Analyzing password complexity rules
Before we start using rules to enhance our password cracking, we need to take a step back and analyze the target system we are going to crack credentials for. The reason for this is straightforward – if we know what a credential requires, we can start to immediately include and exclude certain types of credential constructions and formats.
As an example, many organizations will follow the logic of complexity over length. As we discussed in Chapter 1, this is not necessarily the best approach, but since it is still often used, it requires examination. A common method of setting credential requirements to reflect complexity over length would be to require three (or four) of the following four criteria:
- Lowercase letters
- Uppercase letters
- Numbers
- Special characters (such as hyphens (-), exclamation points (!), and so on
In addition to the preceding requirements, we may also require users to rotate (or change) credentials...
