Password cracking concepts (authorized labs only)

Overview

Offline cracking tests guesses against recovered hashes at GPU speed (no lockout): dictionary (wordlists), rule-based (human-style mutations), mask/brute force, and hybrid, via Hashcat/John (CeWL builds wordlists; Hydra is online). Lab-only. Defenses: slow KDFs, length-based policy, breach screening, MFA.

Why it matters

Understanding how cracking works — and that fast hashes plus weak passwords make it trivial — motivates the storage and policy defenses, and is necessary to assess password posture in authorized engagements.

Core concepts

Offline vs online. Hashes locally (fast, silent) vs live login (slow, lockout). Dictionary/rules/mask/hybrid. Guess strategies. Tools. Hashcat, John, CeWL (wordlists), Hydra (online, lab-only). Defenses. Slow KDFs, length policy, breach screening, MFA.

Lesson

When you legally recover password hashes (from a lab, or a breach you're authorized to assess), offline cracking tests guesses against them at high speed. This is lab-only and tied to explicit authorization.

Offline vs online

• Offline: you have the hashes; guess locally at GPU speed, no lockout, no noise. Fast hashes fall quickly; slow KDFs resist.
• Online: guessing against a live login — slow, noisy, lockout-prone (this is spraying/brute force, next lesson).

Approaches

• Dictionary attack: try a wordlist (e.g. common passwords / breached-password lists). Fastest, highest yield.
• Rule-based: apply transformations to wordlist entries (password → P@ssw0rd!) — mimics how humans modify passwords.
• Mask/brute force: try all combinations of a pattern (e.g. 8 chars, charset) — exhaustive, for short/structured passwords.
• Hybrid: wordlist + mask.

Tools (conceptual)

• Hashcat (GPU), John the Ripper — apply the above to recovered hashes; CeWL builds a target-specific wordlist; Hydra does online attacks (lab-only).

The defensive takeaway

Cracking exists because of weak passwords + fast hashes. The defenses you'd recommend: slow KDFs (prior lesson), strong/length-based password policy, breached-password screening, and MFA so a cracked password isn't enough. (This track's C exercise implements a tiny dictionary-cracking loop so you feel the mechanic.)

Summary

Offline cracking applies dictionary, rule, mask, and hybrid guessing to recovered hashes at high speed — trivial against fast/weak hashes. It's strictly authorized-lab work, and it makes the case for slow KDFs, strong policy, and MFA.

Practice with these exercises

• Dictionary attack against a hash