OSCP · Module 12
Password Attacks
Brute force, password spraying, and offline cracking with hashcat and John the Ripper against network services and captured hashes.
~2 h 5 resources Last updated September 25, 2026
Weak and reused passwords remain one of the most reliable entry points in a penetration test. PEN-200 covers both online attacks (brute force, password spraying, dictionary attacks against live services) and offline attacks (cracking captured hashes with hashcat and John the Ripper). Knowing when to spray versus brute force, picking the right wordlist, and applying mutation rules separates a noisy failed attempt from valid credentials.
Network Service Login Attacks
SSH, RDP, WinRM, FTP, and web logins are common targets for password attacks. Each protocol has its own tooling and lockout behavior. Password spraying (few passwords, many users) avoids lockouts. Brute force (many passwords, one user) works when lockout policies are weak or absent. Always check the lockout policy before spraying to avoid locking out accounts during an engagement.
Offline Password Cracking
Once you capture password hashes (from SAM dumps, LSASS, database breaches, or network captures), offline cracking runs without lockout risk. Hashcat and John the Ripper support hundreds of hash types. Wordlist selection, rule-based mutation, and mask attacks determine cracking speed and success rate. Understanding hash formats (NTLM, NTLMv2, bcrypt, MD5, SHA-512) tells you which tool settings and attack modes to use.
Warning
HackIndex does not currently have dedicated pages for hashcat, John the Ripper, wordlist generation, or rule-based mutation attacks. Refer to the PEN-200 course material for offline cracking exercises and hash identification.
Read
The core material for this module. Where a guide goes deeper than needed, the relevant sections are highlighted.
-
Guide 4 min readFTP Authentication Attacks