Re: Passwords & Passphrases

[Zach Jansen <zjanse20 () CALVIN EDU>]

> > > On 11/19/2007 at 3:01 PM, in message <4741EBAD.2010903 () albany edu>, Martin
Manjak <mm376 () ALBANY EDU> wrote:

> This is a tangential topic, but I was wondering if anyone on the list 
> was familiar with brute force tools that would work against web forms. 
> My concern is that without some kind of lock out policy, an account with 
> a 8 character password would be vulnerable to a brute force attack.


You may want to look at Brutus or THC Hydra if you want to run password guessing attacks against login forms. However, 
I agree with Gary Flynn's response that this tactic isn't really very useful except to audit against really basic 
dictionary based passwords or default passwords because of the time involved with a large number of attempts. 

Zach 


-- 

Zach Jansen
Information Security Officer
Calvin College
Phone: 616.526.6776
Fax: 616.526.8550