> For the complete documentation index, see [llms.txt](https://riteshs4hu.gitbook.io/infosec-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://riteshs4hu.gitbook.io/infosec-notes/internal-and-external-network-sec/password-cracking.md).

# Password Cracking

Password cracking can be categorized into two types: **Online Cracking** and **Offline Cracking**. Both techniques have different methodologies, attack surfaces, and challenges.

***

### **Offline Password Cracking**

Offline password cracking involves attempting to crack a password **hash** that has been **obtained** from a system. This typically happens when an attacker extracts password hashes from **a compromised database, memory dump, or stolen credentials**.

#### **Key Characteristics:**

* Requires **hashes**, not direct login attempts.
* Much **faster** than online cracking since there are **no request limits**.
* Can use **GPU acceleration** for high-speed cracking.
* Does not trigger account lockouts or security alerts.
* Requires **initial access** to obtain password hashes (e.g., database breach, memory dump).

#### **Common Targets for Offline Cracking:**

* **Database breaches** (e.g., MySQL, PostgreSQL, MongoDB).
* **Windows SAM file** (stored NTLM hashes).
* **Linux `/etc/shadow` file** (hashed passwords).

#### **Tools for Offline Cracking:**

* **Hashcat** – GPU-accelerated password cracking tool.
* **John the Ripper** – Powerful CPU-based cracker.
* **Cain & Abel** – Older tool for Windows hash cracking.
* **Ophcrack** – Uses rainbow tables to crack Windows passwords.

***

### **Online Password Cracking**

Online password cracking involves **actively** attempting to guess a password by sending authentication requests **directly to the target system or service**.

#### **Key Characteristics:**

* Requires an active internet connection.
* Sends login attempts to a live target (e.g., web application, SSH, RDP).
* Limited by rate limits, account lockouts, and CAPTCHA mechanisms.
* Can trigger security alerts and intrusion detection systems (IDS).
* Slow process due to request-response delays and security measures.

#### **Common Targets for Online Cracking:**

* **Web applications** (e.g., login forms, admin panels).
* **Remote access services** (e.g., SSH, FTP, RDP, VPN).

#### **Tools for Online Cracking:**

* **Hydra** – Automates brute-force and dictionary attacks on multiple protocols (SSH, FTP, HTTP, etc.).
* **Medusa** – Similar to Hydra but optimized for speed and large-scale attacks.
* **Ncrack** – Focuses on cracking network authentication services (SSH, RDP, VNC).
* **Burp Suite** – Used for web application login brute force (Intruder module).