‫So when performing a password cracking attack, it's either an online or offline attack.
‫And we'll look at each method in detail.
‫Online password cracking attacks are necessary when you don't have access to the password hashes.
‫When performing an online attack you you're usually presented with a web form asking for username and
‫password combination, performing an online attack and be very noisy, extremely slow and sometimes
‫just not feasible.
‫And many login forms have a lockout feature that locks you out after a certain number of failed login
‫attempts.
‫For example, if I failed to log on to my online banking after multiple tries, my account will be locked
‫for 20 minutes.
‫Now, in addition, online password cracking attacks are very noisy, and when you're throwing random
‫wrong passwords in a system, it's log file will grow tremendously.
‫It looks very suspicious when there are hundreds of wrong password attempts logged into the same IP
‫address.
‫So to get around these factors, you might try to cover up your IP address via a proxy, use a different
‫proxy for every five to 10 guesses or even attempt a few guesses every 30 minutes.
‫So it looks less suspicious.
‫Many of the password cracking programs out there have these features available.
‫Now offline.
‫Password cracking attacks are only possible when you have access to the password hashes.
‫The attack is done on your own system or on systems that you have local access to.
‫Unlike an online attack, there are no locks or anything else to stop you on and offline attack because
‫you are doing it on your own machines.
‫The only thing that could hold you back is the limits of your computer hardware, because an off line
‫attack takes advantage of its machine's processing power and its speed is dependent on the speed of
‫the actual machine.
‫So the better the processor and nowadays even graphics cards, more password guessing attempts, you
‫can get per second.