Password Cracking Educational Laboratory
EDUCATIONAL PURPOSE ONLY: This tool is designed for cybersecurity education and demonstration purposes. It shows how passwords can be vulnerable to various attack methods. All simulations are limited to 4-character passwords for educational efficiency.
ETHICAL USE DISCLAIMER: This tool should only be used for educational purposes, authorized penetration testing, and security research. Unauthorized password cracking is illegal and unethical.

Learning Objectives:

  • Understand how Linux and Windows store password hashes
  • Learn about different password cracking attack methods
  • Recognize the importance of strong password policies
  • Explore defense mechanisms against password attacks

How Password Cracking Works:

Password cracking involves recovering plaintext passwords from their hashed counterparts. Operating systems don't store passwords in plain text but instead store cryptographic hashes. Attackers try to reverse this process through various methods.

Linux Password Cracking Simulation
Linux systems store password hashes in /etc/shadow using algorithms like MD5, SHA-256, SHA-512, or yescrypt. The format is typically $algorithm$salt$hash.

Linux Hash Generator & Cracker

Linux Password Storage:

Linux stores password hashes in /etc/shadow with salt to prevent rainbow table attacks. The hash format includes the algorithm identifier, salt, and the actual hash value.

Windows Password Cracking Simulation
Windows systems store password hashes in the SAM database using NTLM (NT) hashing. These hashes are typically extracted using tools like Mimikatz or pwdump.

Windows NTLM Hash Generator & Cracker

Windows Password Storage:

Windows stores NTLM hashes in the SAM database. Unlike Linux, Windows NTLM hashes are not salted, making them more vulnerable to rainbow table attacks.

Password Cracking Attack Methods

Dictionary Attack

Uses a predefined list of common passwords and words. Fast but limited to known passwords.


Effectiveness: High for weak passwords
Speed: Very Fast
Resource Usage: Low

Brute Force Attack

Tries every possible combination of characters systematically. Guaranteed to work but can be extremely slow.


Effectiveness: 100% (given time)
Speed: Very Slow
Resource Usage: High

Hybrid Attack

Combines dictionary words with common variations (numbers, symbols). Balances speed and coverage.


Effectiveness: High
Speed: Moderate
Resource Usage: Moderate

Rainbow Table Attack

Uses precomputed hash tables to instantly look up password hashes. Fast but requires storage space.


Effectiveness: High for unsalted hashes
Speed: Very Fast
Resource Usage: High Storage
Performance Note: This simulation demonstrates these methods on 4-character passwords. Real-world attacks on longer passwords can take exponentially longer times.
Defense Strategies

Password Policy Recommendations:

  • Length: Minimum 12-14 characters
  • Complexity: Mix of uppercase, lowercase, numbers, and symbols
  • Uniqueness: Different passwords for different systems
  • Expiration: Regular password changes for sensitive accounts

Strong Hashing Algorithms

Use modern algorithms like bcrypt, scrypt, or Argon2 that are designed to be slow and memory-intensive.

Salt Implementation

Always use unique salts for each password to prevent rainbow table attacks.

Multi-Factor Authentication

Implement 2FA/MFA to add additional security layers beyond passwords.

Account Lockout Policies

Implement lockout mechanisms after failed login attempts to prevent brute force attacks.

Key Takeaway: The best defense against password cracking is a combination of strong passwords, proper hashing algorithms, and additional security measures like multi-factor authentication.