Password Hacking: Techniques, Tools & Prevention

Modern systems never store passwords in plaintext. Instead, they store password hashes — one-way mathematical transformations that convert the password into a fixed-length string. When you log in, the system hashes your input and compares it to the stored hash.

Common hashing algorithms include MD5 (weak, deprecated), SHA-1 (deprecated), SHA-256/SHA-512 (better but fast), bcrypt (designed for passwords — slow and salted), and Argon2 (current best practice, resistant to GPU attacks).

Salting adds a random value to each password before hashing, ensuring that identical passwords produce different hashes. Without salting, attackers can use precomputed hash tables to crack multiple passwords simultaneously.

Key stretching algorithms like bcrypt, scrypt, and Argon2 intentionally slow down the hashing process, making brute-force attacks computationally expensive. A single bcrypt hash might take 100 milliseconds — trivial for a login but devastating for an attacker trying billions of guesses.

Brute force attacks systematically try every possible combination of characters. Against short passwords (6 characters or less), brute force is practical. Modern GPUs can test billions of simple hashes per second, making short passwords trivially crackable.

Dictionary attacks use wordlists containing common passwords, words from dictionaries, and leaked password databases. Rule-based attacks modify dictionary words using transformations like appending numbers, replacing letters with symbols, and capitalizing letters.

Rainbow table attacks use precomputed tables mapping hashes back to plaintext passwords. These tables trade storage space for computation time — a large rainbow table can crack unsalted hashes almost instantly. Salting defeats rainbow table attacks completely.

Credential stuffing uses username/password combinations leaked from data breaches against other services. Because many people reuse passwords across sites, credentials from one breach can unlock accounts on unrelated platforms.

John the Ripper is the most versatile password cracker. It auto-detects hash types, supports hundreds of formats, and offers multiple attack modes: single crack (uses username-derived guesses), wordlist (dictionary + rules), and incremental (brute force).

Hashcat harnesses GPU processing power for dramatically faster cracking. It supports over 300 hash types and attack modes including dictionary, combinator (combining words), mask (targeted brute force), and rule-based attacks. A high-end GPU can test 100 billion MD5 hashes per second.

Hydra performs online password attacks against live services. Unlike John and Hashcat which crack password hashes offline, Hydra attempts logins over the network: 'hydra -l admin -P wordlist.txt ssh://target_ip' tests passwords against an SSH server.

CeWL (Custom Word List generator) crawls a target's website and builds a custom wordlist from the content. Combined with rules in John or Hashcat, these organization-specific wordlists are extremely effective because people often use work-related terms in their passwords.

Enforce password complexity: minimum 12 characters, mixing uppercase, lowercase, numbers, and symbols. Better yet, encourage passphrases — four or more random words are both more secure and easier to remember than complex short passwords.

Implement account lockout policies that temporarily lock accounts after a set number of failed login attempts. Add rate limiting to prevent rapid automated attacks. Use CAPTCHA challenges after multiple failures to block automated tools.

Deploy multi-factor authentication (MFA) wherever possible. Even if a password is compromised, MFA provides a second barrier. Hardware security keys (FIDO2/WebAuthn) offer the strongest protection against phishing-based credential theft.

Regular password audits using tools like John the Ripper can identify weak passwords in your organization. Hash the passwords from your authentication database and attempt to crack them — any password that falls quickly needs to be changed.