Post cover image
Photo by Jefferson Santos on Unsplash

October 25, 2026

12 Password Cracking Concepts Every Pentester Should Know (Step-By-Step Guide)

Ever wondered how many passwords are just “password123” or “qwerty”? You’d be shocked. According to Verizon’s Data Breach Investigations…

By Very Lazy Tech 👾

7 min read

Ever wondered how many passwords are just "password123" or "qwerty"? You'd be shocked. According to Verizon's Data Breach Investigations Report, over 80% of hacking-related breaches involve weak or stolen passwords. Yet, most pentesters (and attackers) still break into systems because defenders underestimate how passwords truly get cracked.

Pull back the curtain, and you'll see: password cracking isn't just about brute force. There's art, knowledge, and some underappreciated cleverness. In this deep dive, you're going to learn the 12 must-know password cracking concepts every penetration tester, hacker, and cybersecurity pro needs to have in their toolbox.

Whether you're prepping for a bug bounty, just starting out in pentesting, or aiming for that elusive privilege escalation, these are the concepts that actually work in the real world. Let's jump in and get hands-on.

None

Hash Functions and Their Weaknesses

Before you even pick up a password cracker like Hashcat or John the Ripper, you need to get comfortable with hash functions. You might think, "How hard can hashing be?" Well, let's unpack it.

What's a Hash Function, Really?

A hash function takes any input and spits out a fixed-length string. Think of it like a signature — but for data. In theory, these signatures should be unique. In practice… not always.

Common password hashes you'll meet in the wild:

  • MD5 (e10adc3949ba59abbe56e057f20f883e)
  • SHA-1 (5baa61e4c9b93f3f0682250b6cf8331b7ee68fd8)
  • bcrypt (more resilient, uses computational cost)
  • NTLM (still found in Windows environments)

Why Are Weak Hashes a Gift to Attackers?

  • Speed: Fast hashes like MD5 and SHA-1 mean attackers can try millions of passwords per second.
  • No Salting: Hashes like NTLM don't use salts, so repeated passwords always look the same. That opens the door to rainbow tables (more on those soon).

Let's say you recover this NTLM hash on a Windows box:

8846f7eaee8fb117ad06bdd830b7586c

What's the password? If you guessed "password", you win — because NTLM, by default, doesn't salt.

Why It Matters

If you understand the strengths and weaknesses of each hash, you'll know:

  • How hard a target is to crack
  • Which tools and attack strategies will actually work

2. Salting: The Secret Ingredient (Or the Missing One)

Salting is like adding an extra sprinkle of randomness to a password before hashing. Sadly, many legacy systems just don't bother. And that's a problem.

How Does Salting Work?

A "salt" is a random value added to the password before hashing. So, two users with "password" don't have the same hash.

Say a user's salt is XY12:

Password: password
Salt: XY12
Hash input: passwordXY12

Now hash that. Totally different output from just hashing "password".

Why Do Pentesters Care?

Without salts, attackers use precomputed tables (rainbow tables) and instantly look up hashes for common passwords. When salts are present, rainbow tables get… huge. So big they're impractical.

Pro tip: Always check if user hashes are salted. Sometimes, you'll spot the salt stored right next to the hash in the database. That's your cue!

3. Rainbow Tables (And Why They're Still Scary)

Rainbow tables are like cheat sheets for password cracking. Instead of brute-forcing every hash, attackers precompute tons of possible hash results and just look them up.

Practical Example: Using a Rainbow Table

Imagine you grab a hash dump containing MD5 hashes. You can use tools like rtcrack with a rainbow table:

rtcrack -f hashes.txt -d md5.rainbow

If the password is common and unsalted, bam — instant crack.

Limitations

  • Salting kills rainbow tables.
  • Storage: Huge tables need lots of disk space.

But in penetration testing, you'll still see hash dumps without salts, especially in old web apps or Windows environments. If you see that… rainbow tables are your friend.

4. Brute Force Attacks: The Sledgehammer Method

Brute force is the simplest — and often noisiest — way to crack a password.

How Does It Work?

You try every possible combination until you find the right one. It's slow, but it works… eventually.

Code Example: Brute Forcing a Simple Password

Let's say you want to brute force a 4-digit numeric PIN:

from itertools import product

for combo in product('0123456789', repeat=4):
    guess = ''.join(combo)
    # Check guess against hash...

This script will try all possibilities from 0000 to 9999`.

When Is Brute Force Practical?

  • Short passwords (think Wi-Fi PINs, legacy apps)
  • Weak hashes (super-fast to calculate)

But honestly — most serious pentesters reach for smarter tricks first. Brute force is slow, triggers alerts, and gets you blocked fast on rate-limited systems.

Tip from experience: blend brute force with smarter attacks, or you'll waste hours for nothing.

5. Dictionary Attacks: Smart Guessing

You know what most people do? They pick passwords from lists of words they like — pet names, band names, dictionary words, sports teams.

How a Dictionary Attack Works

Instead of trying every possible combination, you try words from a curated list. That's a dictionary file — and there are some famous ones: rockyou.txt is legendary.

Using Hashcat for Dictionary Attack

hashcat -m 0 -a 0 hashes.txt rockyou.txt
  • -m 0: MD5 hash mode
  • -a 0: Dictionary attack

Hashcat will munch through the list and try every word as a password.

Making Your Own Custom Dictionary

Let's say you're pentesting a company called "VeryLazyTech". You might generate a list:

VeryLazyTech2024
verylazy123
TechR0cks!

The best pentesters always create custom wordlists tailored to the target — scrape social media, company bios, anything you can find.

6. Hybrid Attacks: Mixing It Up

Here's where things get interesting. Hybrid attacks blend dictionary and brute force. You take a wordlist, and then mutate it — adding numbers, symbols, or patterns.

Why Hybrids Work

Most users think they're clever by adding a "1", "!" or "2024" at the end of a word. Hybrid attacks exploit this laziness.

Example: Hashcat Hybrid Command

hashcat -m 0 -a 6 hashes.txt rockyou.txt ?d?d
  • -a 6: Dictionary + mask (adds digits)
  • ?d?d: Appends two digits to every word

So password becomes password12, password99, etc.

Real Pentester Move

I once cracked an exec's password because they took their dog's name, added their birth year, and stuck a "!" at the end. Hybrid attack? Crushed it in seconds.

7. Rule-Based Attacks: The Custom Powerhouse

You ever notice how many people use "Password123!" or "Summer2023"? Rule-based attacks let you define how passwords are mutated.

What's a Rule File?

Rule files describe transformations:

  • Capitalize first letter
  • Append digits
  • Substitute letters with numbers (a -> @, o -> 0)

Example Rule File (Hashcat style)

c       # capitalize first letter
$1      # append 1
$!      # append !

Running a Rule-Based Attack

hashcat -m 0 -a 0 -r myrules.rule hashes.txt rockyou.txt

This will try every word in rockyou.txt, applying your custom rules.

Pentester Pro-Tip

You'll get way more hits with a good rule set than basic dictionary. Study your target's naming schemes — you'll spot patterns people use over and over.

8. Mask Attacks: Targeted Guessing

Mask attacks are all about precision. You define the structure of a password — like "8 characters, starts with a capital, ends with numbers".

Why Use a Mask?

When you have an idea about the password format (length, composition), mask attacks are lethal.

Hashcat Mask Example

hashcat -m 0 -a 3 hashes.txt ?u?l?l?l?l?d?d
  • ?u: uppercase
  • ?l: lowercase
  • ?d: digit

That mask tries passwords like Abcde12.

Real-World Scenario

  • Corporate policies often require passwords like Xxxxx999.
  • You can tailor your mask to these patterns and slice through the search space.

Small Detail: Mask Syntax

  • ?l = lowercase
  • ?u = uppercase
  • ?d = digit
  • ?s = special character

The cool part? You can mix and match. Super useful for RCE exploits or privilege escalation where you snag a policy-enforced password hash.

9. Credential Stuffing: When Password Reuse Bites Back

Credential stuffing is using known username/password pairs (from previous breaches) to break into new systems. Because, let's be honest, people reuse passwords everywhere.

How Credential Stuffing Works

  • Find a breach dump (e.g., from a SQLi'd site)
  • Reuse these credentials on other services (email, VPN, cloud)

Practical Example: Using Sentry MBA or Burp Intruder

You load a combo list:

alice@email.com:SuperSecure1!
bob@verylazytech.com:Password123

Automate login attempts against the target portal.

Why It's Deadly

  • Password reuse is rampant. Even savvy users slip up.
  • If you're pentesting, always check for reused credentials — especially for privilege escalation.

I've personally cracked admin panels just by trying old breach combos. Silly, but it works.

10. Password Spraying: Slow, Stealthy, and Sneaky

Password spraying is the art of attacking many accounts with a few passwords at a time, instead of hammering one account with tons of guesses. Why? Avoids lockouts and detection.

Step-By-Step: Password Spraying with CrackMapExec

Let's say you suspect "Winter2024!" is the company's flavor of the month.

crackmapexec smb 10.0.0.0/24 -u userlist.txt -p Winter2024!
  • -u userlist.txt: List of usernames
  • -p Winter2024!: The password to try

It'll try this password for every user on the network share.

When to Use It

  • Enterprise environments
  • Active Directory (AD)
  • Anytime lockout policies are strict

Human Touch

Honestly, password spraying is my go-to on internal pentests. When you see 20% of staff with "Spring2024!" after a forced reset, you'll understand why.

11. Cracking Passwords with GPU Power

CPUs are fine, but GPUs are built for this work. Tools like Hashcat and John the Ripper can use multiple GPU cores, crunching through thousands of hash calculations in parallel.

Why GPUs Matter

  • Massive speed-up for brute force, dictionary, and hybrid attacks.
  • Ability to attack even complex hashes like bcrypt (though slowly).

Practical Example: Hashcat Running on GPU

hashcat -m 1000 -a 0 -w 3 --force hashes.txt rockyou.txt
  • -w 3: High performance workload
  • --force: Ignore warnings (not always recommended, but sometimes necessary)

You'll see your GPU hum. For pentesters, having a decent NVIDIA card is a huge edge.

A Quick Anecdote

I once cracked a 10-character NTLM hash overnight with a mid-tier GPU. CPU? Would've taken days. If you're serious about password cracking, invest in GPU hardware.

12. The Psychology of Passwords (And Social Engineering)

Here's the human part. Passwords aren't random — they're emotional, memorable, and predictable.

Social Engineering Meets Password Cracking

  • Most users pick passwords meaningful to them.
  • Birthdays, kid names, sports teams, favorite bands.
  • Company name + year is perennial (e.g., "VeryLazy2024").

Real Recon Techniques

  • Scrape LinkedIn, Facebook, Instagram for target info.
  • Compile a custom wordlist: nicknames, hobbies, company slogans.
  • Use cewl to spider websites and pull out keyword lists.

Example: Using cewl to Generate a Wordlist

cewl https://www.verylazytech.com -w customlist.txt

Now, feed this wordlist into your dictionary or hybrid attacks.

Why This Matters

The best pentesters blend technical skill with social awareness. If you really understand your target, you'll get inside their head — and, likely, their accounts.

Key Takeaways (The Pentester's Shortcut List)

Let's recap. If you remember nothing else, remember these:

  1. Identify the hash: Know what you're cracking. Is it salted? Slow? Old?
  2. Start smart: Use dictionaries, custom wordlists, and rules before brute force.
  3. Watch for reuse: Credential stuffing and spraying are shockingly effective.
  4. Leverage GPU: Hardware matters. Get a good GPU and your speed multiplies.
  5. Think human: Passwords are rarely random. Social recon goes a long way.

Bonus: My Go-To Password Cracking Toolkit

If you're building out your arsenal, here's what should be in your pentesting bag:

  • Hashcat: The GPU king. Handles nearly every hash type.
  • John the Ripper: Flexible, works well on CPUs.
  • crackmapexec: For SMB/AD password spraying.
  • Cewl: Recon tool for custom wordlists.
  • Burp Suite / Sentry MBA: Credential stuffing and automation.

Remember, every password tells a story. The more you learn about why and how people choose them, the better you'll get at cracking the code — and securing the systems that matter.

Now, go take these concepts and try them out. That's how you really master password cracking as a pentester. Happy hacking!

🚀 Become a VeryLazyTech Member — Get Instant Access

What you get today:

✅ 70GB Google Drive packed with cybersecurity content

✅ 3 full courses to level up fast

👉 Join the Membership → https://shop.verylazytech.com

📚 Need Specific Resources?

✅ Instantly download the best hacking guides, OSCP prep kits, cheat sheets, and scripts used by real security pros.

👉 Visit the Shop → https://shop.verylazytech.com

💬 Stay in the Loop

Want quick tips, free tools, and sneak peeks?

✖ https://x.com/verylazytech/

| 👾 https://github.com/verylazytech/

| 📺 https://youtube.com/@verylazytech/

| 📩 https://t.me/+mSGyb008VL40MmVk/

| 🕵️‍♂️ https://www.verylazytech.com/