bob is conducting a password assessment

What are the means that Bob can use to get password from his client hosts and servers?