1. Executive Summary

This lab assessed the security of passwords stored as cryptographic hashes and examined how different password characteristics affect resistance to offline cracking attacks.

A controlled test environment was created containing sample user passwords and their corresponding hashes. Multiple attack techniques, including dictionary, brute-force, and hybrid attacks, were evaluated using Hashcat and John the Ripper. Crunch was used to generate custom password wordlists, while Hydra was used to demonstrate controlled online authentication attacks against a lab service.

The experiments demonstrated that password length, unpredictability, and the use of appropriate password-storage mechanisms have a significant impact on resistance to password attacks. Short and predictable passwords were recovered relatively quickly, while longer random passwords substantially increased the required search space.

2. Objectives

The primary objectives of the lab were:

• Understand how passwords are represented using cryptographic hashes.

• Compare the resistance of passwords with different lengths and complexity.

• Perform controlled dictionary, brute-force, and hybrid attacks.

• Use Hashcat and John the Ripper for offline password auditing.

• Generate targeted password candidates using Crunch.

• Demonstrate the difference between offline password cracking and online authentication attacks.

• Examine the security implications of weak password-storage algorithms.

• Identify practical mitigation strategies.

3. Lab Environment

The experiments were conducted in an isolated laboratory environment using intentionally created test credentials.

No real user credentials or unauthorized systems were used during the experiments.

4. Methodology

The assessment was divided into four major stages.

Stage 1 — Password and Hash Preparation

A controlled set of passwords was created with different characteristics:

• Short passwords

• Dictionary-based passwords

• Passwords containing predictable numbers

• Mixed-case passwords

• Longer passphrases

• Randomly generated passwords

These passwords were converted into different hash formats for testing.

Stage 2 — Offline Password Cracking

Hashcat and John the Ripper were used to perform several attack types:

1. Dictionary attack

2. Brute-force attack

3. Hybrid/mask attack

The objective was to determine which passwords could be recovered and how the password characteristics affected the attack.

Stage 3 — Wordlist Generation

Crunch was used to generate targeted candidate passwords based on known characteristics such as:

• Minimum and maximum length

• Character sets

• Known prefixes/suffixes

• Numeric patterns

The generated wordlists were subsequently tested against the sample hashes.

Stage 4 — Online Authentication Testing

Hydra was used against an intentionally vulnerable lab authentication service to demonstrate an online password-guessing attack.

The experiment was rate-limited and conducted only against the isolated test environment.

5. Findings

Finding 1 — Short and Predictable Passwords Were Highly Vulnerable

The first experiment demonstrated that password length and predictability have a major effect on cracking resistance.

Simple passwords such as:

• admin123

• password1

• welcome123

• summer2026

were recovered significantly faster than longer, less predictable passwords.

The primary reason was not simply the number of characters, but the fact that these passwords follow patterns commonly represented in password dictionaries and cracking rules.

Security Impact

Passwords based on common words, names, dates, or predictable substitutions can be highly susceptible to dictionary and rule-based attacks.

Recommendation

Users should avoid predictable constructions such as:

word + year

name + number

word + !

Instead, passwords should be sufficiently long and difficult to predict, preferably using a password manager to generate unique credentials.

Finding 2 — Password Length Increased the Brute-Force Search Space

A controlled brute-force experiment was performed using passwords of increasing length.

For a character set containing N possible characters and a password length of L, the theoretical search space is:

N^L

Therefore, increasing password length can dramatically increase the number of possible combinations an attacker must test.

For example, using a 26-character lowercase alphabet:

• 4 characters → 26⁴ = 456,976 combinations

• 6 characters → 26⁶ = 308,915,776 combinations

• 8 characters → 26⁸ = 208,827,064,576 combinations

This demonstrates why increasing password length can have a substantial impact on brute-force resistance.

Security Impact

Short passwords provide a relatively small search space and are therefore unsuitable for protecting sensitive accounts.

Recommendation

Password policies should prioritize sufficient length rather than relying exclusively on complicated character-composition rules.

Finding 3 — Dictionary Attacks Were More Efficient Against Human-Chosen Passwords

Dictionary attacks were tested using common-password wordlists.

The experiment showed that passwords resembling normal words or commonly used password combinations could be recovered without testing the entire theoretical password space.

This makes dictionary attacks considerably more efficient than blindly testing every possible combination.

For example, a password such as:

network123

may appear complex because it contains letters and numbers, but its structure is predictable and therefore easier for an attacker to prioritize.

Security Impact

Adding a number or symbol to a common word does not necessarily make a password resistant to modern password-cracking techniques.

Recommendation

Organizations should encourage unique passwords or passphrases and prevent the use of commonly compromised passwords.

Finding 4 — Hybrid and Rule-Based Attacks Improved Candidate Coverage

Hybrid attacks were used to combine dictionary words with predictable modifications.

Examples included:

• Adding numbers

• Adding years

• Changing capitalization

• Adding common symbols

• Appending predictable suffixes

The experiment demonstrated that attackers do not necessarily need to perform a complete brute-force search.

Instead, they can prioritize combinations that reflect common human password-generation behavior.

Security Impact

Passwords that appear complicated but follow predictable modification patterns may still be vulnerable to modern password-auditing techniques.

Recommendation

Password selection should be based on unpredictability rather than simply satisfying a character-complexity checklist.

Finding 5 — Hashing Algorithm Selection Had a Major Security Impact

Different hashing algorithms exhibited substantially different security characteristics.

Fast general-purpose hashing algorithms are designed to perform computations efficiently. This is desirable for many applications but becomes a disadvantage when the algorithm is used directly for password storage.

An attacker performing an offline attack can potentially test a very large number of password candidates against a fast hash.

Password-storage systems should instead use dedicated password hashing/key-derivation algorithms designed to make large-scale guessing computationally expensive.

Suitable modern approaches include:

• Argon2id

• bcrypt

• scrypt

• PBKDF2 with an appropriately configured work factor

Security Impact

If an attacker obtains a database containing weakly protected password hashes, they can perform cracking attempts offline without repeatedly interacting with the original authentication system.

Recommendation

Passwords should never be stored as plaintext or using a fast unsalted hash. Password-storage mechanisms should use an appropriate password-hashing algorithm with a unique salt and suitable computational cost.

Finding 6 — Salting Reduces the Effectiveness of Precomputed Attacks

The experiment also examined the purpose of salts in password storage.

A salt is a unique random value associated with a password before the password is processed by the password-hashing function.

The primary benefits are:

• Identical passwords produce different stored hashes.

• Precomputed hash tables become less useful.

• An attacker cannot efficiently reuse one cracked hash result against every account using the same password.

For example, two users selecting the same password should not have identical stored password hashes when proper unique salts are used.

Recommendation

Every password should receive a unique, cryptographically random salt as part of the password-storage process.

6. Online vs Offline Attacks

The lab demonstrated an important distinction between online and offline password attacks.

Online Attack

An attacker interacts directly with an authentication service.

Examples include:

• Login password guessing

• Credential stuffing

• Brute-force login attempts

These attacks can potentially be detected and restricted using:

• Rate limiting

• Account lockout or progressive delays

• CAPTCHA where appropriate

• Monitoring and alerting

• Multi-factor authentication

Offline Attack

An attacker obtains password hashes and performs password guessing without interacting with the original authentication service.

This makes traditional login protections such as account lockout ineffective because the attacker is operating against a stolen copy of the password database.

This is why secure password storage is critical even when strong authentication controls are already implemented.

7. Overall Risk Assessment

8. Key Lessons Learned

The experiments demonstrated several important principles of password security:

1. Length and unpredictability are fundamental to password strength.

2. Human-generated complexity is often predictable.

3. Dictionary and hybrid attacks can be significantly more efficient than pure brute force.

4. Password hashing and password encryption are not interchangeable concepts.

5. Fast hashing algorithms are unsuitable for direct password storage.

6. Unique salts help protect password databases against precomputation and hash reuse.

7. Offline password attacks are particularly dangerous because they bypass online login protections.

8. MFA provides an additional layer of protection when passwords are compromised.

9. Recommended Mitigations

Based on the findings, the following controls are recommended:

Password Storage

• Use Argon2id, bcrypt, scrypt, or appropriately configured PBKDF2.

• Generate a unique cryptographically random salt for every password.

• Never store passwords in plaintext.

• Avoid using fast general-purpose hashes directly for password storage.

Password Policy

• Encourage sufficiently long passwords/passphrases.

• Block commonly compromised passwords.

• Avoid excessive reliance on arbitrary complexity rules.

• Encourage unique passwords for different services.

Authentication Security

• Implement multi-factor authentication.

• Apply rate limiting to authentication endpoints.

• Monitor repeated failed authentication attempts.

• Detect credential-stuffing patterns.

• Apply progressive delays where appropriate.

User Security

• Use a password manager.

• Avoid password reuse.

• Replace credentials that are known to have been exposed.

• Use MFA for important accounts.

10. Conclusion

The password auditing exercises demonstrated that password security depends on both the characteristics of the password and the security of the system responsible for storing it.

Weak and predictable passwords were significantly easier to recover using dictionary, brute-force, and hybrid techniques. The experiments also demonstrated that increasing password length and unpredictability substantially increases the difficulty of password guessing.

However, strong passwords alone are not sufficient. If an attacker obtains a database containing poorly protected password hashes, offline cracking can be performed without triggering normal authentication defenses.

The overall security posture therefore depends on a combination of strong password selection, secure password hashing, unique salting, rate limiting, monitoring, and multi-factor authentication.