Auditing Password Reuse After a Portal Leak is a practical Kali Linux project for learners who can enter terminal commands and recognize file paths. A community organization has retired a staff portal, but its old password export may still threaten a working archive. Your task is to establish which recovered credentials actually reach an authorized current identity.
Two Guided Labs teach the workflow: recover synthetic legacy passwords with John the Ripper, preserve the employee relationship, then test exact authorized pairs with Hydra and SSH. One independent Challenge transfers those methods to a workshop archive with different records, accounts and a different port. Every unit starts with its own prepared scene.
What You Will Learn
- Perform a bounded dictionary recovery against real SHA-512 crypt hashes and retain account-linked results in private files.
- Connect legacy records to approved current logins through stable employee IDs, even when display names repeat.
- Test exact credential pairs with Hydra and distinguish a completed rejection from connection or tool failure.
- Observe an authenticated SSH identity and produce a password-free impact inventory.
- Keep demonstrated reuse, rejected old credentials, missing authorization and unrecovered passwords as separate conclusions.
Who This Course Is For
This course is for Kali Linux learners and aspiring security analysts who want a small, complete credential assessment beyond an isolated cracking command.
Prerequisites: Basic terminal input and path recognition. Start with the first Guided Lab; it teaches the required options, private-file handling and recovery workflow before you apply them independently. No programming or prior Hydra experience is required.
Learning environment: LabEx provides the browser-based Auditor terminal, Kali tools, synthetic evidence and an isolated real SSH service. The auditor and target are containers sharing one VM kernel. No local Kali installation, external account or public target is needed.
Frequently Asked Questions
Does cracking an old password prove current account access?
No. You must map the record to an authorized current login and test that exact credential pair. The course makes these separate judgments visible.
Does an unrecovered password mean it is secure?
No. It means this supplied candidate budget did not recover it. The project records that uncertainty rather than certifying password strength.
Will I change passwords or attack public systems?
No. All identities and targets are part of the prepared exercise. You preserve the current service and its accounts while assessing impact; password rotation is a separate task.
What will I deliver?
A private set of recovery evidence and exact credential pairs, supported by actual authentication decisions, plus a password-free inventory of the four different impact outcomes. The Challenge asks you to assemble these results without a guided recipe.
