how to HACK a password // password cracking with Kali Linux and HashCat
Based on NetworkChuck's video on YouTube. If you like this content, support the original creators by watching, liking and subscribing to their content.
Hydra enables online dictionary attacks by testing passwords from a word list against a live service such as SSH.
Briefing
Password cracking is presented as a two-step process: first identify a likely username, then recover the password either by trying guesses against a live login (online) or by testing candidate passwords against a stored password hash (offline). The practical takeaway is that offline cracking with tools like Hashcat is usually faster and less likely to trigger account lockouts, while online cracking with Hydra is more visible because it generates repeated login attempts.
The walkthrough begins with a “brute force” mindset—trying simple passwords like 000000, 000001, and so on—then pivots to more efficient automation. Instead of guessing blindly, it uses Hydra to perform an online dictionary attack against an SSH service. Hydra is configured with a username and a target host, then fed a password list so it can rapidly test many candidates. The transcript emphasizes that this approach relies on a dictionary attack: using lists of common passwords rather than every possible combination. It also points to a built-in Kali Linux word list (notably “rockyou.txt,” distributed as a compressed file) and shows how to locate, decompress, and inspect it.
After demonstrating that the online approach can quickly find a password when the word list contains the right candidate, the discussion flags the operational downside: repeated login attempts can trigger defenses such as firewalls, rate limits, and account lockouts, plus timeouts can slow progress. That leads to the more effective offline method.
Offline cracking is explained through how password storage typically works. When a user sets a password, the system stores a cryptographic hash rather than the plaintext password. During login, the entered password is hashed using the same algorithm (examples mentioned include MD5, SHA-256, and NTLM), and the resulting hash is compared to the stored value. Because hashes can’t be “reversed” in a straightforward way, the recovery strategy becomes brute forcing the hash: take a candidate password from a word list, hash it locally, and check whether the computed hash matches the target hash.
Hashcat is then introduced as the tool for this offline workflow. The transcript walks through creating a file of hashes (by extracting from the system’s shadow file) and running Hashcat with a straight dictionary attack (option “-a 0”). It also covers selecting the correct hash mode with “-m,” using “1800” for SHA-512 Unix passwords in the example and “1000” for NTLM for a Windows-based example. Output is written to a results file (via “-o”), and the cracked password appears among the candidates once the hash match is found.
The segment ends with a challenge: crack the server’s passwords using the learned online (Hydra + word list) and offline (Hashcat + hash + word list) techniques. It repeatedly stresses that doing this without explicit permission is illegal, and frames the exercise as limited to systems where permission is granted or in a self-built lab environment.
Cornell Notes
The transcript contrasts two password-cracking paths: online guessing against a live service and offline cracking against stored password hashes. Online attacks use Hydra with a dictionary (word list) to try many passwords quickly over SSH, but they risk detection, throttling, and lockouts. Offline attacks use Hashcat to test candidate passwords locally by hashing each guess and comparing it to a target hash extracted from the system’s shadow file. Because password systems store hashes (not plaintext), offline cracking can be faster and less disruptive, provided the correct hash type/mode is used (e.g., SHA-512 Unix mode 1800, NTLM mode 1000).
Why does the transcript move from brute force guessing to dictionary attacks?
What makes online cracking with Hydra different from offline cracking?
How does a password hash enable offline cracking?
Why does Hashcat require a specific hash mode (the “-m” option)?
What role do word lists play in both Hydra and Hashcat?
What operational risks are highlighted for online cracking?
Review Questions
- In what ways do online dictionary attacks and offline hash cracking differ in how they generate evidence of the attack?
- How does selecting the correct Hashcat hash mode (e.g., 1800 vs 1000) affect whether a cracked password can be found?
- Why might a large word list still fail even when the correct password exists somewhere in the password space?
Key Points
- 1
Hydra enables online dictionary attacks by testing passwords from a word list against a live service such as SSH.
- 2
Online cracking is more likely to trigger defenses like rate limiting, firewalls, and account lockouts due to repeated authentication failures.
- 3
Password systems typically store cryptographic hashes rather than plaintext passwords, which changes the cracking strategy.
- 4
Offline cracking with Hashcat works by hashing candidate passwords locally and comparing results to stored hashes extracted from the shadow file.
- 5
Hashcat success depends on using the correct hash mode (e.g., 1800 for SHA-512 Unix passwords and 1000 for NTLM).
- 6
Word lists (such as Kali Linux’s rockyou.txt) are central to both online and offline dictionary-based cracking workflows.
- 7
Carrying out password cracking without explicit permission is illegal; the transcript frames the activity as restricted to authorized targets or self-built labs.