It's time we talked a little bit about passwords, we all have password problems, everybody's got them.
We've got too many passwords and too often we make them hard to remember, but easy for a computer to
guess.
And we're going to see what I mean by that in this section.
If you'll remember on the section on Windows seven hacking, we saw that we could dump the password
hash file from that computer, the encoded versions of all the passwords on the Windows seven computer.
Once we compromised that computer using Métis and interpreter in this section, we're going to see how
to crack passwords, how passwords get hacked, hijacked and when I'll call snacked.
But the common thing that we all have when it comes to our passwords is that passwords are filled with
problems.
First of all, we have social engineering.
We saw that with the phishing attack.
All it took was just a simple email saying that your accounts been hacked or there's a picture posted
of you that you don't want up there or, hey, I need some help.
Click through this really fast and someone can fish your password no matter how complex, how elegant,
how perfect your password is.
If you give up that username and password to someone threw a phishing attempt or from them calling and
saying, hey, this is it, I need to log in with your password to fix something.
You have lost everything.
You've lost complete access.
You've given access to someone else.
There's also something I call snacking, and I just do that because it rhymes with hacking, hijacking
and cracking.
But if you've ever looked around someone's workstation before, you may see Post-it notes with passwords.
That one is actually a pretty good one.
Jado one has a password of I hate passwords, high H, eight P and SSW zero r d exclamation.
That's not a terrible password.
What's terrible is it was just complex enough that they had to write it down and they stuck it on their
monitor.
That's a terrible way to handle your passwords, especially putting the username right with it.
Usernames are easy enough to guess without putting it down on a piece of paper, but if your passwords
are so complex that you have to write them down, you might be doing it wrong even if you've got a decent
password.
We saw in the very first example, the very first section in this ethical hacking course that physical
access can overwrite our passwords.
So if we give someone access to our computer and they can pop in a Windows 10 DVD and boot that computer
a couple of times, the special key combinations and just about four commands, they can overwrite our
password and give us a completely new password.
Or they can create a whole new user account, make them an administrator on the computer and they don't
even need our password.
They can see most of our files if we don't have them encrypted.
So all the way back in Section one, we saw that passwords can get hacked with physical access.
We saw in the section on phishing that people can steal our passwords through a phishing Web site if
we're not really careful where we enter our usernames and passwords, if we write our passwords down
and leave them on a Post-it note stuck to the monitor, that's just about the worst case that you can
have.
But I'm going to show you a few techniques to in this section that will both show you how people hack
passwords, hijack and crack passwords, and how you can keep your passwords safer.
So in this very first hands on application, we're going to hijack some passwords.
We're going to reveal passwords stored in a browser.
If you ever store your passwords in your browser, if you tell the browser to remember those passwords,
you need to know that those passwords are susceptible to hijacking.
I'm going to show you how we can change just one character in the source code for the Web page while
it's live on the screen and display those passwords.
So be very careful.
If you ever have a browser, remember your passwords for you.
You need to make sure it's a computer that only you have physical access to.
Never do this at work, at school, at the airport, at an Internet cafe and a library.
Wherever you enter your password and tell the browser to remember it, you've as good as given that
password to even a moderately skilled hacker.
And you're going to see how to reveal those passwords coming up in the next lesson.