‫So beyond the penetration test, we should perform security audits on the network devices to be sure
‫whether they are configured according to security criteria.
‫Typically, these audits will include password creation methods.
‫Identity management mechanism.
‫Access control lists.
‫S&P Security.
‫And Switch Port Security.
‫In Cisco routers, there are two main methods to create passwords for users and services.
‫The password and the secret method.
‫So let's see these methods and each of their features on the router.
‫So here we are in Genesis three, and we're back on our network.
‫Right click the router and select console to reach the router unless it's already open.
‫If you have a console and you select the console option from the right click menu, it opens another
‫console.
‫Configure T to enter terminal configuration mode.
‫Let's create a new user.
‫Username, I'll name it is Cisco one, and I'll put a question mark to see the options to create a private
‫authentication key word we have two options.
‫The first one is password and the second one is secret.
‫So I'll choose password for this example.
‫And lastly, the password we choose.
‫Can I identify the privilege here to understand this?
‫Just put a few letters of the keyword PR I right here and press tab.
‫So if it's completed, that means the word is allowed here if it wasn't completed.
‫I'll just need to identify privilege as a separate command.
‫So just delete, pry and hit enter.
‫So now we created the users Cisco one with the password, one two three four five.
‫Do identify privilege, as we've seen before, just type username.
‫Cisco one.
‫Privilege.
‫One five.
‫Type exit and hit enter to exit the config mode.
‫And look at that, you will see that we have an information message which says rooter has been configured.
‫Hmm.
‫OK, now let's go to Carly and try to gather the router configuration as a pen tester or ethical hacker.
‫Open terminal screen and run MSFT console.
‫So we've already seen these before, so I'll just keep it fast.
‫Search for Cisco config keywords.
‫Use the auxiliary module.
‫So the options and now set the options community.
‫Our host as that target router.
‫Let me ping the router.
‫OK.
‫Output directory to say the result, I'll choose to save it at the desktop.
‫Our port is OK and the other options are good and their default.
‫Now we can run the module.
‫We the option is our hosts, not our host.
‫I said they are host option.
‫So let me run the module once again.
‫OK, so that'll do for now, the execution of the module completed and the output file, which is the
‫config of our router has been created.
‫Double click to open it.
‫And we have here the configuration of the router.
‫So scroll down a bit.
‫And here's a user we created just a couple of minutes ago Cisco one.
‫As we already know, the password is stored as clear text in this method so we can see the password
‫clearly.
‫Now, let's go one step further, shall we?
‫I'll go back to the router console and go into the configured terminal mode once again.
‫Type in service and put a question mark to see the service options.
‫There is an option here, password encryption to encrypt the system passwords, so let's use it.
‫Exit from the configuration mode to let a rebuild the configuration now will activate the password encryption.
‫So let's go on back to Carly and grab the router configuration again.
‫We already know how to run the auxiliary module, so just help run to run it.
‫The output file is created double click to open it.
‫Scroll down a bit.
‫Then here are the users.
‫As you can see, the password is stored encrypted now.
‫Excellent.
‫So does that mean it's OK now?
‫Mm hmm.
‫No, absolutely not, because the algorithm used to encrypt the passwords is very weak, which only
‫takes a few seconds to crack.
‫So now I'll copy the encrypted password.
‫Open a Web browser.
‫Google, Cisco password paste the hash in search.
‫I'll just click on the first link, which says Cisco Password Cracker.
‫Now be careful where you visit while studying hacking.
‫You might just go face to face with some harmful web sites, and I want to strongly caution you against
‫that.
‫So I'll paste the password hash here and press crack password.
‫Oh man, it took less than a second to crack it.
‫So what should we do to protect the passwords?
‫Now we'll go another step further.
‫I am back in the console of the router again.
‫And are the configure terminal mode.
‫Now, I'll create another user and let me use this secret method now.
‫Type in username, let the username be Cisco to secret and the password.
‫Presenter.
‫So identify the privilege username Cisco to privilege one five.
‫Exit the configuration mode and the configure say.
‫Now, let's go back to Carly and run the auxiliary module once again, so I'll delete the previous output
‫file first.
‫OK.
‫The output file is created double click to open it and scroll down a little.
‫The new users here, Cisco, too.
‫And as you can see, the password is now stored as a Linux like hash value.
‫Do you remember Linux hashes inside the shadow file?
‫They are the fields separated by the dollar sign.
‫The first field is the type of the hash algorithm.
‫The second part is the salt and the rest is the hash value.
‫Now we can say it's more secure.