# Password Security and Cracking Lab ## 1\. Executive Summary This lab assessed the security of passwords stored as cryptographic hashes and examined how different password characteristics affect resistance to offline cracking attacks. A controlled test environment was created containing sample user passwords and their corresponding hashes. Multiple attack techniques, including dictionary, brute-force, and hybrid attacks, were evaluated using Hashcat and John the Ripper. Crunch was used to generate custom password wordlists, while Hydra was used to demonstrate controlled online authentication attacks against a lab service. The experiments demonstrated that password length, unpredictability, and the use of appropriate password-storage mechanisms have a significant impact on resistance to password attacks. Short and predictable passwords were recovered relatively quickly, while longer random passwords substantially increased the required search space. * * * ## 2\. Objectives The primary objectives of the lab were: * Understand how passwords are represented using cryptographic hashes. * Compare the resistance of passwords with different lengths and complexity. * Perform controlled dictionary, brute-force, and hybrid attacks. * Use Hashcat and John the Ripper for offline password auditing. * Generate targeted password candidates using Crunch. * Demonstrate the difference between offline password cracking and online authentication attacks. * Examine the security implications of weak password-storage algorithms. * Identify practical mitigation strategies. * * * ## 3\. Lab Environment The experiments were conducted in an isolated laboratory environment using intentionally created test credentials. | Component | Purpose | | --- | --- | | Kali Linux | Security testing environment | | Hashcat | GPU/CPU-based password hash auditing | | John the Ripper | Password hash auditing and recovery | | Crunch | Custom wordlist generation | | Hydra | Controlled online authentication testing | | Test password hashes | Offline cracking experiments | | Isolated test service | Online authentication experiment | No real user credentials or unauthorized systems were used during the experiments. * * * ## 4\. Methodology The assessment was divided into four major stages. ### Stage 1 — Password and Hash Preparation A controlled set of passwords was created with different characteristics: * Short passwords * Dictionary-based passwords * Passwords containing predictable numbers * Mixed-case passwords * Longer passphrases * Randomly generated passwords These passwords were converted into different hash formats for testing. ### Stage 2 — Offline Password Cracking Hashcat and John the Ripper were used to perform several attack types: 1. Dictionary attack 2. Brute-force attack 3. Hybrid/mask attack The objective was to determine which passwords could be recovered and how the password characteristics affected the attack. ### Stage 3 — Wordlist Generation Crunch was used to generate targeted candidate passwords based on known characteristics such as: * Minimum and maximum length * Character sets * Known prefixes/suffixes * Numeric patterns The generated wordlists were subsequently tested against the sample hashes. ### Stage 4 — Online Authentication Testing Hydra was used against an intentionally vulnerable lab authentication service to demonstrate an online password-guessing attack. The experiment was rate-limited and conducted only against the isolated test environment. * * * # 5\. Findings ## Finding 1 — Short and Predictable Passwords Were Highly Vulnerable The first experiment demonstrated that password length and predictability have a major effect on cracking resistance. Simple passwords such as: * `admin123` * `password1` * `welcome123` * `summer2026` were recovered significantly faster than longer, less predictable passwords. The primary reason was not simply the number of characters, but the fact that these passwords follow patterns commonly represented in password dictionaries and cracking rules. ### Security Impact Passwords based on common words, names, dates, or predictable substitutions can be highly susceptible to dictionary and rule-based attacks. ### Recommendation Users should avoid predictable constructions such as: `word + year` `name + number` `word + !` Instead, passwords should be sufficiently long and difficult to predict, preferably using a password manager to generate unique credentials. * * * ## Finding 2 — Password Length Increased the Brute-Force Search Space A controlled brute-force experiment was performed using passwords of increasing length. For a character set containing `N` possible characters and a password length of `L`, the theoretical search space is: `N^L` Therefore, increasing password length can dramatically increase the number of possible combinations an attacker must test. For example, using a 26-character lowercase alphabet: * 4 characters → 26⁴ = 456,976 combinations * 6 characters → 26⁶ = 308,915,776 combinations * 8 characters → 26⁸ = 208,827,064,576 combinations This demonstrates why increasing password length can have a substantial impact on brute-force resistance. ### Security Impact Short passwords provide a relatively small search space and are therefore unsuitable for protecting sensitive accounts. ### Recommendation Password policies should prioritize sufficient length rather than relying exclusively on complicated character-composition rules. * * * ## Finding 3 — Dictionary Attacks Were More Efficient Against Human-Chosen Passwords Dictionary attacks were tested using common-password wordlists. The experiment showed that passwords resembling normal words or commonly used password combinations could be recovered without testing the entire theoretical password space. This makes dictionary attacks considerably more efficient than blindly testing every possible combination. For example, a password such as: `network123` may appear complex because it contains letters and numbers, but its structure is predictable and therefore easier for an attacker to prioritize. ### Security Impact Adding a number or symbol to a common word does not necessarily make a password resistant to modern password-cracking techniques. ### Recommendation Organizations should encourage unique passwords or passphrases and prevent the use of commonly compromised passwords. * * * ## Finding 4 — Hybrid and Rule-Based Attacks Improved Candidate Coverage Hybrid attacks were used to combine dictionary words with predictable modifications. Examples included: * Adding numbers * Adding years * Changing capitalization * Adding common symbols * Appending predictable suffixes The experiment demonstrated that attackers do not necessarily need to perform a complete brute-force search. Instead, they can prioritize combinations that reflect common human password-generation behavior. ### Security Impact Passwords that appear complicated but follow predictable modification patterns may still be vulnerable to modern password-auditing techniques. ### Recommendation Password selection should be based on unpredictability rather than simply satisfying a character-complexity checklist. * * * ## Finding 5 — Hashing Algorithm Selection Had a Major Security Impact Different hashing algorithms exhibited substantially different security characteristics. Fast general-purpose hashing algorithms are designed to perform computations efficiently. This is desirable for many applications but becomes a disadvantage when the algorithm is used directly for password storage. An attacker performing an offline attack can potentially test a very large number of password candidates against a fast hash. Password-storage systems should instead use dedicated password hashing/key-derivation algorithms designed to make large-scale guessing computationally expensive. Suitable modern approaches include: * Argon2id * bcrypt * scrypt * PBKDF2 with an appropriately configured work factor ### Security Impact If an attacker obtains a database containing weakly protected password hashes, they can perform cracking attempts offline without repeatedly interacting with the original authentication system. ### Recommendation Passwords should never be stored as plaintext or using a fast unsalted hash. Password-storage mechanisms should use an appropriate password-hashing algorithm with a unique salt and suitable computational cost. * * * ## Finding 6 — Salting Reduces the Effectiveness of Precomputed Attacks The experiment also examined the purpose of salts in password storage. A salt is a unique random value associated with a password before the password is processed by the password-hashing function. The primary benefits are: * Identical passwords produce different stored hashes. * Precomputed hash tables become less useful. * An attacker cannot efficiently reuse one cracked hash result against every account using the same password. For example, two users selecting the same password should not have identical stored password hashes when proper unique salts are used. ### Recommendation Every password should receive a unique, cryptographically random salt as part of the password-storage process. * * * # 6\. Online vs Offline Attacks The lab demonstrated an important distinction between online and offline password attacks. ### Online Attack An attacker interacts directly with an authentication service. Examples include: * Login password guessing * Credential stuffing * Brute-force login attempts These attacks can potentially be detected and restricted using: * Rate limiting * Account lockout or progressive delays * CAPTCHA where appropriate * Monitoring and alerting * Multi-factor authentication ### Offline Attack An attacker obtains password hashes and performs password guessing without interacting with the original authentication service. This makes traditional login protections such as account lockout ineffective because the attacker is operating against a stolen copy of the password database. This is why **secure password storage is critical even when strong authentication controls are already implemented.** * * * # 7\. Overall Risk Assessment | Finding | Risk | Primary Reason | | --- | --- | --- | | Short predictable passwords | High | Easily prioritized by dictionaries/rules | | Dictionary-based passwords | High | Common password candidates | | Predictable substitutions | Medium–High | Easily incorporated into cracking rules | | Short brute-force passwords | High | Small search space | | Fast password hashing | High | Enables rapid offline guessing | | Missing/weak salting | High | Enables hash reuse and precomputation | | Long random passwords | Lower | Significantly larger/unpredictable search space | | MFA enabled accounts | Lower | Password compromise alone is insufficient | * * * # 8\. Key Lessons Learned The experiments demonstrated several important principles of password security: 1. **Length and unpredictability are fundamental to password strength.** 2. **Human-generated complexity is often predictable.** 3. **Dictionary and hybrid attacks can be significantly more efficient than pure brute force.** 4. **Password hashing and password encryption are not interchangeable concepts.** 5. **Fast hashing algorithms are unsuitable for direct password storage.** 6. **Unique salts help protect password databases against precomputation and hash reuse.** 7. **Offline password attacks are particularly dangerous because they bypass online login protections.** 8. **MFA provides an additional layer of protection when passwords are compromised.** * * * # 9\. Recommended Mitigations Based on the findings, the following controls are recommended: ### Password Storage * Use Argon2id, bcrypt, scrypt, or appropriately configured PBKDF2. * Generate a unique cryptographically random salt for every password. * Never store passwords in plaintext. * Avoid using fast general-purpose hashes directly for password storage. ### Password Policy * Encourage sufficiently long passwords/passphrases. * Block commonly compromised passwords. * Avoid excessive reliance on arbitrary complexity rules. * Encourage unique passwords for different services. ### Authentication Security * Implement multi-factor authentication. * Apply rate limiting to authentication endpoints. * Monitor repeated failed authentication attempts. * Detect credential-stuffing patterns. * Apply progressive delays where appropriate. ### User Security * Use a password manager. * Avoid password reuse. * Replace credentials that are known to have been exposed. * Use MFA for important accounts. * * * # 10\. Conclusion The password auditing exercises demonstrated that password security depends on both the characteristics of the password and the security of the system responsible for storing it. Weak and predictable passwords were significantly easier to recover using dictionary, brute-force, and hybrid techniques. The experiments also demonstrated that increasing password length and unpredictability substantially increases the difficulty of password guessing. However, strong passwords alone are not sufficient. If an attacker obtains a database containing poorly protected password hashes, offline cracking can be performed without triggering normal authentication defenses. The overall security posture therefore depends on a combination of **strong password selection, secure password hashing, unique salting, rate limiting, monitoring, and multi-factor authentication**.