Purple Edge
Get started

Password & Credential Attacks

intermediate5 labsSubscription

The full credential-attack lifecycle: identifying hash types, offline cracking with Hashcat and John, wordlist/rule/mask crafting, online brute-force and spraying, and NTLM pass-the-hash/relay.

This path is available with a Purple Edge subscription. Sign in to read the full overview and start the labs.

Labs in this path

  1. 1
    intermediate Hands-on lab Subscription

    Hashing & Identifying Hashes

    Before you can crack a credential you have to know what it is. Learn to fingerprint MD5, SHA-family, NTLM, and bcrypt hashes by length and structure, and confirm with hashid and hash-identifier so you pick the right Hashcat/John mode every time.

    35 min3 tasksCredential Access
  2. 2
    intermediate Hands-on lab Subscription

    Cracking with Hashcat

    Hashcat is the world's fastest password recovery tool. Learn the two attacks you reach for daily - straight dictionary (-a 0) and rule-based mangling - against NTLM and MD5 using the rockyou wordlist, plus how to read --show, --status, and the potfile.

    45 min3 tasksCredential Access
  3. 3
    intermediate Hands-on lab Subscription

    Cracking with John & Wordlist Crafting

    John the Ripper is Hashcat's CPU-first sibling and the king of unusual hash formats. Learn john's single/wordlist/incremental modes and --format, then craft targeted wordlists with cewl (scrape a site) and crunch (generate by pattern), and build Hashcat masks for structured guessing.

    50 min3 tasksCredential Access
  4. 4
    intermediate Hands-on lab Subscription

    Online Brute-Force & Password Spraying (Hydra)

    When you can't get the hashes, you attack the login itself. Learn THC-Hydra for controlled online brute-force against SSH and HTTP login forms, the http-post-form failure-string syntax, and low-and-slow password spraying that flips brute force around to dodge account lockout.

    45 min3 tasksCredential Access
  5. 5
    advanced Hands-on lab Subscription

    Pass-the-Hash & NTLM Relay

    The endgame of credential attacks: capture NetNTLMv2 challenge-responses with Responder, crack them offline (hashcat -m 5600), and when cracking fails, pass-the-hash with impacket - using the raw NT hash to authenticate without ever knowing the password.

    55 min3 tasksCredential Access

Unlock this lab

Launch the lab in your browser. Real Kali, Ubuntu and Windows targets, guided step by step. No setup, no VM downloads.

Create free accountSign in to start

Updated 2026-06-06