# Password Attacks

> Brute force, password spraying, and offline cracking with hashcat and John the Ripper against network services and captured hashes.

- **URL:** https://hackindex.io/learn/oscp-pen-200-study-path/password-attacks
- **Certification:** [OSCP (PEN-200) Study Path](https://hackindex.io/learn/oscp-pen-200-study-path.md)
- **Estimated study hours:** 2
- **Published:** 2026-09-24
- **Updated:** 2026-09-25

Weak and reused passwords remain one of the most reliable entry points in a penetration test. PEN-200 covers both online attacks (brute force, password spraying, dictionary attacks against live services) and offline attacks (cracking captured hashes with hashcat and John the Ripper). Knowing when to spray versus brute force, picking the right wordlist, and applying mutation rules separates a noisy failed attempt from valid credentials.

## Network Service Login Attacks

SSH, RDP, WinRM, FTP, and web logins are common targets for password attacks. Each protocol has its own tooling and lockout behavior. Password spraying (few passwords, many users) avoids lockouts. Brute force (many passwords, one user) works when lockout policies are weak or absent. Always check the lockout policy before spraying to avoid locking out accounts during an engagement.

## Offline Password Cracking

Once you capture password hashes (from SAM dumps, LSASS, database breaches, or network captures), offline cracking runs without lockout risk. Hashcat and John the Ripper support hundreds of hash types. Wordlist selection, rule-based mutation, and mask attacks determine cracking speed and success rate. Understanding hash formats (NTLM, NTLMv2, bcrypt, MD5, SHA-512) tells you which tool settings and attack modes to use.

> [!WARNING]
> HackIndex does not currently have dedicated pages for hashcat, John the Ripper, wordlist generation, or rule-based mutation attacks. Refer to the PEN-200 course material for offline cracking exercises and hash identification.

## Study material

- [SSH Password Credential Attacks](https://hackindex.io/services/ssh/exploitation/ssh-password-credential-attacks.md) (read, core)
- [RDP Brute Force and Password Spraying](https://hackindex.io/services/rdp/exploitation/brute-force-password-spray.md) (read, core)
- [WinRM Brute Force and Password Spraying](https://hackindex.io/services/winrm/exploitation/brute-force-password-spray.md) (read, core)
- [FTP Authentication Attacks](https://hackindex.io/services/ftp/exploitation/ftp-authentication-attacks.md) (read, core)
- [Login Page Enumeration](https://hackindex.io/services/web/enumeration/login-page-enumeration.md) (read, core)