Bob is conducting a password assessment for one of his clients. Bob suspects that password policies are not in place and weak passwords are probably the norm throughout the company he is evaluating. Bob is familiar with password weaknesses and key loggers. What are the means that Bob can use to get password from his client hosts and servers?