Passwords are currently used as the main method to authenticate a user to the system. After a user submits the correct username and password, the system will allow a user to log in and access its functionality based on the authorization given to that username.

The following three factors can be used to categorize authentication types:

• Something you know: This is usually called the first factor of authentication. A password is categorized in this type. In theory, this factor should only be known by the authorized person. In reality, this factor can easily be leaked or captured; therefore it is not advisable to use this method to authenticate users to a sensitive system.
• Something you have: This is usually called the second factor of authentication, examples of this factor include security tokens and cards. After you prove to the system that you have the authentication factor, you are allowed to log in. The drawback of this factor is that it is prone to the cloning process.
• Something you are: This is usually called the third factor of authentication, examples include biometric and retina scans. This factor is the most secure one, but already there are several published attacks against this factor.

To have more security, people usually use more than one factor. The most common combination is to use the first and second factors of authentication. As this combination uses two factors of authentication, it is usually called a two-factor authentication.

Unfortunately, based on our penetration-testing experiences, password-based authentication is still widely used. As a penetration tester, you should check for password security during your penetration testing engagement.

According to how the password attack is done, this process can be differentiated into the following types:

• Offline attack: In this method, the attacker gets the hash file from the target machine and copies it to the attacker's machine. The attacker then uses the password cracking tool to crack the password. The advantage of using this method is that the attacker doesn't need to worry about the password-blocking mechanism available in the target machine because the process is done locally.
• Online attack: In this method, the attacker tries to log into the remote machine by guessing the credentials. This technique may trigger the remote machine to block the attacker machine after several failed attempts to guess the password.