So You Cracked a Bunch of Passwords. Now What?

on YouTube ↗28m

" summary

Cracks at about 160 billion NTLM hashes per second, uses PACK to extract masks but finds manual import into reporting tools wasteful, so builds PERP PowerShell tool to parse john/hashcat pod files, detect LANMAN hashes, password reuse, patterns and seasonal histories, and generate exports Excel pivot tables plus CSV/HTML; supports PAC output, plans HaveIBeenPwned checks, runs cross‑platform under PowerShell Core, is on GitHub and actively developed.

AI-written summary · about

" chapters (7)

1. 0:00Introduction and speaker intro
2. 3:12Purpose of penetration testing
3. 5:16Importance of reporting in pen tests
4. 11:51Password cracking tools overview
5. 18:37Introducing PERP reporting tool
6. 24:16Using PERP for password policy improvement
7. 27:43Q&A and tool release

" related talks

• 30mThe Domain Password Audit ToolCarrie Roberts, Darin Roberts, Cameron Roberts · BSidesSLC 2020
• 40mLive autopsy of a password: lessons learnt cracking secretsNiclas Kjellin · Øredev 2023
• 29m80,000 Plaintext Passwords: An Open Source Love Story in 3 ActsT.J. Schuck · Red Dot Ruby Conference 2014
• 59mHack Yourself FirstTroy Hunt · Web Directions South 2013
• 25m80,000 Plaintext Passwords: An Open Source Love Story in Three ActsT.J. Schuck · Cascadia Ruby 2014
• 58mHacking in 2016 - How is our systems broken?Chris Dale · NDC Oslo 2016
• 31m680,000 Plaintext Passwords: An Open Source Love Story in Three ActsT.J. Schuck Fluffmuffin · ArrrrCamp 2014
• 34m80,00 Plaintext PasswordsT.J. Schuck · Rocky Mountain Ruby 2014