search

safebuffer / vulnerable-AD

Create a vulnerable active directory that's allowing you to test most of the active directory attacks in a local lab
MIT License
1.98k stars 374 forks source link

Default Password - Is a randomly generated 12 character mixed case, special char password. #3

Closed Console closed 3 years ago

Console commented 3 years ago

The default password routine appears to set a randomly generated password that has some complexity and is 12 chars long. This seems a bit borked from it's intended purpose.

Additionally the "default password" is set within the "password spraying" function - yet a 12 char randomly generated password is unlikely to succeed in a password spray.

But the password in the comments could be a 12 character random password (and is) yet the function is called "default password".

It just seems a little backwards, I'd expect something like a "changeme123!" or "thedomain1!" or something, not "d4pf?Ani4A7!" as a default password.

Happy to submit a pull request for the change if you think its worth the effort, just needs to wait until this evening once I get back from work.

safebuffer commented 3 years ago

hi @Console, I was thinking about renaming this one to be "password in Object description" and create another function for "default password" which's gonna pick random passwords from a predefined list that contains such passwords you mentioned, however, feel free to submit a PR for that function! on the other hand, I'm planning to deploy some new stuff before the end of this month!

Console commented 3 years ago

That's epic. Bit of a delay on this just real life getting in the way but will throw a pull req over when I get a moment.

safebuffer commented 3 years ago

pushed smt today , feel free to PR anything or share any idea , thanks for feedback