For the (most common) WPA password-based attacks, an already-prepared dictionary of words to use to attack the password will be required. See the Appendix on Audit Preparation for guidance on dictionary preparation. A Password Survey (see Appendix) for an alternate way to gather password practices The Level Up Activity, Password Reverse Race provides a staff activity. Considerations Walkthrough This exercise supports the auditor in building an effective dictionary that is customized to an organization. This dictionary can then be used in a variety of ways: By using the examples referenced in the Network Access section, the auditor can attack weak wifi passwords, which present a non-personal and non-disruptive way to demonstrate password security problems. Weak wifi passwords are specifically a challenge, as wifi signals often are accessible outside of an office's physical limits, but provide full access to the private network. An Auditor can show or discuss their preferred customization strategy and the tools (like JtR) that automatically "mutate" passwords with numbers, capitals, and so on, to demnonstrate the power of a computer to quickly get around common "tricks" An Auditor can also use a password "survey" to get an understanding of password practices within the organization. WALKTHROUGH This skillset, plus demonstration against non-invasive accounts, provides an opening for a discussion with staff on password security. See Level Up for further activities and exercises around passwords. Download basic word lists Research dictionary needs Create custom word list Build core list(s) Attack a password hash using increasingly more time-consuming methods INSTRUCTIONS Page 79 of 240