What's Up Ethicalhacker.net,

I was wondering & since I don't see it listed in security courses, when you are involved in a penetration test, you may often crack an ssh or ftp password, windows account passwords with Ophcrack (like how Apollo did in Part 2 of His 15 Minute Pentest), but I was wondering, do you guys actually go to the extent of accessing the users mail account? I'm sure some of you could use tools such as wifizoo, etc to perform session hijacking but do you guys actually go to the extent to say, "Here's an employees (possibly the IT Admin) e-mail address, I'm going to run a brute force utility against it, obtain the password (if I can) and not change it but go through his mail to obtain more information". Is this even an option for you guys or do you consider cracking the users e-mail address passwords unethical?

We don't go for the email password, but we do shoot for any account on the system when we do a test event. Often our client wants to know about any passwords that are not up to snuff with the requirements. And we regularly break the weak passwords. We are looking at ginning up some rainbow tables to help with the harder stuff. Should be fun.