From the course: CompTIA Cybersecurity Analyst (CySA+) (CS0-003) Cert Prep

Unlock the full course today

Join today to access over 24,200 courses taught by industry experts.

Password forensics

Password forensics

From the course: CompTIA Cybersecurity Analyst (CySA+) (CS0-003) Cert Prep

Start my 1-month free trial Buy for my team

Password forensics

“

- [Instructor] Password cracking is a valuable tool for attackers, and it also plays a role in the forensic analysis toolkit. Cybersecurity analysts conducting a forensic analysis may uncover password files stored on disk and can use password cracking tools to attempt to retrieve the passwords from those files. Let's take a look at how passwords are stored and how we can use password cracking utilities to access stored passwords. On Linux systems, password files contain user credentials. When a user attempts to log into a system, the log-in process checks the password file to determine whether the password is valid. Now, of course, the file doesn't simply contain a copy of the password. That would be an easy target for attackers, and it would allow system administrators to know all of the user passwords on a system. Instead, the password file contains a password hash, shown here, that's computed using a one-way function. When the user logs in, the login process takes the password…

Contents