As a pen tester, one of the things that we're going to be tasked with occasionally is being able to break those passwords to get into different accounts.
Now, we're going to keep in the mindset of this all being ethical and we're within the rules of engagement and making sure that we're doing everything the way that we're supposed to be doing, not just ethically, but also legally.
So keeping that in mind, there will be situations throughout the course of a pen test for an organization that you may need to crack a password or to test to see if that password meets the actual standard of the security policy of said organization.
You see, password attacks aren't just for giggles, although we do get a lot of giggles out of them.
But the ability to be able to attack those passwords and test to see if they're common used phrases or something that is simplistic to attack, such as all lowercase password, is actually strengthening the security of the organization that we're pen testing for.
So it's not just all about getting into an account and wreaking havoc. That's later on in the course and also when we start doing pivoting and elevating permissions.
And this is part of the first step in elevating those permissions, because if we can crack a password on an account, whether it be a user or even a privileged user of some type, we can begin to start doing things on the network and those systems that allow us to get more permissions later on.
So real quick, I do want to point out that we will be using the lab and we will be doing a bunch of different tests throughout this skill.
But it also goes without saying that we need to understand where some of these passwords actually stored at.
Because not all operating systems are the same and not all, even let's say Windows, for instance, they don't keep their passwords in the same place on different versions of Windows.
And I bring that up because we need to be familiar as pen testers with the different variants of operating systems out there.
And in case some of those variants have different methods of storing those passwords in different locations, we're not going to be able to remember everything all the time.
But let's say that you run across a Windows XP system on an organization's network.
That's right. They still exist out there, even though they're well outdated and don't have the support from Microsoft anymore officially.
But it does happen.
When does Windows XP keep the passwords in the same location as Windows 10 or 11?
It's slightly different and we'll have references throughout this course.
And I'm mostly just picking on myself because I, too, still have a Windows XP system that set up in the living room to run DOS games and some other stuff.
And if somebody were to pen test over here, they'd find out it's pretty easy to be able to crack into that XP system.
So familiarity is key and also being able to know where to find that type of information.