Online vs Offline Attacks

Password attacks split into two worlds. Offline attacks work on captured hashes locally — fast, silent, limited only by hardware. Online attacks guess against a live service over the network — slow, noisy, and rate-limited.

Offline cracking (Hashcat, John) requires you to first obtain the hashes — from a database dump, /etc/shadow, or a captured handshake. Once you have them, you can guess billions of times per second with zero network traffic.

Online attacks send login attempts directly to a service: SSH, RDP, FTP, web forms, etc. Speed is capped by network latency and server rate limits, and every attempt may be logged or trigger lockout.

THC-Hydra is the standard online brute-forcer. It supports many protocols and parallelizes login attempts. You supply a username/list, a password list, the target, and the service module.

Key flags:

• -l single user / -L user list
• -p single pass / -P pass list
• -t parallel tasks
• -f stop on first success

For HTTP POST login forms, Hydra needs the path, the POST body with ^USER^/^PASS^ placeholders, and a failure string so it knows which responses are wrong.

Spraying flips brute force: try one common password (e.g. Spring2024!) across many accounts. This avoids per-account lockout thresholds and is highly effective against organizations with weak password policies.

Credential stuffing replays username/password pairs leaked from other breaches, betting that users reuse credentials. It needs no cracking at all — just valid pairs from a previous dump.

Defenders blunt online attacks with account lockout, rate limiting, CAPTCHAs, MFA, and monitoring for many failures. These do little against offline cracking, which is why strong hashing (bcrypt/Argon2) plus salts matter for offline resistance.

If you can steal the hash database, go offline — faster and stealthier. If you only have a login endpoint, you are forced online — then spray a few good passwords slowly rather than hammering one account.

Online attacks can lock out real users and trigger alerts — coordinate with the client and respect lockout policies. Conduct any attack only within an authorized, scoped engagement.

Distinguish the attack types.

You compared attack strategies:

• Offline = crack captured hashes locally; fast and silent
• Online = guess against a live service; slow, noisy, rate-limited
• Hydra brute-forces protocols and web forms
• Spraying and credential stuffing evade lockout and reuse leaks

That completes the Password Cracking course.