测试Plone密码强度
我正在 Plone 站点上执行渗透测试。一旦我有了密码（使用 SSHA 进行哈希处理），是否有任何工具可以评估密码的强度？
谢谢和问候， 鳗鱼
I am performing a penetration test on a Plone site. Is there any tool to assess the password's strength, once I have the passwords (hashed with SSHA)?
Thanks and regards,
Grig
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（3）
如果您只有哈希值，那么您可以做出的唯一评估就是尝试猜测确切的密码，这有点昂贵。然后，你要么打破它，要么不打破它；没有中间立场。您可以使用猜测密码所花费的时间来估计密码强度，但希望好的密码会花费比实际更长的时间。这就是对密码进行哈希处理的要点：这样猜测密码并使用哈希值进行验证只需几周或几个月的时间，而不是几分钟。
作为渗透测试的一部分，如果您有哈希密码，那么您应该运行密码破解程序。如果尚未集成确切的密码哈希过程，您可能需要开发一些软件。任何被破解的密码都会被报告为严重的系统缺陷。
通常的密码强度估计器通过尝试确定密码的可猜测程度来对未散列的密码进行操作。这在实践中效果不太好，因为“猜测”可能涉及人脑，从而逃避了精确的建模。例如，您可以通过连接四个或五个日期（例如以YYMMDD格式）来创建一个长密码；这样的密码估计具有良好的强度 - 但如果日期是您妻子和孩子的出生日期，那么很可能该密码实际上很容易猜到。
If you only have the hash, then the only assessment you can make is by trying to guess the exact password, which is kind of expensive. And then, either you break it, or not; there is no middle ground. You could use the time it took you to guess the password as an estimate for the password strength, but, hopefully, good passwords will take a longer time than is practical. That's the point of hashing passwords: so that guessing the password and verifying it with the hash is a matter of weeks or months, not minutes.
As part of a penetration test, if you have the hashed passwords, then you should run a password cracker. You may have to develop a bit of software if the exact password hash process is not already integrated. Any broken password would be reported as a severe system weakness.
Usual password strength estimators operate on the unhashed password, by trying to determine how much guessable the password is. This does not work very well in practice, because "guessing" may involve human brains, which evade accurate modelling. For instance, you can make a long password by concatenating four or five dates (e.g. in the YYMMDD format); such a password will be estimated to have a good strength -- but if the dates are the birth dates of your wife and children, then chances are that the password is actually easy to guess.
不。
如果我理解正确，您建议为假设的工具提供哈希值，而不是明文密码本身。我对这个猜想相当有信心：您所描述的工具将告诉您更多有关 SSHA 加密的信息，而不是底层密码的强度。
我会以积极的方式说：评估密码强度的工具对明文密码进行操作；否则，它主要测量哈希方法的熵。
当然，我的主张并没有特别的克隆人内容。当然，基于现有密码强度检查器之一构建 Plone（或 Zope ...）产品应该很简单。据我所知，没有任何一个是为公众打包的。
No.
If I understand you correctly, you are proposing to supply the hypothesized tool with a hash rather than the cleartext password itself. I am reasonably confident in this conjecture: a tool as you describe it will tell more about the SSHA encryption than the strength of the underlying password.
I'll say this in a positive way: a tool to assess password strength operates on the plaintext password; otherwise, it measures mostly the entropy of the hashing method.
There's no particular Plone content to my claims, of course. To build a Plone (or Zope ...) product based on one of the existing password strength-checkers should, of course, be straightforward. I'm aware of none that have been packaged for the public.
SSHA 或更常见的称为 salted sha1 是一种存储密码的好方法。 SHA1 在技术上已被破坏，但没有人产生冲突，并且它仍然在 NIST 推荐的消息摘要函数列表中。
John The Ripper 可用于破解加盐的 sha1 哈希值。
加盐 SHA256 会是更好的选择。
SSHA or more commonly known as a salted sha1 is a good method of storing passwords. SHA1 is technically broken but no one has generated a collision and it is still on the list NIST recommended message digest functions.
John The Ripper can be used to break salted sha1 hashes.
A salted SHA256 would be a better choice.