Earlier this year, Triaxiom was set on building a new password cracking machine which would be a more advanced iteration than its predecessor, Thor. Simply put, a password cracking machine is a powerful computer which can run through billions of password guesses per second. This leads us to our new project – Loki. Overview: While […]
In a lot of organizations we work with, something as simple as changing the password policy from a minimum length requirement of 8 to 14 is anything but simple. They have to get approval, organizational buy-in from top management, and then deal with hundreds of help desk tickets and frustrated employees once the change is […]
In today’s blog, we are going to take a look at how to make a better wordlist. When performing password attacks, whether online or offline, wordlists are a much better approach than a traditional brute force. Even with an offline password attack using a machine designed to crack passwords efficiently, a brute force of just […]
After performing penetration tests for a myriad of companies over the last decade, there is one thing that stands out above all others…. People suck at making passwords. At first I thought “how hard can it be?” But after working with company after company, and trying to improve their password security, I have realized that […]
Passwords are commonly one of the biggest weaknesses we find when performing a penetration test. It seems that no matter what password policy you have in place, users will still use Comany123, Spring2019, or a keyboard pattern for their password. An attacker can easily guess these and gain access to sensitive resources or even your […]
The difference between a password and passphrase is simply a terminology change. A password is typically around 8 characters long and meets necessary complexity requirements. For example Panthers1! A passphrase, by contrast, is making your password into a sentence, including spaces and punctuation as necessary. An example of a passphrase is “I love the Carolina Panthers!” […]
