diff --git a/password-strength/src/main/java/org/owasp/webgoat/plugin/PasswordStrength.java b/password-strength/src/main/java/org/owasp/webgoat/plugin/PasswordStrength.java index 14856bce..028d0a14 100644 --- a/password-strength/src/main/java/org/owasp/webgoat/plugin/PasswordStrength.java +++ b/password-strength/src/main/java/org/owasp/webgoat/plugin/PasswordStrength.java @@ -60,20 +60,20 @@ public class PasswordStrength extends LessonAdapter { private Map passwords = new TreeMap() {{ - put("pass1", new Password("123456", "seconds", "0", "dictionary based, in top 10 most used passwords")); - put("pass2", new Password("abzfezd", "seconds", "2", "26 chars on 7 positions, 8 billion possible combinations")); - put("pass3", new Password("a9z1ezd", "seconds", "19", "26 + 10 chars on 7 positions = 78 billion possible combinations")); - put("pass4", new Password("aB8fEzDq", "hours", "15", "26 + 26 + 10 chars on 8 positions = 218 trillion possible combinations")); - put("pass5", new Password("z8!E?7D$", "days", "20", "96 chars on 8 positions = 66 quintillion possible combinations")); - put("pass6", new Password("My1stPassword!:Redd", "quintillion years", "364", "96 chars on 19 positions = 46 undecillion possible combinations")); + put("pass1", new Password("123456", "seconds", "0", "Common password: In the top 5 most used passwords")); + put("pass2", new Password("abzfezd", "seconds", "0.2", "Possible a word")); + put("pass3", new Password("a9z1ezd", "seconds", "2", "Length short")); + put("pass4", new Password("aB8fEzDq", "hours", "2", "Length short")); + put("pass5", new Password("z8!E?7D$", "days", "2", "Length short")); + put("pass6", new Password("My1stPassword!:Redd", "quintillion years", "36", "Length long")); }}; private class Password { - + String password; String timeUnit; String answer; - private String explanation; + String explanation; public Password(String password, String timeUnit, String answer, String explanation) { this.password = password; diff --git a/password-strength/src/main/resources/plugin/PasswordStrength/lessonSolutions/en/PasswordStrength.html b/password-strength/src/main/resources/plugin/PasswordStrength/lessonSolutions/en/PasswordStrength.html index a656ac51..b025210c 100644 --- a/password-strength/src/main/resources/plugin/PasswordStrength/lessonSolutions/en/PasswordStrength.html +++ b/password-strength/src/main/resources/plugin/PasswordStrength/lessonSolutions/en/PasswordStrength.html @@ -27,11 +27,14 @@ Here are the results you get:

Password = 123456: 0 seconds
-Password = abzfezd: 2 seconds
-Password = a9z1ezd: 19 seconds
-Password = aB8fEzDq: 15 hours
-Password = z8!E?7: 20 days
-Password = My1stPassword!:Redd: 364 quintillion years
-


+Password = abzfezd: 0.2 seconds
+Password = a9z1ezd: 2 seconds
+Password = aB8fEzDq: 2 hours
+Password = z8!E?7D$: 2 days
+Password = My1stPassword!:Redd: 36 quintillion years
+
+ +Important to note
+It is possible that a password could be a dictionary word or a name. In the case of a name it might be easy to guess. If it's looks like a dictionary word it could be cracked very quickly. \ No newline at end of file