‫So when performing a password cracking attack, it's either an online or offline attack and we'll look
‫at each method in detail, online password cracking attacks are necessary when you don't have access
‫to the password hashes.
‫When performing an online attack, you're usually presented with a web form asking for username and
‫password combination.
‫Performing an online attack can be very noisy, extremely slow, and sometimes it's not feasible.
‫And many login forms have a lockout feature that locks you out after a certain number of failed login
‫attempts.
‫For example, if I failed to log on to my online banking after multiple tries, my account will be locked
‫for 20 minutes.
‫Now, in addition, online password cracking attacks are very noisy, and when you're throwing random
‫wrong passwords to the system, it's log file will grow tremendously.
‫It looks very suspicious when there are hundreds of wrong password attempts logged in to the same IP
‫address.
‫So to get around these factors, you might try to cover up your IP address via a proxy, use a different
‫proxy for every five to ten guesses, or even attempt a few guesses every 30 minutes so it looks less
‫suspicious.
‫Many of the password cracking programs out there have these features available.
‫Now, offline password cracking attacks are only possible when you have access to the password hashes.
‫The attack is done on your own system or on systems that you have local access to.
‫Unlike an online attack, there are no locks or anything else to stop you on and offline attack because
‫you are doing it on your own machines.
‫The only thing that could hold you back is the limits of your computer hardware, because an offline
‫attack takes advantage of its machine's processing power and its speed is dependent on the speed of
‫the actual machine.
‫So the better the processor and nowadays even graphics cards, more password guessing attempts, you
‫can get per second.