Nexus

This utility scans the passwords stored by popular Windows applications (Microsoft Outlook, Internet Explorer, Mozilla Firefox, and more...) and displays security information about all these passwords. The security information of every stored password includes the total number of characters, number of numeric characters, number of lowercase/uppercase characters, number of repeating characters, and password strength. You can use this tool to determine whether the passwords used by other users are secured enough, without watching the passwords themselves.

Start Using Password Security Scanner

Password Security Scanner doesn't require any installation process or additional dll files. In order to start using it, simply run the executable file - PasswordScan.exe

After you run PasswordScan.exe, Password Security Scanner scans the passwords stored on your system, and then displays the security information of all found passwords inside the main window.

You can also go to the 'Advanced Options' window (F9) and choose to displays only insecure passwords with low number of characters or with low password strength value.

Columns Description

Item Name:The name of the item. For Web site passwords, the address of the Web site is displayed. For email passwords, the email address is displayed.
Password Type:The type of the password: Web Browser, Messenger, Email, or Dialup/VPN.
Application:The application that stores the specified password item: Microsoft Outlook, Firefox, Internet Explorer, and so on...
User Name:The user name that is used with the specified password item.
Password Length:The total number of characters in the password.
Numeric:The total number of numeric characters (0 - 9) in the password.
Lowercase:The total number of lowercase characters (a - z) in the password.
Uppercase:The total number of uppercase characters (A - Z) in the password.
Other Ascii:The total number of non-alphanumeric characters in the password.
Non-English:The total number of non-English characters in the password.
Repeating:The total number of repeating characters in the password. For example, if the password is abcdab, then the 'Repeating' value will be 2, because both a and b characters appears more than once.
Password Strength:The strength of the password, calculated according to number of parameters, including the total number of characters, number of repeating characters, type of characters used in the passwords, and more...
The numeric value displayed in this column represents the strength of the password, according to the following list:
- 1 - 7: Very Weak
- 8 - 14: Weak
- 15 - 25: Medium
- 26 - 45: Strong
- 46 and above: Very Strong
Windows User:The Windows user that owns the password. For most passwords, this column will display the current logged-on user. However, for Dialup passwords of Windows, you might also see the passwords of other Windows users, and in those cases, this column will display the Windows users that created the dialup password.

Download Password Security Scanner

Read More Add comment

Osueta - A simple Python script to exploit the OpenSSH User Enumeration Timing Attack

By 0x000216

Read

0 Comments

Osueta it's a simple Python2 script to exploit the OpenSSH User Enumeration Timing Attack, present in OpenSSH versions 5.* and 6.*. The script has the ability to make variations of the username employed in the bruteforce attack, and the possibility to establish a DOS condition in the OpenSSH server.

usage: osueta.py [-h] [-H HOST] [-k HFILE] [-f FQDN] [-p PORT] [-L UFILE]
             [-U USER] [-d DELAY] [-v VARI] [-o OUTP] [-l LENGTH]
             [-c VERS] [--dos DOS] [-t THREADS]

OpenSSH User Enumeration Time-Based Attack Python script

optional arguments:
-h, --help  show this help message and exit
-H HOST     Host Ip or CIDR netblock.
-k HFILE    Host list in a file.
-f FQDN     FQDN to attack.
-p PORT     Host port.
-L UFILE    Username list file.
-U USER     Only use a single username.
-d DELAY    Time delay fixed in seconds. If not, delay time is calculated.
-v VARI     Make variations of the username (default yes).
-o OUTP     Output file with positive results.
-l LENGTH   Length of the password in characters (x1000) (default 40).
-c VERS     Check or not the OpenSSH version (default yes).
--dos DOS   Try to make a DOS attack (default no).
-t THREADS  Threads for the DOS attack (default 5).