Cracking and auditing an Activity Directory database can be a time-consuming process for any admin. But, a new tool called PwdPwn (password pone) from Sydney developer Luke Millanta promises the ability to audit an Active Directory database with more than 5,000 passwords within 15-30 seconds.

According to Millanta, PwdPwn is meant to be used as both a security analysis and a reporting tool to audit the strength of Active Directory user account passwords stored within an NTDS database file. In Millanta’s words, here’s the five-step process for using PwdPwn:

  1. The user points the application to the NTDS database files (NTDS.dit and the associated SYSTEM registry hive).
  2. The application dumps the hashes out of the NTDS database.
  3. Once dumped, the hashes are cracked so the passwords are displayed in plain text.
  4. Once in plain text, the strength of each password is measured.
  5. A comprehensive report is then generated for the user.

SEE: Information security policy (Tech Pro Research)

The impetus for creating the tool came with Millanta watching a friend of his audit an Active Directory database, noting how much time the process took. Millanta said that he saw no reason it should take so long, and he believed automation could help solve the problem.

From Millanta’s own experience and feedback he received from pen-testers, NDTS database auditing is still very much a manual process in many respects.

“First you have to take a copy of your NDTS database files, then you have to dump the hashes, crack these hashes, audit the passwords, and build your report,” Millanta told TechRepublic. “Doing this manually could take hours if not days. PwnPwn is able to do all of this in a matter of seconds.”

In creating PwdPwn, Millanta hopes to provide system administrators with an easier way to conduct such audits on a more regular basis, within a much faster time frame, he said. That way, admins could more readily enforce strong password policies and standards.

To further this goal, Millanta will eventually release PwdPwn as an open source tool. At that time, it will be available on his GitHub page here.

“I think organisations need to start taking user password policies more seriously,” Millanta said. “I have seen far too many senior executives–people with access to highly sensitive information, information that could drastically influence the future of their company’s stock price–with passwords of ‘Hello123.’ This needs to change.”

Millanta went on to note that he believes users must be educated on the repercussions of poor password hygiene, and he hopes this tool can help with that.

To get a better picture of how most users approach passwords, an OpenVPN report found that 25% of employees use the same password for every account they have. Additionally, 23% of employees said they often click links before even verifying that they lead to a legitimate website. Needless to say, any new tool that can help improve user security and password practices could be a welcome addition to any workplace.

The big takeaways for tech leaders:

  • PwdPwn, a security tool from Sydney developer Luke Millanta, can audit an Active Directory database with more than 5,000 passwords within 15-30 seconds.
  • PwdPwn will eventually be released as an open source offering, which could help more organizations enforce strong password policies.