[Myrddin]

I see that you haven't been introduced to rainbow tables. The typical hash used is md5. If you can get the shadow password file off a Linux system, you then take the md5 associated with the user you want (usually root) and run that through the rainbow table. It will hand you an ascii string that produces the md5 sum. The advent of cloud computing means there are many rainbow table servers sitting on the web to provide the lookup service.

If you want to know more details about system security, sign up for SANS classes. They are worth the time and money.

[Black Agnes]

Dictionary attacks were popular 20 years ago.

Which makes me wonder why they need the passwd file. If they’ve got control of the network they can just see the password in transit.

[null and void]

I figured it had already been done...

[taxcontrol]

Actually I am very aware of rainbow tables and if you review my other posts, you will find that I also describe other ways one can obtain the password. I will point out that rainbow tables ARE NOT reversing the hash. A rainbow table is just a more educated brute force attack.

Many SANS classes are worth the money. However, I already have my CISSP and hold patents in cryptography so I’m not really interested in the majority of classes they offer.