcat --version
john --version

# Installing wordlists:
sudo apt install wordlist rockyou
gunzip /usr/share/wordlists/rockyou.txt.gz

# On Windows (manual install):
# 1. Download Hashcat from https://hashcat.net/hashcat/
# 2. Download John the Ripper from https://www.openwall.com/john/
# 3. Download rockyou.txt from GitHub/cloud storage

Auditing Active Directory Passwords

Method 1: Using DSInternals (Windows)

# Install DSInternals module
Install-Module -Name DSInternals -Force

# Export NTDS.dit (requires Domain Admin or SYSTEM access)
# Option A: Using ntdsutil (on Domain Controller)
ntdsutil
activate instance ntds
ifm
create full C:\AD_Export
quit
quit

# Option B: Using Volume Shadow Copy
$shadow = Invoke-CimMethod -ClassName Win32_ShadowCopy `
  -MethodName Create -Arguments @{Context="ClientAccessible"; Volume="C:"}
Copy-Item "$($shadow.Path)Windows\NTDS\NTDS.dit" C:\AD_Export\
Copy-Item "$($shadow.Path)Windows\NTDS\ntds.dit" C:\AD_Export\ntds.dit

# Extract hashes
Get-BootKey -SystemHivePath "C:\AD_Export\registry\SYSTEM"
Get-ADDBAccount -All -DBPath "C:\AD_Export\Active Directory\ntds.dit" |
  Format-Custom -View HashcatNT | Out-File C:\AD_Export\hashes.txt

Method 2: Using Impacket (Linux/Windows)

# Extract hashes using secretsdump (requires credentials)
impacket-secretsdump -just-dc-ntlm techflow.local/administrator:Password@DC01

# Output format:
# username:rid:lmhash:nthash:::
# jdoe:1115:aad3b435b51404eeaad3b435b51404ee:5f4dcc3b5aa765d61d8327deb882cf99:::

Sample Hash File

# techflow_hashes.txt — 150 user accounts extracted
# Format: username:RID:LM:NT::
administrator:500:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
jdoe:1115:aad3b435b51404eeaad3b435b51404ee:e19ccf75ee54e06b06a5907af13cef42:::
asmith:1116:aad3b435b51404eeaad3b435b51404ee:5f4dcc3b5aa765d61d8327deb882cf99:::
bjohnson:1117:aad3b435b51404eeaad3b435b51404ee:7c6a61b68d3d5b7c6e9c6d5a7b8c9d0e:::
...

Auditing Local Account Passwords

Extracting Local SAM Hashes (Windows)

# Using Mimikatz (run as Administrator)
mimikatz.exe
privilege::debug
token::elevate
lsadump::sam
exit

# Extract to file for offline cracking
mimikatz "privilege::debug" "token::elevate" "lsadump::sam" "exit" > sam_hashes.txt

Extracting Linux Shadow File

# Linux password hashes are in /etc/shadow (requires root)
sudo cat /etc/shadow > shadow_hashes.txt

# Hash format:
# username:$algorithm$salt$hash:lastchange:min:max:warn:inactive:expire
# $6$ = SHA512, $5$ = SHA256, $1$ = MD5, $2y$ = bcrypt

# Example:
johndoe:$6$xyz123$AbCdEfGhIjKlMnOpQrStUvWxYz1234567890abc:

Analyzing Password Hashes

Identifying Hash Types

# Hashcat example hashes reference
# Use hashid or hash-identifier to identify hash types
hashid '5f4dcc3b5aa765d61d8327deb882cf99'
# Output: MD5, MD4, MD2, LM, NTLM

hashid '$2a$10$N9qo8uLOickgx2ZMRZoMyeIjZAgcfl7p92ldGxad68LJZdL17lhWy'
# Output: bcrypt

Common Hash Modes for Hashcat

Cracking Passwords with Hashcat

Basic Hashcat Commands

# Dictionary attack (fastest method)
hashcat -m 1000 -a 0 hashes.txt rockyou.txt

# Dictionary + rules (more thorough)
hashcat -m 1000 -a 0 hashes.txt rockyou.txt -r /usr/share/hashcat/rules/best64.rule

# Brute force (8-character lowercase)
hashcat -m 1000 -a 3 hashes.txt ?l?l?l?l?l?l?l?l

# Mask attack (known patterns)
hashcat -m 1000 -a 3 hashes.txt ?u?l?l?l?l?l?l?d?s
# Example: Password matching "Aaaaaaa1!"

# Hybrid attack (word + mask)
hashcat -m 1000 -a 6 hashes.txt rockyou.txt ?d?d?d?d
# Example: "password2024"

# Using a rule file
hashcat -m 1000 -a 0 hashes.txt rockyou.txt -r dive.rule

# Show cracked passwords
hashcat -m 1000 hashes.txt --show

# Output format
hashcat -m 1000 hashes.txt rockyou.txt --outfile=cracked.txt

Hashcat Attack Modes

Cracking with John the Ripper

# Basic dictionary attack
john --format=nt --wordlist=rockyou.txt hashes.txt

# Show cracked passwords
john --show hashes.txt

# Incremental (brute force) mode - SLOW but thorough
john --incremental hashes.txt

# Using rules
john --wordlist=rockyou.txt --rules hashes.txt

# Specify format explicitly
john --format=raw-sha256 --wordlist=rockyou.txt hashes.txt

Analyzing Results

Password Classification

Sample Audit Results Table

Password Pattern Analysis

Patterns Found (150 accounts):
  Based on company name "TechFlow":        12 accounts (8%)
  Containing current year "2024":          25 accounts (17%)
  Sequential numbers (123, 1234, etc.):    18 accounts (12%)
  Common substitutions (p@ss, etc.):        8 accounts (5%)
  Under 8 characters:                      22 accounts (15%)
  In rockyou.txt top 1000:                 15 accounts (10%)
  Shared passwords across accounts:        20 pairs found
  Password same as username:                3 accounts (2%)

Most Common Passwords:
  1. "Summer2024" — 8 accounts
  2. "TechFlow1!" — 5 accounts
  3. "Password1" — 4 accounts
  4. "Welcome1" — 3 accounts
  5. "Company2024" — 3 accounts

Password Policy Review

NIST SP 800-63B Guidelines (Current Best Practice)

NIST RECOMMENDATIONS:
  ✓ Minimum 8 characters (12+ preferred)
  ✓ Allow up to 64+ character passwords
  ✓ Allow all ASCII characters + Unicode (spaces, emoji)
  ✓ Compare against known compromised passwords (breach databases)
  ✓ Rate limiting on login attempts
  ✓ No mandatory periodic change (unless compromised or requested)
  ✓ No complexity requirements (uppercase, number, etc.)
  ✓ No password hints
  ✓ No knowledge-based authentication (security questions)

  ✗ REMOVED from NIST guidelines:
  ✗ Periodic password changes every 90 days
  ✗ Complexity requirements (must have special char, etc.)
  ✗ Password expiration without reason

Evaluating Current Policy

TECHFLOW INC. CURRENT PASSWORD POLICY
───────────────────────────────────────
| Requirement | Current Policy | NIST Recommended | Status |
|-------------|---------------|------------------|--------|
| Minimum length | 8 characters | 8+ (12+ preferred) |  Marginal |
| Maximum length | 16 characters | 64+ characters |  Too restrictive |
| Complexity required | Yes (upper, lower, num) | No (not recommended) |  Outdated |
| Expiration | 90 days | No (not recommended) |  Outdated |
| Password history | 10 passwords | 10 passwords |  Good |
| Breach check | No | Yes |  Missing |
| MFA required | No | Yes (strongly) |  Missing |
| Account lockout | 5 attempts/15min | Rate limiting |  Adequate |

Have I Been Pwned (HIBP) Integration

# Check if passwords appear in known breaches
# Using HIBP API (v3)

function Test-IsPasswordPwned {
    param([string]$Password)
    
    $sha1 = [System.Security.Cryptography.SHA1]::Create()
    $hash = [BitConverter]::ToString(
        $sha1.ComputeHash([Text.Encoding]::UTF8.GetBytes($Password))
    ) -replace '-', ''
    
    $prefix = $hash.Substring(0, 5)
    $suffix = $hash.Substring(5)
    
    $response = Invoke-WebRequest "https://api.pwnedpasswords.com/range/$prefix"
    
    if ($response.Content -match $suffix) {
        $count = ($response.Content -match $suffix) -replace '.*:(\d+).*', '$1'
        return $true, [int]$count
    }
    return $false, 0
}

Reporting Findings

Executive Summary Template

═══════════════════════════════════════════
PASSWORD AUDIT REPORT — EXECUTIVE SUMMARY
═══════════════════════════════════════════

To: Management, TechFlow Inc.
From: [Your Name], Security Consultant
Date: [Current Date]
Classification: CONFIDENTIAL

PROJECT OVERVIEW
  A password audit was conducted on the TechFlow Inc. Active Directory
  environment from [Start Date] to [End Date]. The audit assessed password
  strength, password policies, and account security for 150 user accounts.

KEY FINDINGS
  ┌────────────────────────────────────────────────────────────┐
  │  • 78 of 150 accounts (52%) had passwords cracked         │
  │  • 15 accounts used passwords found in top 1000 breaches  │
  │  • 3 accounts had the password set as the username         │
  │  • Average cracking time: 14 minutes (cracked accounts)    │
  │  • Password policy is outdated compared to NIST standards │
  │  • No MFA implemented for any accounts                     │
  └────────────────────────────────────────────────────────────┘

RISK RATING: HIGH
  The organization is at significant risk of credential-based
  attacks due to weak password practices and missing controls.

RECOMMENDATIONS
  1. Implement MFA for all accounts (priority: 30 days)
  2. Update password policy to align with NIST SP 800-63B
  3. Deploy a password manager for all employees
  4. Implement breach-checking at password creation
  5. Conduct security awareness training focused on passwords

Technical Report Template

═══════════════════════════════════════════
PASSWORD AUDIT REPORT — TECHNICAL DETAIL
═══════════════════════════════════════════

1. METHODOLOGY
   • Hash extraction: DSInternals (NTDS.dit export)
   • Cracking tool: Hashcat v6.2.6
   • Hardware: NVIDIA RTX 3070, 8GB VRAM
   • Wordlists: rockyou.txt, SecLists/Passwords
   • Rules: best64.rule, dive.rule
   • Cracking time: 4 hours total

2. ACCOUNTS AUDITED
   Total accounts extracted: 157
   Disabled/expired accounts: 7 (excluded from analysis)
   Active accounts analyzed: 150

3. CRACKING RESULTS
   ┌──────────────────┬────────┬──────────────┐
   │ Status           │ Count  │ Percentage   │
   ├──────────────────┼────────┼──────────────┤
   │ Cracked easily   │ 52     │ 34.7%        │
   │ Cracked with rules│ 26    │ 17.3%        │
   │ Not cracked      │ 72     │ 48.0%        │
   └──────────────────┴────────┴──────────────┘

4. TOP WEAK PASSWORDS (USER-VISIBLE; DO NOT LIST PLAINTEXT)
   [Detailed list provided separately — CONFIDENTIAL]
   [Passwords communicated only to security team]

5. COMPROMISED ACCOUNTS
   Accounts appearing in known breaches: 22 (14.7%)
   [Details in appendix]

6. COMPLIANCE GAPS
   [See Password Policy Review section]

7. RECOMMENDATIONS
   [See detailed recommendations section]

Remediation Recommendations

Quick Wins (0-30 Days)

Medium-Term (30-90 Days)

Long-Term (90+ Days)

Sample Audit Scenario

Complete Walkthrough

SCENARIO: TechFlow Inc. Password Audit

Step 1: Setup
  - Tool: Hashcat on Kali Linux
  - Wordlist: rockyou.txt (downloaded and extracted)
  - Hashes: Extracted via DSInternals (150 accounts)

Step 2: First Pass — Dictionary Attack
  Command: hashcat -m 1000 -a 0 hashes.txt rockyou.txt
  Time: 47 seconds
  Results: 42 accounts cracked (28%)

Step 3: Second Pass — Dictionary + Rules
  Command: hashcat -m 1000 -a 0 hashes.txt rockyou.txt -r best64.rule
  Time: 3 minutes 12 seconds
  Results: 18 additional accounts cracked (total: 60 accounts)

Step 4: Third Pass — Mask Attack (8 char)
  Command: hashcat -m 1000 -a 3 hashes.txt ?u?l?l?l?l?l?l?d!?s
  Time: 8 minutes
  Results: 8 additional (total: 68 accounts)

Step 5: Fourth Pass — Company-Specific
  Command: echo "TechFlow" > custom.txt && hashcat -m 1000 -a 6 hashes.txt custom.txt ?d?d?d?d?d?d
  Time: 2 minutes
  Results: 10 additional (total: 78 accounts)

Step 6: Analysis
  Total cracked: 78/150 (52%)
  Average strength: Weak
  Common patterns: Company name, current year, seasonal

Step 7: Policy Review
  NIST compliance gaps identified: 5 major gaps

Step 8: Report Creation
  Executive summary + technical report + recommendations

Audit Output Template

Password Audit Summary
─────────────────────────────────
Organization: TechFlow Inc.
Date: July 22, 2026

═══════════════════════════════
📊 Overall Score: D (48/100)
═══════════════════════════════

Categories:
□ Password Strength      ████████░░ 42/100
□ Password Policy        ██████░░░░ 35/100  
□ MFA Implementation    ██░░░░░░░░ 10/100
□ Account Hygiene        ██████░░░░ 45/100

Critical Issues Found:
■ 52% of passwords cracked in under 1 hour
■ No MFA enabled on any account  
■ 22 accounts appear in known breaches
■ Password policy is 5+ years outdated
■ 7 service accounts have non-expiring passwords

Top 3 Immediate Actions:
1. Enable MFA (1 week)
2. Force password reset for all cracked accounts (immediate)
3. Update password policy to NIST standards (2 weeks)

Deliverables Checklist

Before marking this project complete:

• Authorization documentation — Signed scope of work
• Hash extraction — Successfully extracted hashes from target system
• Cracking results — Successfully cracked a portion of the hashes
• Password analysis — Categorized passwords by strength/pattern
• Policy review — Evaluated current policy against NIST standards
• Executive summary — Non-technical overview for management
• Technical report — Detailed findings for security team
• Risk assessment — Risk levels assigned to findings
• Remediation plan — Prioritized action items with timeline
• Secure data handling — Hashes and plaintext passwords destroyed