User authentication and movement
One of the simplest ways to exploit systems through authentication is through passwords and password attacks. Password attacks can occur in one of three ways:
- The first is to find and exploit a vulnerability to gain access to the system. Once the system has been breached, dump the account and password hashes and crack them later off the system. Once the passwords are cracked, the attacker can access the machines(s)/network using multiple accounts. In this example, the exploit preceded the password attack.
- The second way uses the opposite approach, where the attacker performs automated password guessing to determine passwords for one or many accounts; this is also known as a brute force attack. Brute force attacks can use either a dictionary attack, which is just a list of passwords to try, or an algorithm that supplies a calculated sequence of letters, numbers, and symbols as the password. If successful, the attacker gains access to target...
