Password Audit Plan

Password audit plan

Offline password auditing is a measured experiment over supplied material. Algorithm, hardware, candidate space, runtime, and cohort denominators determine what the result means. Preserve unknowns until measurement exists.

This skill plans and records offline analysis. It does not collect hashes, expose raw material, generate organization-derived candidates, authenticate, spray, stuff, replay, test reuse, contact accounts, or access target systems.

When to Use

• Preparing or documenting password cracking without online authentication, spraying, stuffing, replay, or credential reuse testing.
• Use only within explicit authorization and the stated rules of engagement.

When NOT to Use

• Do not treat this skill as permission to access, test, or change a target.
• Do not convert missing evidence into a clean result or a stronger claim.

Workflow

1. Record authorization, offline-only boundary, compute and storage ceilings, prohibited sources and actions, stop conditions, workspace, retention, owner, and disposition evidence.
2. Inventory each dataset using opaque IDs. Record source class, record and unique digest counts, acquisition-time precision, algorithm claim, validation state, cost parameters, integrity, and limitations. Never place raw hashes in the plan.
3. Preserve record counts and digest counts separately. Deduplicate work while keeping the mapping needed to expand aggregate recoveries back to record and cohort counts.
4. Define cohorts with explicit denominators and overlap rules. Disabled, privileged, service, administrator, and standard populations remain separate where supplied.
5. Plan format validation and a measured benchmark before recovery passes. Do not invent throughput, runtime, keyspace completion, or recoveries.
6. Order bounded passes from generic baseline through generic rules, bounded masks, and optional adaptive work. Each pass names dependencies, candidate-source class, dataset, GPU budget, expected measurement, and stop conditions.
7. Let the review reject budget over-allocation, recovery before validation and benchmark, prohibited candidate sources, online actions, unproved results, and inconsistent cumulative counts.
8. Record pass results as counts and rates only. Attribute each unique recovery to its first successful pass; expand record recovery and cohort recovery from the preserved mapping without exposing plaintext.
9. Analyze aggregate length, character-class, duplicate, pattern-label, cohort, policy shape, and marginal-yield metrics. A policy document is a requirement, not proof a recovered password complied when created.
10. Track raw datasets, recovered material, potfiles, restore state, generated candidates, logs, and exports through disposition. Report only approved aggregate artifacts and opaque IDs.
11. Cover format, deduplication, cohorts, benchmark, baseline, rules, masks, adaptive work, handling, and reporting for every dataset. Blocked work remains visible.

Boundary with adjacent skills

• Use credential-exposure-audit to inventory possible credential exposure without cracking or decrypting.
• Use password-audit-plan only after offline material and authority are supplied.
• Use findings-report after aggregate audit results are proven.
• Online authentication, spraying, stuffing, reuse checks, and account contact require a separate capability and authorization; they are outside this skill.

Rationalizations to reject

• "The manifest says NTLM, so mode selection is settled." Validate structure before spending compute or interpreting results.
• "Deduplication reduced 1,000 accounts to 860 hashes." It reduced work items, not the reporting population. Expand results back to records and cohorts.
• "The benchmark should be about this fast." Hardware labels and published speeds are not measurements of this dataset and configuration.
• "Eight hours means every pass gets an equal share." Allocate from measured cost, expected evidence value, and explicit priorities; record the rationale.
• "Recovered means valid." Offline equality says nothing about current account state, usability, privilege, or successful authentication.
• "Examples make the pattern finding clearer." Plaintext examples and reusable candidate strings do not belong in the assessment record or report.
• "The potfile is just tool state." It contains recovered evidence and inherits the same storage, access, retention, and deletion rules.
• "One more pass cannot hurt." The compute ceiling and stop conditions are part of authorization, even when the hardware is idle.