01 Why passwords are the front door
In lesson 01.3 you saw that the great majority of breaches start with credentials, either stolen, guessed, or reused from somewhere else. Attackers do not usually kick the door in. They walk through it with a valid username and password.
Here is the part that surprises beginners. The attacker almost never sits at your login page typing guesses. That is slow and noisy. Instead they get hold of the site's stored password data first, take a copy away, and attack it on their own hardware where nobody is watching.
Recall from lesson 00.5 that a well-built site never stores your actual password. It stores a hash, a one-way fingerprint. On a Linux server those hashes live in /etc/shadow, the file you met in lesson 00.3. If an attacker walks off with that file, they hold every user's fingerprint. They cannot reverse a hash, but they can guess, and the whole of this lesson is about how they guess at enormous scale.
Cracking password hashes is legal only when the hashes are yours, or come from an authorised engagement with written permission, or from a CTF or training platform that exists for exactly this. Cracking someone else's password hashes, even ones you found lying in a leak, is a criminal offence in most countries. Everything below is practised on hashes you generate yourself.
02 Online versus offline attacks
There are two completely different places an attacker can guess a password, and the difference decides everything about how the attack feels and how fast it goes.
An online attack throws guesses at a live login, the real one, over the network. A website form, an SSH server, an email account. An offline attack throws guesses at a captured file of hashes on the attacker's own machine, with no live server involved at all.
| Online attack | Offline attack | |
|---|---|---|
| Target | A live login service | A stolen file of hashes |
| Speed | A few guesses per second | Millions to billions per second |
| Held back by | Rate limits, account lockouts, network delay | Only the attacker's own hardware |
| Noise | Loud, every guess is logged | Silent, the defender sees nothing |
| Stopped by | Lockout after a few tries | Nothing, they can run for weeks |
This is why getting the hash file changes everything. Online, a lockout after five wrong tries limits an attacker to a handful of guesses before the account freezes. Offline, that same attacker copies the hashes home and tries billions of guesses per second on a graphics card, and no defender ever sees a single attempt.
an offline attack is just this loop, run absurdly fast on hardware the defender cannot see
03 The five ways attackers guess
Guessing is not one technique, it is a ladder from dumbest and slowest to smartest and fastest. Real cracking sessions climb the ladder in order.
| Attack | What it tries | When it wins |
|---|---|---|
| Brute force | Every possible combination, aaaa, aaab, aaac... | Only for short passwords, it explodes with length |
| Dictionary | A list of likely words and known passwords | When the password is a real word or a common choice |
| Rule-based | Mutations of list words, Password becomes P@ssw0rd, Summer2024! | Against people who "strengthen" a weak base password |
| Mask | A known pattern, such as 8 letters then 2 digits | When you know the password policy or a habit |
| Credential stuffing | Real passwords breached from other sites | Against anyone who reuses a password anywhere |
Rule-based deserves a second look, because it defeats the advice most people follow. Swapping a for @, capitalising the first letter, and adding a 1 or a ! at the end feels clever. A cracking tool applies those exact substitutions to every dictionary word automatically, so P@ssw0rd! falls almost as fast as password.
Credential stuffing is the reason a breach at one company hurts you at another. If a shopping site leaks your email and password, attackers replay that exact pair against your bank, your email, and your work login. It costs nothing and it works constantly, purely because people reuse passwords.
Check yourself
A user's password is Dragon2024!. Which attack cracks this fastest?
dragon, dressed up with a capital, a year, and a bang. A rule-based run over a wordlist applies exactly those mutations and lands it in seconds. Pure brute force of 11 characters would take effectively forever, and the mask for lowercase-only never matches because of the capital, the digits, and the symbol.04 Wordlists: the ammunition
A dictionary attack is only as good as its word list. The most famous one is rockyou.txt, a plain text file of roughly 14 million real passwords. They are real because they came from an actual 2009 breach of a company called RockYou that stored passwords with no protection at all. That leak became the standard starting wordlist, and if a password is in it, it cracks almost instantly.
The sharper move is a targeted wordlist, built for one specific person or company from open-source intelligence, the OSINT you gathered in lesson 02.2. Pet names, a football club, a child's birth year, the company's product names. People build passwords from the things they care about, so a wordlist built from someone's public life often beats a generic 14-million-word file.
05 The tools
Three names cover almost all password work. Two attack captured hashes offline, and one attacks live services online.
| Tool | Use case |
|---|---|
| Hashcat | Offline hash cracking on the graphics card (GPU), the fastest option by far |
| John the Ripper | Offline cracking too, versatile and good at odd or obscure hash formats |
| Hydra | Online attacks against a live service, such as SSH, FTP, or a web login form |
Before you crack anything, you must know what kind of hash you are holding, because the tool needs to be told. This is exactly the length trick from lesson 00.5. Count the characters.
| What you see | Hash type |
|---|---|
| 32 hex characters (0-9, a-f) | MD5 |
| 64 hex characters | SHA-256 |
Starts with $2b$ | bcrypt (slow, deliberately hard) |
Get this wrong and the tool tries to match your guesses against the wrong algorithm and finds nothing, even when the password is in your wordlist. Identifying the hash is not a formality, it is step one.
Check yourself
You want to guess passwords against a company's live SSH login over the network. Which tool fits?
Before you can crack anything you must identify it. Start here.
06 Why salting and slow hashes win
Everything so far assumes cracking is cheap. Good defences make it expensive enough to stop being worth it, and you already met both of them in lesson 00.5.
A salt is random text added to each password before hashing, so two people with the identical password still get completely different hashes. This kills the attacker's biggest shortcut, the precomputed table. Without salt, an attacker hashes the whole rockyou list once and reuses it against every leaked database forever. With a unique salt per password, that precomputed work is worthless, because every hash was built with a different salt and has to be attacked from scratch.
A slow hash such as bcrypt or argon2 attacks the other side of the economics. MD5 lets a graphics card try billions of guesses a second. bcrypt is designed to be deliberately slow, so the same hardware manages only thousands per second. A login barely notices the extra fraction of a second, but an attacker's billion-guess run stretches from an afternoon into a span of years.
Put the two together. A unique salt means every hash must be cracked on its own, with no reuse. A slow algorithm means each of those hashes costs real time. A salted bcrypt or argon2 hash of a decent password is not uncrackable in theory, it is just so slow and so unshareable that mass cracking stops paying off. That, in one sentence, is why modern password storage looks the way it does.
07 Do it on your real machine
You will feel the whole mechanic in five minutes, safely, using only a hash you make yourself. You will pick a word, hash it, identify the hash, then crack it with a tiny wordlist you write by hand. You are never touching anyone else's password.
First install the two offline crackers with Homebrew:
brew install hashcat john
Now make an MD5 hash of a word you choose. Pick anything:
echo -n "sunshine" | md5
You get 32 characters using only 0-9 and a-f. Count them. That length is how you identify it as MD5, the length trick from lesson 00.5, no special tool needed.
Save that hash to a file, then write a tiny wordlist of guesses. Make sure your chosen word is one of the guesses, because a cracker can only find what is in its list:
echo -n "sunshine" | md5 > myhash.txt printf 'password\nletmein\nsunshine\ndragon\n' > mywords.txt
Point Hashcat at the hash with your wordlist. The -m 0 tells it the hash is MD5, and -a 0 means a straight dictionary attack:
hashcat -m 0 -a 0 myhash.txt mywords.txt
Hashcat stores each result it finds, so to print the cracked password again just ask it to show:
hashcat -m 0 myhash.txt mywords.txt --show
You will see your word recovered next to its hash. On a Mac Hashcat may print a note about running on the CPU rather than a dedicated GPU. For this tiny demo that is fine, ignore it.
Prefer John the Ripper? It cracks the same file, you just name the format:
john --format=raw-md5 --wordlist=mywords.txt myhash.txt john --show --format=raw-md5 myhash.txt
When you are done, clean up the two files you created:
rm myhash.txt mywords.txt
To crack hashes that are meant to be cracked, use a platform built for it. picoCTF has free beginner challenges and stays open all year. Hack The Box has guided labs and full practice machines. Both give you explicit permission to attack their targets, which is the entire point. Never point these tools at anything you do not own or are not invited to test.
Your checklist
- Can explain the difference between an online and an offline attack
- Installed hashcat and john with Homebrew
- Made an MD5 hash of my own word and recognised it by its 32 hex characters
- Wrote a tiny wordlist and cracked my own hash with it
- Can explain why salting plus a slow hash makes mass cracking a losing bet
- Bookmarked picoCTF or Hack The Box for legal practice
08 Final check
Question 1 of 3
Why is an offline attack so much more dangerous than an online one?
Question 2 of 3
How does adding a unique salt to each password defeat an attacker's precomputed hash table?
Question 3 of 3
You capture a hash that is exactly 64 characters long, using only 0-9 and a-f. What is it, and what do you tell your cracker?
$2b$, and base64 would include uppercase letters and often an equals sign. Identify the type first so the tool matches your guesses against the right algorithm, or it finds nothing even when the password is in your wordlist.Passwords are the front door, and attackers steal the hash file so they can guess offline, silently, at enormous speed. They climb from brute force to dictionaries to rules, masks, and credential stuffing, aimed with wordlists like rockyou or one built from OSINT. Hashcat and John crack captured hashes, Hydra hits live logins, and you identify the hash by its length before you start. The defence is a unique salt plus a slow algorithm like bcrypt or argon2, which together make mass cracking cost more than it is worth.
✓ Key takeaways
The things from this lesson worth carrying into the next one. If you remember nothing else, remember these.
★ Carry these forward
- Against a stolen file of hashes there is no rate limit, lockout or logging, so guessing runs at billions per second, in silence, on hardware the defender cannot see.
- Brute force tries every combination. A dictionary tries lists of likely passwords, with rules mutating them. Stuffing replays real pairs leaked from other sites.
- A salt makes every hash unique, so precomputed tables cannot be reused. A slow hash like bcrypt or argon2 drops guessing from billions per second to thousands.
⚑ Keep going
You have read it and tried it in the lesson. Now cement it. These three do more for retention than re-reading ever will.