Bob is doing a password assessment for one of his clients. Bob suspects that security policies are not in place. He also suspects that weak passwords are probably the norm throughout the company he is

All three methods are legitimate password retrieval techniques in a penetration testing context. Hardware keyloggers are physical devices intercepting keystrokes between keyboard and system, software keyloggers capture input at the OS or application level, and network sniffing captures credentials transmitted over the wire - particularly effective against cleartext or weakly-encrypted protocols such as FTP, Telnet, and HTTP. A thorough assessment leverages all three vectors.

Hardware and software keyloggers alone omit network sniffing, which is a distinct and independently effective technique for capturing credentials in transit across the network.

Hardware keyloggers are not always the best method - they require physical access to the target machine, making them impractical in many remote or large-scale assessment scenarios.

Software keyloggers alone are insufficient as a complete methodology; hardware keyloggers and network sniffing cover attack vectors that software keyloggers cannot address.