05-27-2013, 02:00 PM
(This post was last modified: 05-27-2013, 02:01 PM by Itinsecurity.)
(05-27-2013, 12:34 PM)atom Wrote: Password pattern do not mirror a real-life situation in a pentest
In real-life situation you do not crack 100% of an unknown list. Especially not if it is salted, highly-iterated or use bcrypt or sha512crypt.
True, but as someone on the receiving end of security advice from pentesters and security consultants, I often hear that users will choose passwords that follow common patterns.
So even if you won't crack everything with a single pattern, you should be able to cover a lot by finding a few patterns.
Specifically, I'm thinking of the claims that users will form their passwords according to whatever policy is enforced on them (ie. the classic example Password01, with capital first, and digits at the end.).