TechKnowSurge

VideoSecurityFree

DEMO: Password and Credential Attacks

Password and credential attacks rely on tools like Hydra and Hashcat to compromise authentication systems through techniques ranging from brute force to hash cracking. This content covers how attackers acquire credentials and how these two tools are used in ethical penetration testing scenarios.

⚑ Complete this video to capture a CTF flag worth 1 point.

About this video

Credential-based attacks are among the most common entry points in real-world compromises, and understanding how attackers obtain and exploit authentication data is essential for security professionals. Passwords are typically acquired in one of two broad ways: they are already known to the attacker through theft or purchase, or they are discovered through systematic guessing. Theft methods include social engineering tactics like phishing and shoulder surfing, passive interception via keyloggers or adversary-in-the-middle attacks, and large-scale data breaches where username and password databases are leaked or sold by access brokers on criminal marketplaces. Once credential data is in hand, purpose-built tools are used to operationalize it. Hydra is designed for online attacks against live services, automating the process of testing large lists of username and password combinations against targets like FTP servers, web applications, and other network-accessible systems. It works in real time against a running service, making it effective for credential stuffing and brute force scenarios where the goal is to find a valid login. Hashcat, by contrast, is an offline password recovery tool used when a database of hashed passwords has already been obtained. Because passwords are stored as cryptographic hashes rather than plaintext, Hashcat attempts to reverse-engineer those hashes by comparing them against wordlists and common password patterns until a match is found. Practical demonstrations of both tools illustrate the distinction clearly. Hashcat can take a known hash and, by running it against a wordlist, identify the original plaintext password, such as recovering a credential like "monkey1" from its hashed representation. Hydra, given a list of candidate credentials and a target host, can systematically attempt FTP connections and identify valid logins among thousands of combinations. Both tools are widely used in authorized penetration testing engagements and represent core competencies in offensive security work. Their use outside of explicitly authorized environments constitutes a criminal offense, and all practical application of these techniques must occur within a legal, ethical testing framework.

What you'll learn

Distinguish between Hashcat and Hydra by explaining their respective roles in password hash cracking and credential-based application attacks
Identify common methods used to acquire or compromise credentials, including social engineering, data breaches, brute force attacks, and credential stuffing

What's covered

Password & Credential Attacks

Password Acquisition Methods
- Stolen Passwords
  - Social Engineering
  - Eavesdropping & Keyloggers
  - Data Breaches
- Guessing Techniques
  - Brute Force Attacks
  - Wordlists & Dictionaries
  - Credential Stuffing
Hashcat
- Cracks Hashed Passwords
- Compares Hash to Wordlist
- Reverse Engineers Hash
Hydra
- Attacks Login Applications
- Uses Username & Password Lists
- FTP Server Example
Ethical Hacking Reminder

Key terms

Social Engineering: A manipulation technique that exploits human psychology to trick individuals into revealing confidential information.
Phishing: A social engineering attack that uses deceptive emails or messages to trick users into revealing sensitive information.
Brute Force Attack: An attack method that systematically tries all possible combinations of passwords or keys until the correct one is found.
Dictionary Attack: A type of brute force attack that uses a predefined list of common words and phrases to guess passwords.
Hash Function: A mathematical algorithm that converts input data of any size into a fixed-size output value used to verify data integrity.
Credential Stuffing: An automated attack in which stolen username and password pairs from one breached service are systematically tested against other services to gain unauthorized access. It exploits users who reuse passwords across multiple accounts.
Hashcat: An open-source password recovery and cracking tool that recovers plaintext passwords by comparing computed hash values against wordlists, brute-force sequences, or generated candidate patterns. It is widely used in authorized penetration testing and forensics.
Hydra: A network login cracking tool that performs credential-based attacks against live applications and services such as FTP, SSH, and HTTP.

Topics

Password Attacks Credential Stuffing Brute Force Hashcat Hydra Hash Cracking Penetration Testing

Transcript

Getting Into a System With Credentials

If we're trying to gain access into a system, then perhaps what we need to do is figure out some sort of credentials to get into that system. One of the programs that we can use to do that would be Hydra. Another one is Hashcat.

Just remember that what we learn in here could be considered cyber crime if you're doing it in the wrong places. Make sure you practice ethical hacking only.

How Passwords Get Acquired

If we have passwords, there's pretty much two ways that we've gotten the password: somehow we know it — we've stolen it or we purchased it — or we have guessed it.

Here are some ways that we could acquire stolen passwords. One of them is through social engineering. We could use some sort of phishing technique, or some sort of shoulder surfing where we're looking over somebody when they're typing in their password, to gain access to their passwords. Another one is eavesdropping — either actually physically being there, or more likely maybe a key logger or some sort of machine in the middle or adversary in the middle.

Perhaps it's from some sort of data breach. The data breach could be because they've been hacked before, because there's some sort of malware on the systems, or the network got hacked, or whatever the case may be, where there's a bunch of usernames and passwords that have been released. We can go and actually download these databases, or we could purchase them as well. There is something out there called an access broker that has these credentials, and you can purchase that from them.

There's also software that can help us guess things. We could carry out some sort of brute force attack, or use a word list of common passwords and dictionary words, or we could use credential stuffing. There are mask attacks, and there's just known information that's out there that we can utilize and pump into these systems to figure out and crack these passwords.

Hashcat Versus Hydra

We're going to be taking a look at two different programs, Hashcat and Hydra, that serve very different purposes. Hashcat allows us to crack passwords, versus Hydra, which allows us to figure out credentials to sites. What's the difference? One is that credentials are a username and password, versus Hashcat, which is just meant to crack passwords.

Hydra is going to allow us to attack an application. We can — and we're going to use FTP as an example — go in there and test a lot of different passwords to see if we can crack into that application. Hashcat would be more if we stole a bunch of usernames and passwords from a database. These passwords aren't stored in clear text; instead, they're stored in a hash. So Hashcat will figure out what the hashes are for those passwords.

Cracking a Hash With Hashcat

I'm first of all going to use our Hashcat program. What you see right here is the password, and this is the password that's been hashed, so it's in a hashed form. We're going to crack it by looking at this hash and comparing it to this word list right here. It'll try all these different words out and see if it can reverse engineer it and find this hash, and when it finds this hash, then it's going to give it to us.

So I'm going to hit enter on here. Once again, what it's looking for is that hash, and it found one from that word list right there. This is the hash, and it's a hash of the password monkey one.

That is what Hashcat is used for: when you already had the hash and what you're trying to do is figure out the password that's associated with that hash.

Testing Credentials With Hydra

The next one I said we'd take a look at is Hydra. In this case right here we've got a list of credentials. Inside this text file right here is a list of usernames and passwords. We're going to check it against this server right here, 10.110.40, and use FTP. Essentially what's happening is it's trying to make an FTP connection to this server and then trying to use this list of usernames and passwords in order to hack into that server.

We'll go ahead and hit enter, and it's once again trying all these different combinations out. Then we see that three valid passwords have been found. It was able to log into the FTP server on this host using B Jones with a password exclamation point, this one right here with the PW crack demo monkey 1, and then new employee temp password. So those are some different logins that they used out of this document that we had of usernames and passwords.

Read the full transcript Show less

About TechKnowSurge

TechKnowSurge builds IT and cybersecurity professionals through hands-on, concept-first training built around real understanding — not memorization. Free interactive tools, structured programs, and 25+ years of real-world experience, all in one place.

Explore free tools and programs →