Performing Penetration Testing with Python Script to Crack Passwords

Scenario-1: Cracking a Password for a Specific User

(1) Please, follow the demo video and fully understand each step of the script. You are given the and the complete script from the demo video. You will replicate the pentest that was demonstrated in the demo videos.

Scenario-1:

You are performing a penetration test in which you need to crack a password of a specific user. You successfully downloaded the Shadow file from a remote server. The user you are interested in just posted her grandson’s birthday photo on social media. Her grandson’s name is Jax and today is May 28.

You assume that

          a. “Jax” or its 3-character variances are in the password. People may use “@” to replace the letter “a”.
          b. “05” is in the password
          c. “28” is in the password
          d. There is another special character (one from “!"#$%&\'()*+,-./:;<=>?@[\\]^_`{|}~'” ) in the password to make the password 8-character long.
          e. You don’t know the order of a, b, c, and d

Submission-1:

Comment and reorganize the code into three functions. The  is used to test if your my_cracker_functions.py work. You will submit “my_cracker_functions.py” and a screenshot of the output from running “function_call.py”. Please note that “my_cracker_functions.py” only contains three function definitions.

Submit "my_cracker_functions.py" and the Screenshot_1 of the output.

(2) Modify the first script slightly to find another password in the shadow file.

Scenario-2:· 

o We believe “Jose” is in the password, but do not know if the letters are in upper- or lower-cases. (sometimes, people use digit “0” to replace the letter “O” and dollar sign “$” for the letter “S”).

o We will try Jose’s birthday in the password. He was born in November. We don’t know the exact date. However, we know it is between 20th and 30th November. 

o The password will only contain four characters for Jose, two digits for month, and two digits for day, but we do not know the order of these three sections – the name, the month, and the day.

Submission-2:

"jose.py" and the Screenshot_2 of the output.

(3) Modify the first script to find another password in the shadow file.

Scenario-3:

We overheard that Jane complained that her company mandates MONTHLY password change. She also bragged about how she is able to easily find new passwords and remember them perfectly. She said would start a password with a QUESTION MARK, followed by a short word she can remember. She will fill the rest of the password with the year and month. Based on what Jane said, we’d like to create the following assumptions.

· The password is 8 characters long (Jane just wants to fulfill the minimum company requirement)

· The first letter is “?” (Jane said it)

· The last four letters are digits for the year (two digits) and month (digits). Today is in June 2020. So, the last first digits are “0620” or “2006”

· The missing 3 characters will be a three-letter dictionary word with only one character capitalized.

· Use the dictionary in  “/usr/share/dict/american-english”. Extract all three-letter English words. You need to remove the words with apostrophe such as “A’s”.

Submission-3: "jane.py" and the Screenshot_3 of the output.

Submission Summary:

- You will submit three python files: "my_cracker_functions.py" - "jose.py" - "jane.py"

- a PDF file containing three screenshots of the outputs. Include your answer to the questions below:

· Do some research and answer what is the advantage of using "passlib" library over "hash" or "hashlib" to crack Linux passwords." 

· "In 3rd question, how many 3-letter words you found in the dictionary."