This article explains how passwords are stored, attacked, and secured through hashing, salting, and modern defensive practices. It covers the technical mechanisms behind password cracking tools like Hashcat and Hydra, demonstrates why weak algorithms and poor storage practices fail rapidly under real-world attacks, and provides practical recommendations for building credential security that actually resists compromise. The material is framed within an ethical hacking course for penetration testers and security professionals conducting authorised assessments.
- One-way hashing defeats password reversal attacksPasswords are stored as hashes—fixed-length outputs from mathematical algorithms that cannot be reversed to recover the original password. When a user logs in, the system hashes their input and compares it to the stored hash; attackers cannot reverse this process, so they instead guess passwords, hash each guess, and check for matches. This is why password cracking relies on testing millions of candidates rather than mathematical reversal.
- Algorithm speed determines practical crackabilityFast hash algorithms like MD5 (60 billion hashes/second on GPU) and SHA-256 (10 billion/second) were designed for data integrity, not password storage. Deliberately slow algorithms like bcrypt (20,000/second), scrypt (1,000/second), and Argon2 (500/second) make large-scale guessing computationally infeasible; the same GPU attempting 218 trillion 8-character combinations would need only 60 minutes against MD5 but over 300 years against bcrypt. Algorithm selection is identified as the single most important first line of defence.
- Salting eliminates precomputed rainbow tablesA salt is a unique random string appended to each password before hashing, making identical passwords produce different hashes across users. Rainbow tables—precomputed tables mapping passwords to hashes—become useless because an attacker would need a separate table for every possible salt value. Modern algorithms like bcrypt embed the salt directly in the hash string, storing both together for verification.
- Dictionary attacks exploit predictable password choicesDictionary attacks test every word in wordlists like rockyou.txt, which contains 14.3 million real passwords from the 2009 RockYou breach stored in plaintext. The article notes these attack crack the majority of real-world weak passwords within minutes because people choose predictable combinations; rule-based variants apply transformations (capitalising, adding numbers, replacing letters with symbols) that mirror how users create 'complex' passwords from simple words.
- Five distinct attack strategies target different password patternsThe article describes dictionary attacks (testing wordlists), brute force (all possible combinations, impractical for modern length requirements), rule-based attacks (transforming wordlist entries), mask attacks (targeting specific patterns when partial knowledge exists), and credential stuffing (reusing breached credentials across services). Understanding which strategy applies to a scenario determines whether a test is methodical or computationally wasteful.
- Online and offline cracking serve different purposesHashcat performs offline cracking—testing billions of hashes per second against a password dump you already possess, entirely within your own lab. Hydra performs online attacks, systematically trying credentials against live services (SSH, FTP, HTTP forms) through real network connections. Online attacks risk triggering account lockout policies and require careful coordination with authorised assessments to avoid operational disruption.
- Layered defences make credential compromise insufficientThe article argues length over complexity prevents rule-based attacks; password managers eliminate reuse that enables credential stuffing; multi-factor authentication (authenticator apps, hardware keys) renders even cracked passwords useless; bcrypt or Argon2 with proper cost factors make offline cracking infeasible; and progressive rate limiting plus account lockout defeat online brute force. The single most important addition is MFA on email, VPN, and admin accounts.
- Hash format recognition enables field assessmentThe article provides quick reference patterns for identifying algorithms in /etc/shadow and database dumps: 32 hexadecimal characters indicates MD5, 40 characters indicates SHA-1, the $1$ prefix indicates MD5crypt, $2y$ indicates bcrypt, $6$ indicates SHA-512crypt, and $argon2id$ indicates Argon2. Recognising these formats allows penetration testers to immediately assess an organisation's password storage practices and prioritise cracking efforts.
Bottom line: Password security depends primarily on three factors: using deliberately slow algorithms (Argon2, bcrypt with adequate cost factors), implementing unique salts per user, and enforcing length-based policies rather than complexity rules. A properly salted bcrypt hash with a strong random password is computationally uncrackable with current technology, making algorithm choice and storage practice far more critical than any attack technique.
Day 100 — Professional Pentester
Password security testing is a core component of professional penetration tests. Understanding how these techniques work is essential for:
How Passwords Are Actually Stored — The Hashing Mechanism
No legitimate system stores your password in plaintext. If they did — and some still do, disastrously — any database breach would immediately expose every user’s password. Instead, passwords are passed through a hash function: a mathematical algorithm that converts any input into a fixed-length output string. The critical property of a hash function is that it’s one-way — you cannot mathematically reverse it.
So if hashing is one-way — how do attackers crack passwords? They don’t reverse the hash. They guess the password, hash their guess, and see if the hash matches. If “Password123” hashed with MD5 produces 42f749ad... and they find 42f749ad... in a database dump — they hash every word in their wordlist until one matches. That process is password cracking.
Hash Types — From Dangerously Fast to Deliberately Slow
Not all hash algorithms are equal for password storage. The key metric is speed — and this is counterintuitive. For passwords, slower is better. A fast hash can be computed billions of times per second by modern hardware. A deliberately slow hash — designed for password storage — might allow only a few thousand attempts per second, making large-scale guessing computationally impractical.
| Algorithm | Speed | Designed For | Password Storage? | Notes |
|---|---|---|---|---|
| MD5 | ~60 billion/sec (GPU) | File integrity | ❌ Never | Cryptographically broken. Trivially cracked. |
| SHA-1 | ~25 billion/sec (GPU) | Certificates (deprecated) | ❌ Never | Deprecated by major standards bodies. |
| SHA-256 | ~10 billion/sec (GPU) | Data integrity, TLS | ⚠️ Poor choice | Too fast — without salt+iterations, weak. |
| bcrypt | ~20,000/sec (GPU) | Password storage | ✅ Good | Built-in salt, adjustable cost factor. Widely used. |
| scrypt | ~1,000/sec (GPU) | Password storage | ✅ Better | Memory-hard — expensive on GPU farms. |
| Argon2 | ~500/sec (GPU) | Password storage | ✅ Best | Winner of Password Hashing Competition. Recommended by OWASP. |
Why Salting Changes Everything — The Defence Against Precomputation
Even before cracking tools existed, attackers solved the “hashing is slow” problem with rainbow tables — precomputed tables mapping common passwords to their hashes. If your database uses unsalted MD5 and an attacker has the rainbow table, they look up every hash instantly. No computation needed at attack time.
Salting defeats this completely. A salt is a random string generated uniquely for each user, prepended or appended to their password before hashing. The same password “Password123” produces a completely different hash for every user, because each gets a unique salt. Rainbow tables become useless — they’d need a separate table for every possible salt value.
Attack Types Explained — From Wordlists to Masks
Professional password testers use several distinct attack strategies, each suited to different scenarios. Understanding which type to apply — and why — is what makes the difference between a methodical security assessment and hours of wasted computation.
Tests every word in a wordlist — a file containing millions of real passwords from past breaches, dictionary words, and common patterns. The rockyou.txt wordlist alone contains 14.3 million entries. Dictionary attacks crack the majority of real-world weak passwords within minutes because people choose predictable passwords.
Tests every possible combination of characters up to a given length. Guaranteed to find any password eventually — but time increases exponentially with length and character set size. Practical only for short passwords (under 8 characters) with fast hash algorithms. Modern length requirements make raw brute force largely impractical.
Applies transformation rules to a wordlist — capitalise the first letter, add numbers to the end, replace ‘a’ with ‘@’, append the current year. This mirrors how real people create “complex” passwords from simple words. “password” becomes “Password123!”, “P@ssw0rd”, “password2026”, etc. Extremely effective against password policies that require “complexity.”
Targets a specific password pattern when you have partial knowledge. If you know a company’s policy requires: one uppercase, 6 lowercase, two digits — you define a mask that only generates passwords matching that pattern. Far more efficient than full brute force because it eliminates billions of irrelevant combinations.
Takes username/password pairs from previous breaches and tests them against other services — exploiting password reuse. If someone used “alice@email.com / Hunter2!” on a breached site, attackers try the same credentials on banking, email, and corporate systems. This is why password reuse is catastrophic and why password managers exist.
Wordlists — The Foundation of Dictionary Attacks
The quality of your wordlist determines the quality of your dictionary attack. Kali Linux comes with several pre-installed, and the security community maintains continuously updated collections. Understanding what’s in each wordlist helps you choose the right one for the scenario.
TOOL
Hashcat — Offline Hash Cracking (Lab Only)
Hashcat is the industry-standard tool for offline password hash cracking — meaning you have a hash (from a database dump or a captured file) and you want to find the original password. It uses GPU acceleration to test billions of combinations per second against fast hash algorithms. We use it here on intentionally weak test hashes in our own lab environment.
/etc/shadow, a database dump, or memory). You then crack them offline on your own machine — not on the target. The cracking happens entirely within your own lab environment. Never attempt to crack hashes that belong to systems you don’t have authorisation to test.
TOOL
Hydra — Online Authentication Testing (Lab Only)
While Hashcat works on hashes you already have, Hydra tests live authentication services — SSH, FTP, HTTP login forms, RDP — by systematically trying username/password combinations. This is called an online attack because it involves actual network connections to the target service. It’s used in authorised assessments to test whether services allow weak credentials.
Building Credential Security That Actually Holds
Understanding attacks deeply is what makes defence recommendations credible. Here’s what actually works — based on what we’ve just seen about how these attacks operate. Each recommendation directly addresses one of the attack vectors we covered.
📋 Quick Reference — Identifying Hash Types in the Field
🎯 Day 10 Practical Task
echo -n “YourPassword” | md5sum
echo -n “YourPassword” | sha256sum
echo -n “YourPassword!” | md5sum # one character diff
echo -n “summer2026” | md5sum | awk ‘{print $1}’ > ~/Day10/practice.hash
# Try to crack it
hashcat -m 0 -a 0 ~/Day10/practice.hash /usr/share/wordlists/rockyou.txt
192.168.56.101 ssh -t 4 -V -f
ssh msfadmin@192.168.56.101
sudo cat /etc/shadow
# Look at the hash format — what algorithm does Metasploitable use?
Use Password Strength Checker Tool or zxcvbn (the Dropbox password strength estimator) to test a variety of password patterns. Compare: “Password1!” vs “correct-horse-battery” vs a 20-character random string. What does the estimated crack time show? Share your findings in comments with #Day10Done 🔐
10 days. 10% of the course. Everything from here builds on this.
Mindset. Lab. Linux. File system. Networking. Subnetting. Packets. Scanning. OSINT. Credential security. Day 11 starts Phase 2 — Web Application Security. The most commonly tested category in bug bounty and the source of the most critical findings in corporate pentests.
Frequently Asked Questions — Day 10 How Password Attacks Work
On every penetration test I’ve run, credential issues appear in the findings. Default passwords. Password reuse. MD5 without salt. “Password1” for the VPN. Understanding this topic — not just as an attacker technique but as a systemic organisational weakness — is what lets you have the conversation that actually changes things. That’s what Day 10 is about.
