In this chapter, we covered the fundamental theory behind Windows passwords and their hashed representations. We looked at both raw hashes as they're stored in the SAM and encrypted network hashes. We then reviewed the fundamental design flaws that make Windows hashes such a lucrative target for the pen tester. The Metasploit Framework was introduced for the first time to demonstrate auxiliary modules; we used the SMB listener module to capture authentication attempts from misled Windows targets on the network. We then demonstrated a type of link-local name service spoofing that can trick a target into authenticating against our machine as well. With the captured credentials from our demonstration, we moved on to practical password cracking with John the Ripper. We covered the two primary methodologies of password cracking with John and demonstrated ways to fine-tune the attack depending on human factors.  

In the next chapter, we will move on to more sophisticated network attacks. We'll build on our experience building man-in-the-middle bridges to quietly compromise SSL traffic. We'll look at routing attacks, software upgrade attacks, and we'll cover a crash course in IPv6 from a pen tester's perspective.