Stop 06 · Ethical Hacking & Penetration TestingTopics · 9/11

Password Attacks & Cracking

In short

Weak passwords fall fast. Understanding how, at a high level, is what convinces you to use strong hashing, long passphrases and multi factor, which make cracking impractical.

Techniques for obtaining or bypassing passwords — brute force, dictionary attacks, and cracking captured password hashes with tools like Hashcat, exploiting weak password policies from Phase 4.

The blob studies a tiny combination bicycle lock with a magnifying glass.

Think of it like this

Guessing a cheap bicycle lock

A three digit bicycle lock has only a thousand combinations; a patient thief tries them all. A long, random combination would take far too long to be worth it. Passwords work the same way: length and randomness are what defeat guessing.

Watch it happen

Weak versus strong storage

Weak setup

Short, common passwords
Fast or no hashing
No multi factor

Strong setup

Long unique passphrases
Slow salted hashing
Multi factor on top

The defence is not secrecy; it is strong hashing, length and multi factor. Together they make offline cracking too slow to be worthwhile.

The big ideas

What you need to know

Slow, salted hashing

Store passwords with bcrypt, scrypt or Argon2. A unique salt and slow hash make bulk cracking impractical.

Length beats complexity

A long passphrase is both stronger and easier to remember than a short string of odd symbols.

Multi factor is the backstop

Even a cracked password fails without the second factor. MFA blocks the vast majority of account takeovers.

Rate limit and lock out

On live logins, limit attempts and add delays, so online guessing becomes far too slow to succeed.

See it in code

Walk through the code

1import bcrypt from "bcrypt";2 3// Hash a new password with a slow, salted algorithm4const hash = await bcrypt.hash(plainPassword, 12);5// Store 'hash' only, never the plain password6 7// On login, compare safely; bcrypt handles the salt8const ok = await bcrypt.compare(attempt, hash);

1/3bcrypt.hash with a work factor of 12 is deliberately slow, which is what frustrates mass cracking.

A high work factor and a built in salt make each guess expensive, so even a stolen hash list resists bulk cracking. Never store plain passwords.

Save yourself the pain

Common mistakes

Oops

Storing passwords in plain text or with a fast hash like MD5.

Do this instead

Use a slow, salted algorithm such as bcrypt or Argon2, so a leaked database does not hand over passwords.

Oops

Relying on passwords alone for important accounts.

Do this instead

Add multi factor authentication. Even a cracked or phished password then fails without the second factor.

Your mission

Compare hashing speeds

~35 min

Quick check

Why is bcrypt safer than MD5 for storing passwords?

Go deeper

1Practice cracking a sample password hash using Hashcat or John the Ripper on a practice lab.
2Learn why strong hashing algorithms (bcrypt, Argon2) dramatically slow down cracking attempts.
3Understand why password reuse across sites makes credential stuffing attacks so effective.