A friend of mine used cain and able a his work place, in order to capture NTLM hashes . After doing some successful brute forcing attacks on captured accounts, he managed to obtain the usernames and passwords of few employers at his institute. While checking the validity of the captured accounts, it turned out that 3 out of 4 accounts was valid. One account was invalid.
The dilemma here is that he checked multiple times about the username, you can do that by logging with your account and checking the database of the employees, you can search using (first name, last name, email address). The name is 100% corresponds to the captured one. He referred to me and I checked it many time, trying to log in from different computers with no result. Furthermore, it's quite impossible as far as I know for cain to yield and incorrect password. We all know that brute forcing generates a random passwords,then hash it and tries to match it with the captured hash. What could be the problem here? I also highly doubt the targeted employee changed his password. Could it be that the server doesn't accept logging in with different accounts from the same IP, as a security measure.
