Ivan used a software utility called L0phtcrack3 (pronounced loft-crack; available at www.atstake.com ; another source for some excellent password recovery tools is www.elcomsoft.com ). System administrators use L0pht-crack3 to audit weak passwords; attackers use it to crack passwords. The brute force feature in LC3 tries passwords with combinations of letters, numerals, and most symbols including !@#$%^&. It systematically tries every possible combination of most characters. (Note, however, that if nonprintable characters are used, LC3 will be unable to discover the password.)