3.3 Gaining Access: Password Attack Concepts

EC-Council Certified Ethical Hacker CEH

Track your progress as you read

Finished sections get a check mark.

1 Introduction & Exam Overview

1.1 CEH Exam Format, Cost & Eligibility 1.2 The Five Phases of Ethical Hacking 1.3 Information Security Fundamentals 1.4 Ethical Hacking Concepts, Scope & Legal Framework 1.5 The CEH Domains & Your Study Priority Map

2 Reconnaissance, Footprinting, Scanning & Enumeration

2.1 Footprinting & Reconnaissance Concepts 2.2 Footprinting Sources & Techniques 2.3 Network Scanning Concepts 2.4 Banner Grabbing, OS Fingerprinting & Scanning Beyond IDS/Firewall 2.5 Enumeration 2.6 Vulnerability Scanning & Countermeasures

3 Vulnerability Analysis & System Hacking Phases

3.1 Vulnerability Analysis Concepts 3.2 System Hacking Methodology Overview 3.3 Gaining Access: Password Attack Concepts 3.4 Privilege Escalation Concepts 3.5 Maintaining Access: Backdoors, Rootkits & Persistence 3.6 Covering Tracks, Anti-Forensics & Blue-Team Detection

4 Malware Threats, Sniffing & Social Engineering

4.1 Malware Concepts and Taxonomy 4.2 Malware Analysis and Detection 4.3 Sniffing Concepts and Layer 2 Attacks 4.4 Sniffing Countermeasures and Detection 4.5 Social Engineering Types and Human Psychology 4.6 Social Engineering and Insider Threat Defenses

5 Network & Perimeter Hacking

5.1 Denial of Service and DDoS Attacks 5.2 Session Hijacking 5.3 Evading IDS and IPS (Defensive Focus) 5.4 Evading Firewalls 5.5 Evading Honeypots and Defensive Deception 5.6 Network Security Controls and Architecture 5.7 Packet Analysis and Secure Protocols for Defenders

6 Web Server & Web Application Hacking

6.1 Web Server Attacks & Hardening 6.2 OWASP Top 10 Overview 6.3 Injection: SQL Injection & Command Injection 6.4 Cross-Site Scripting (XSS) & CSRF 6.5 Authentication, Session & Access-Control Flaws 6.6 API & Web App Security Testing Concepts

7 Wireless Network Hacking

7.1 Wireless Concepts and Standards 7.2 Wireless Encryption 7.3 Wireless Threats and Attack Concepts 7.4 Wireless Security Countermeasures

8 Mobile Platform, IoT & OT Hacking

8.1 Mobile Platform Threats & Security Models 8.2 Mobile Attack Vectors & Risks 8.3 Mobile Device Management & Enterprise Defense 8.4 IoT Hacking Concepts & Defense 8.5 OT, ICS & SCADA Security

9 Cloud Computing & Cryptography

9.1 Cloud Computing Concepts 9.2 Cloud Threats & Attack Surfaces 9.3 Cloud Security Controls 9.4 Cryptography Fundamentals 9.5 PKI & Cryptographic Applications 9.6 Cryptanalysis, Crypto Attacks & Best Practices

3.3 Gaining Access: Password Attack Concepts

Key Takeaways Explain This Topic AI

Password attacks split into online (against a live service, rate-limited and noisy) and offline (against captured hashes, fast and quiet)

Dictionary, brute force, and rule/hybrid attacks differ by candidate space; password spraying and credential stuffing target many accounts to evade lockout

Windows stores LM (DES-based, uppercased, split into two 7-char halves, unsalted, legacy) and NT/NTLM (MD4, case-sensitive, unsalted) hashes; pass-the-hash authenticates with the NTLM hash itself, no plaintext needed

John the Ripper and Hashcat crack hashes offline (Hashcat is GPU-accelerated with mask/dictionary/hybrid modes); Hydra brute-forces live services online (SSH, RDP, HTTP, FTP)

Defenses combine slow salted hashing, multi-factor authentication, lockout/throttling, breach-password screening, and disabling LM hash storage

Last updated: June 2026

Gaining Access Through Credentials

The fastest route into a system is often a valid password, so the CEH spends real time on password attack concepts . You must be able to define each attack, name the tool associated with it, and name its countermeasure — exactly how the exam asks it. This is taught defensively: understanding the attack is how you build the defense.

Online vs. Offline Attacks

This distinction is heavily tested and decides which tool an attacker reaches for:

Online attacks submit guesses to a live authentication service (a login form, SSH, RDP, FTP). They are rate-limited, slow, and noisy — lockout policies, throttling, and alerting all fire. Hydra (and Medusa, Ncrack) is the classic online tool: it takes username and password lists and tries combinations against a target protocol.

Offline attacks run against a stolen hash database on the attacker's own hardware. They are fast and silent because the target service is never touched. John the Ripper and Hashcat are the offline crackers CEH names, which is why protecting credential stores matters so much.

How Windows Stores Passwords: LM vs. NTLM

The CEH tests Windows hash types directly. Windows historically stored two hashes in the SAM database (and the NTDS.dit on domain controllers):

Property LM Hash NT / NTLM Hash
Algorithm DES-based MD4 of the password
Case Converts password to UPPERCASE Case-sensitive
Length handling Pads to 14, splits into two 7-char halves hashed separately Whole password hashed
Salt None None
Strength Very weak; trivially brute-forced/rainbow-tabled Stronger but still unsalted and fast

The LM weakness is severe: because the password is uppercased and split into two independent 7-character chunks , an 8-character password becomes one 7-char block plus a 1-char block, and the keyspace collapses — rainbow tables crack LM almost instantly. The defensive takeaway: disable LM hash storage (it is off by default on modern Windows) so only the NT hash exists.

Password Attack Types (Conceptual)

Dictionary attack — tries a curated word list of likely passwords. Fast but only finds passwords that are in the list.

Brute-force attack — tries every possible character combination in a keyspace. Guaranteed to eventually succeed but grows exponentially with length and character set, so long passphrases make it infeasible.

Rule-based / hybrid attack — starts from dictionary words and applies mutation rules (append digits, common substitutions, capitalization). It bridges dictionary speed and brute-force coverage and is effective against predictable human patterns.

Password spraying — tries a few very common passwords against many accounts. By keeping per-account attempts low, it slips under account-lockout thresholds.

Credential stuffing — replays username/password pairs leaked in other breaches against a target, exploiting password reuse. The credentials are already valid somewhere, so success rates are high.

Rainbow table attack — uses large precomputed tables that reverse unsalted hashes to plaintext via a time-memory trade-off. Per-user salting defeats rainbow tables because every account would need its own table.

Pass-the-Hash and Hash-Based Attacks

A pass-the-hash (PtH) attack is a CEH favorite: because Windows NTLM authentication can use the hash directly, an attacker who steals the NTLM hash can authenticate as that user without ever cracking the plaintext . No password recovery is needed — the hash is the credential. Related techniques include pass-the-ticket (Kerberos) and Kerberoasting (requesting service tickets to crack offline). Tools like Mimikatz extract these hashes/tickets from memory; the defense is credential isolation, restricting local-admin reuse, and protections such as Credential Guard.

Attack vs. Tool vs. Countermeasure

Attack Type Typical Tool Online/Offline Primary Countermeasure
Dictionary John the Ripper, Hashcat Either Ban weak/common passwords, length policy
Brute force / mask Hashcat (mask, -a 3) Either Long passphrases, slow hashing, lockout
Rule / hybrid Hashcat rules, JtR Either Block predictable patterns, MFA
Online service guessing Hydra, Medusa, Ncrack Online Lockout, rate limiting, MFA
Password spraying Manual / scripted Online Global lockout awareness, MFA, anomaly alerts
Credential stuffing Bots / replay tools Online MFA, breached-password screening, bot detection
Rainbow table RainbowCrack Offline Per-user salting, slow adaptive hashing
Pass-the-hash Mimikatz n/a (replays hash) Credential isolation, unique admin creds, Credential Guard

The Cracking Tools CEH Names

Know what distinguishes the three tools the exam keeps returning to:

John the Ripper (JtR) — an offline cracker famous for autodetecting hash formats and its cracking modes : single crack (uses account info as candidates), wordlist (dictionary with optional rules), and incremental (brute force). Primarily CPU-driven; great as an all-rounder.

Hashcat — the high-speed offline cracker, GPU-accelerated and supporting 300+ hash types (MD5, SHA-family, bcrypt, NTLM, and more). Its attack modes are referenced by number: straight/dictionary ( -a 0 ), combination ( -a 1 ), brute-force/ mask ( -a 3 ), and hybrid ( -a 6 / -a 7 ). Mask attacks let you target a known password pattern efficiently.

Hydra (THC-Hydra) — an online brute-forcer that attacks live network services — SSH, RDP, HTTP(S) forms, FTP, SMB, and many more — by trying username/password lists against the service. Because it touches the live service, it is slow and noisy and trips lockout and alerting.

The exam trap: do not confuse the offline crackers (John, Hashcat — operate on stolen hashes) with the online tool (Hydra — operates on a running service).

How Passwords Should Be Stored, and Layered Defenses

Good systems never store plaintext. They store a hash (one-way transform), strengthened by two ideas:

A salt is a unique random value added to each password before hashing, so identical passwords get different stored hashes and precomputed (rainbow) attacks become impractical.

A slow / adaptive hash (a purpose-built password hash with a tunable work factor) makes each guess expensive, so offline cracking crawls. Fast general-purpose hashes are poor password choices because attackers test billions of guesses cheaply.

No single control suffices. The CEH wants a defense-in-depth answer:

Unique per-user salts + a slow adaptive password hash neutralize precomputation and slow offline cracking.

Multi-factor authentication (MFA) makes a stolen password (or even a stolen hash) insufficient by itself — the strongest control against spraying and stuffing.

Account lockout, throttling, and rate limiting blunt online guessing (and Hydra).

Breached-password and weak-password screening stop reused and trivial passwords at selection.

Disable LM hashing and isolate credentials to blunt rainbow tables and pass-the-hash.

Monitoring and anomaly detection catch low-and-slow spraying that evades simple lockout.