Password Cracking & Defense — Cyber Hacker Academy
Password Cracking & Defense
Enroll to track your progress and unlock lab environments.
Preview Lesson 1 FreeSkills you will walk away with
No prior experience needed. Each lesson builds on the last — by the end you will have real, hands-on skills that employers and CTF challenges actually test for.
How Passwords Are Stored
Plaintext vs encoded vs hashed vs salted password storage
Hash Functions Explained
Properties of cryptographic hash functions: deterministic, one-way, avalanche effect
Dictionary Attacks with Hashcat
Hashcat architecture: CPU vs GPU cracking performance
Brute Force Techniques
Brute force vs dictionary vs hybrid attacks
Rainbow Table Attacks
Time-memory trade-off: the principle behind rainbow tables
Secure Password Policies
NIST SP 800-63B password guidelines: length over complexity
Your learning path
How Passwords Are Stored
Start hereUnderstanding how applications store passwords is the foundation of both attacking and defending authentication systems. You will learn why plaintext storage is catastrophic, how hashing works as a one-way function, and why the same password can produce different hashes depending on how it is stored. This lesson explains the technical reality behind every password breach you have ever read about.
Hash Functions Explained
Hash functions are the mathematical backbone of password security, digital signatures, and data integrity verification. You will learn how MD5, SHA-1, SHA-256, bcrypt, and Argon2 work, why some are considered broken for password storage, and what properties make a hash function suitable for security applications. Understanding the difference between a fast hash and a slow hash is critical for both attackers and defenders.
Dictionary Attacks with Hashcat
Hashcat is the world's fastest password cracker, capable of testing billions of hash candidates per second using GPU acceleration. You will learn how to identify hash types, configure Hashcat for different attack modes, and use wordlists like rockyou.txt to crack real password hashes. Dictionary attacks succeed because most users choose passwords that appear in common wordlists.
Brute Force Techniques
Brute force attacks systematically try every possible combination of characters until the correct password is found. You will learn when brute force is practical versus impractical, how to use mask attacks in Hashcat to target specific password patterns, and how online brute force tools like Hydra work against login forms. Understanding brute force helps you design password policies that make it computationally infeasible.
Rainbow Table Attacks
Rainbow tables are precomputed lookup tables that trade storage space for cracking speed, allowing attackers to instantly reverse unsalted hashes. You will learn how rainbow tables work, why they were once the dominant password cracking technique, and how password salting completely defeats them. Understanding rainbow tables explains why salting is a non-negotiable requirement in modern password storage.
Secure Password Policies
Effective password policies balance security with usability — overly restrictive policies often backfire by causing users to write passwords down or use predictable patterns. You will learn evidence-based password policy recommendations from NIST SP 800-63B, how to implement multi-factor authentication, and how password managers solve the human memory problem. This lesson bridges the gap between attacking passwords and defending against those attacks.
Completely beginner-friendly
Every concept is explained from scratch. You will get a real terminal environment, step-by-step labs, audio walkthroughs, and quizzes after each lesson to lock in what you learned — no prior hacking or coding experience required.