Active
--:--:-- UTCSyed Dayaan Shah
← Back to case filesCase · IAM-009
Identity / CryptographySeverity · high2-day lab

Password brute-force & hash cracking — why length beats complexity

Built a hands-on lab that models entropy, hash algorithms, and attacker hashrate so anyone can see why a 16-character passphrase behind bcrypt beats a scrambled 8-character password behind MD5 by a factor of trillions.

Evidence · hashcat session · MD5 rig at speedLIVE
dayaan@lab ~/hashcathashcat 6.2.6
$ hashcat -m 0 -a 0 hashes.md5 rockyou.txt -O
hashcat (v6.2.6) starting
OpenCL API (OpenCL 3.0) — RTX 4070

Session..........: hashcat
Status...........: Running
Hash.Mode........: 0 (MD5)
Speed.#1.........: 12.4 GH/s (86.71ms)
Progress.........: 14336000000/14344384000 (99.94%)

5f4dcc3b5aa765d61d8327deb882cf99:password
e10adc3949ba59abbe56e057f20f883e:123456
d8578edf8458ce06fbc5bb76a58c5ca4:qwerty
25f9e794323b453885f5181f1b624d0b:123456789
827ccb0eea8a706c4c34a16891f84e7b:12345

Recovered........: 4183/5000 (83.66%)
Started..........: Sat Jul 25 14:02:11 2026
Stopped..........: Sat Jul 25 14:02:57 2026

Algorithms modeled

4

Realtime entropy calc

Yes

MFA multiplier

10^6+

bcrypt vs MD5 gap

~10^11x

[01]Objective

Demonstrate how attackers actually crack passwords and quantify what makes them fail.

[02]Live Lab · Password brute-force lab
Interactive · runs in your browser
  1. 01 · Brief
  2. 02 · Your move
  3. 03 · Defenses
  4. 04 · How I stopped it
  5. 05 · How you prevent it
Stage 1 / 5 · Brief

Attackers steal password hashes, then crack them offline. Speed depends on two things: your password's entropy and the hash algorithm's cost.

You'll pick a password, watch entropy score in real time, then see how long a single RTX-4090 would need to crack it under MD5 vs bcrypt — with defenses on or off.

[03]Stack · Tools & Platforms

Tools

  • hashcat
  • John the Ripper
  • OWASP ASVS
  • rockyou.txt

Platforms

  • Kali Linux
  • Windows AD (lab)
[04]Method
  1. 01

    Modeled Shannon entropy per character class; layered dictionary + pattern penalties for realistic scoring.

    Fig · 01 · Model · time to crack by algorithmLIVE
    lab-report · time to crack an 8-char password
    AlgorithmLog-scale · attacker rig 12 GH/s
    MD5< 1 sec
    SHA-25618 min
    bcrypt (12)3.4 years
    Argon2id> 300 years

    Takeaway → move legacy MD5/SHA-1 stores to bcrypt or Argon2id.

  2. 02

    Calibrated attacker throughput against published RTX-4090 hashcat benchmarks (MD5, SHA-1, bcrypt cost 12, Argon2id).

  3. 03

    Simulated defense stacking: salt → adaptive hash cost → MFA to show combined effect on time-to-crack.

    Fig · 03 · Lab · lockout policy stops the burstLIVE
    Active Directory Users and Computers · Account Lockout Policy

    Default Domain Policy → Account Lockout

    Account lockout threshold5 invalid attempts
    Account lockout duration15 minutes
    Reset lockout counter after15 minutes
    Minimum password length14 characters
    Password must meet complexityEnabled

    Event Viewer · Security

    EventID 4625svc_backupBad password
    EventID 4625svc_backupBad password
    EventID 4625svc_backupBad password
    EventID 4625svc_backupBad password
    EventID 4625svc_backupBad password
    EventID 4740svc_backupAccount locked out

    → Attacker halted after 5 attempts.

[05]Outcome

Public-facing interactive lab, adopted internally as a security-awareness demo for onboarding.

[06]Lessons learned
  • Adaptive hashing (bcrypt/Argon2) is what breaks GPU rigs — plain SHA is a speedbump.
  • The single biggest win for a user is length. 16-char passphrase > any 8-char scramble.

Next case · SOC-014

SIEM alert triage — separating signal from noise under pressure

Open →