Password Security Academy

Master Password
Auditing
Through Practice

Learn Hashcat, John the Ripper, Hydra, and CeWL through interactive terminal simulations, visual workflows, and beginner-friendly methodology — all in one platform.

Start Learning Open Terminal View Workflows
kali@edwhere — bash
# Welcome to Edwhere — Password Auditing Academy ┌──(kali@edwhere)-[~] └─$ cewl -d 2 -m 5 -w wordlist.txt http://target.com CeWL 5.5.2 (Grouping) Robin Wood... Fetching: http://target.com Found 124 unique words. Saved to wordlist.txt └─$ hashcat -m 0 hashes.txt wordlist.txt hashcat (v6.2.6) starting... * Device #1: NVIDIA GeForce RTX — [OK] Status......: Running Speed.#1.....: 14238.5 MH/s 5e884898da28047151d0e56f8dc62927 → password Session complete. └─$
4
Core Tools
40+
Commands Covered
7
Learning Stages
3
Combined Workflows
⚠
Ethical Use Notice: All tools and techniques demonstrated on this platform are strictly for educational purposes, authorized security assessments, and learning in controlled lab environments. Never use these tools against systems, networks, or accounts you do not own or have explicit written permission to test. Unauthorized access is illegal and unethical.
Tools Overview

Four Tools,
One Methodology

Each tool covers a critical phase of the password security assessment workflow — from wordlist generation to hash cracking and online authentication testing.

HC
Hashcat
GPU-accelerated hash cracking with support for 300+ hash modes, wordlist, mask, and rule-based attacks.
Offline Cracking
JtR
John the Ripper
Versatile password auditing tool supporting wordlist, incremental, and single crack modes across many hash types.
Password Auditing
HY
Hydra
Fast online authentication tester supporting SSH, FTP, HTTP, SMB, and dozens of other network protocols.
Online Testing
CW
CeWL
Custom wordlist generator that crawls websites to extract real words for targeted password auditing campaigns.
Wordlist Generation
Stage 4 · Offline Cracking

Hashcat

The world's fastest password recovery tool. Hashcat leverages GPU acceleration to crack password hashes using multiple attack strategies.

⚡ Offline cracking only — no network required
What is Hashcat? +
Hashcat is an advanced CPU/GPU password cracking tool. It works by taking stored password hashes and running candidate passwords through the same hashing algorithm until a match is found. It never sends data over a network — all cracking happens locally on your machine.
Why is it used? +
Security professionals use Hashcat to test the strength of stored passwords during authorized audits. It reveals whether users are choosing weak, guessable passwords — helping organizations enforce better password policies before attackers exploit the weakness.
How does it work internally? +
Hashcat takes candidate words from a wordlist, applies the selected hash algorithm (e.g. MD5, SHA-256, NTLM), and compares the resulting hash to the target hash. GPUs excel at this because they can compute billions of hash comparisons per second in parallel.
Common Mistakes +
1) Using wrong hash mode (-m) for your hash type. 2) Forgetting to identify the hash type before cracking. 3) Using a small wordlist when a large one would work better. 4) Not using rules to expand wordlist coverage. Always run hashcat --identify or use hash-identifier first.
Best Practices +
Always identify hash type before cracking. Start with common wordlists (rockyou.txt), then add rule sets. Use GPU acceleration for speed. Document all findings. Only run against hashes you are authorized to test. Keep audit logs for reporting.
Common Hash Modes
-m Mode Hash Type Example Hash
0MD55f4dcc3b5aa765d61d8327...
100SHA-15baa61e4c9b93f3f0682250b...
1000NTLM8846f7eaee8fb117ad06bdd83...
1800SHA-512 (Unix)$6$rounds=5000$abc$...
3200bcrypt$2y$10$abc123...
1400SHA-2565e884898da280471...
hashcat — examples
# Wordlist attack — MD5 hashes └─$ hashcat -m 0 -a 0 hashes.txt rockyou.txt hashcat (v6.2.6) starting... Speed.#1.....: 14238.5 MH/s 482c811da5d5b4bc6d497ffa98491e38:password123 # NTLM — Windows hash cracking └─$ hashcat -m 1000 ntlm.txt wordlist.txt # Mask attack — ?a=all chars, 6 length └─$ hashcat -m 0 -a 3 hashes.txt ?a?a?a?a?a?a # View help └─$ hashcat --help
Interactive Commands — Click to Expand
$ hashcat -m 0 hashes.txt rockyou.txt
Purpose
MD5 wordlist attack. -m 0 sets MD5 mode. Reads candidate words from rockyou.txt, hashes each one, and compares to hashes.txt.
$ hashcat -m 1000 hashes.txt wordlist.txt
Purpose
NTLM hash cracking. NTLM is the Windows authentication hash format. Used during authorized Windows system audits.
$ hashcat -m 0 -a 3 hashes.txt ?a?a?a?a?a
Purpose
Mask attack. ?a = all characters (upper, lower, digits, special). Generates all 5-character combinations. Slow but thorough.
$ hashcat --show hashes.txt
Purpose
Display previously cracked passwords from the hashcat potfile. Run this after a cracking session to review results.
Hashcat Workflow
Obtain Hash
→
Identify Hash Type
→
Select Mode (-m)
→
Choose Attack (-a)
→
Run Hashcat
→
--show Results
Stage 3 · Password Auditing

John the Ripper

A classic, flexible password auditing tool. John auto-detects hash types, supports multiple attack modes, and excels at auditing Unix and application password files.

🔍 Auto-detects hash type — great for beginners
What is John the Ripper? +
John the Ripper (JtR) is a free, open-source password security auditing tool available for Unix, Windows, and macOS. Unlike Hashcat's GPU focus, John is more CPU-centric and famously auto-detects the hash type — making it easier for beginners to get started quickly.
Attack Modes Explained +
Single Crack: Uses the username and GECOS fields to generate password guesses. Wordlist: Tries words from a file. Incremental: Brute-forces all character combinations (slowest but most thorough). Start with wordlist, then escalate if needed.
Password Audit Workflow +
1) Obtain password hash file (e.g. /etc/shadow on authorized Linux system). 2) Run john with --wordlist for common passwords. 3) Use --show to review cracked passwords. 4) Escalate to incremental if needed. 5) Report findings with password policy recommendations.
Common Mistakes +
Running john without specifying a wordlist defaults to incremental mode, which is very slow. Always start with a wordlist attack. Running john twice on the same file requires --restore to resume. Use john --show after each session to see results.
John Cracking Workflow
01 john hashes.txt Auto-detect & single crack
02 john --wordlist=rockyou.txt hashes.txt Wordlist attack
03 john --show hashes.txt View results
04 john --incremental hashes.txt Brute-force (last resort)
john — examples
# Default run — John auto-detects hash type └─$ john hashes.txt Loaded 3 password hashes with no different salts Using default input encoding: UTF-8 Press 'q' or Ctrl-C to abort... admin (admin) # Wordlist attack └─$ john --wordlist=rockyou.txt hashes.txt Using wordlist: rockyou.txt password123 (user1) letmein (user2) # Show all cracked passwords └─$ john --show hashes.txt admin:admin:1000:... user1:password123:1001:... 2 password hashes cracked, 1 left # Incremental mode (brute force) └─$ john --incremental hashes.txt
Commands Reference
$ john hashes.txt
Auto-detects hash format, runs single crack mode first. Best starting point — John figures out the hash type for you automatically.
$ john --wordlist=rockyou.txt hashes.txt
Runs a wordlist attack using rockyou.txt (14M+ common passwords). Most effective against weak passwords. Run this before incremental.
$ john --show hashes.txt
Displays all passwords cracked in previous sessions. John stores results in a .pot file — this command reads from it and shows username:password pairs.
$ john --incremental hashes.txt
Brute-force mode — tries every possible character combination. Very slow. Use only when wordlist attacks fail and you have time/compute budget.
Stage 5 · Online Authentication Testing

Hydra

Hydra tests live authentication services over a network. Unlike offline crackers, Hydra sends real login attempts to running services — making authorization critical.

🌐 Online testing — only use on authorized systems
What is Hydra? +
Hydra (THC-Hydra) is a parallelized network login cracker. It supports over 50 protocols including SSH, FTP, HTTP, HTTPS, SMB, RDP, and more. It tests real login endpoints by sending authentication requests over the network — making it an online testing tool only.
Online vs Offline Testing +
Offline (Hashcat/John): Works on hash files without network access. Much faster. Online (Hydra): Makes real login attempts to live services. Limited by network speed and lockout policies. Always check for account lockout policies before testing — multiple failed logins can lock accounts.
Flags Explained +
-l: Single username. -L: Username list file. -p: Single password. -P: Password list file. -t: Number of parallel tasks (default 16). -V: Verbose output (shows each attempt). -f: Stop after first found credential.
Best Practices +
Always verify IP ownership before testing. Use -t to limit threads (avoid flooding). Use -f to stop at first success. Start with a small wordlist. Check lockout policies. Log all tests. Never run against production systems during business hours without change management approval.
Supported Protocols
SSH
FTP
HTTP
HTTPS
SMB
RDP
Telnet
MySQL
SMTP
Authentication Flow
Get Target IP
→
Identify Service
→
Prepare Wordlist
→
Run Hydra
→
Credentials Found
hydra — examples
# SSH brute force — single username └─$ hydra -l admin -P passwords.txt ssh://192.168.1.10 Hydra v9.4 (c) 2022 by van Hauser/THC [DATA] max 16 tasks per 1 server [DATA] attacking ssh://192.168.1.10:22/ [22][ssh] host: 192.168.1.10 login: admin password: admin123 1 of 1 target successfully completed # FTP with user list + password list └─$ hydra -L users.txt -P passwords.txt ftp://192.168.1.20 [DATA] attacking ftp://192.168.1.20:21/ # Verify target is reachable first └─$ ping -c 3 192.168.1.10 PING 192.168.1.10: 56 bytes of data 3 packets transmitted, 3 received # View help └─$ hydra -h
$ hydra -l admin -P pass.txt ssh://IP
SSH login test. -l specifies a single username (admin). -P specifies a password file. Replace IP with your authorized target's IP address.
$ hydra -L users.txt -P pass.txt ftp://IP
FTP login test with multiple usernames and passwords. -L reads usernames from a file. Tests all username/password combinations against the FTP service.
$ ping -c 3 192.168.1.10
Always verify your target is reachable before running Hydra. -c 3 sends 3 packets. If you receive replies, the host is up and reachable.
Stage 6 · Custom Wordlist Generation

CeWL

CeWL crawls websites and extracts real words to build targeted password wordlists. People often use words from their company, projects, or interests as passwords.

🕷 Web crawler — only crawl authorized websites
What is CeWL? +
CeWL (Custom Word List generator) is a Ruby application that spiders a given URL and returns a list of words found on the site. The generated wordlist is ideal for targeted password auditing — people tend to use words related to their environment, company name, or products as passwords.
Why targeted wordlists? +
Generic wordlists like rockyou.txt contain common passwords. But targeted wordlists contain organization-specific words (product names, department names, project codes) that employees are statistically more likely to use. CeWL bridges the gap between generic and targeted auditing.
Key Flags Explained +
-d: Crawl depth (how many links deep to follow, default 2). -m: Minimum word length (default 3, use 5+ for passwords). -w: Write output to file. --email: Also extract email addresses found on the site. --lowercase: Lowercase all words.
Crawling Workflow +
1) CeWL starts at the given URL. 2) Follows links up to the specified depth (-d). 3) Extracts all words meeting minimum length (-m). 4) Deduplicates and sorts the list. 5) Saves to file (-w). The output is ready to feed directly into Hashcat or Hydra.
Crawling Visualization
TARGET URL http://example.com
↓
CRAWL DEPTH -d 2 Follows links 2 levels deep
↓
FILTER -m 5 Only words 5+ characters
↓
OUTPUT wordlist.txt Ready for Hashcat / Hydra
cewl — examples
# Basic crawl — extract words from site └─$ cewl http://example.com CeWL 5.5.2 (Grouping) Robin Wood Example domain documents # Depth 2, min 5 chars, save to file └─$ cewl -d 2 -m 5 -w wordlist.txt http://example.com CeWL 5.5.2 — Crawling... Saved 124 words to wordlist.txt # View the generated wordlist └─$ cat wordlist.txt | sort | uniq | wc -l 124
Simulated Wordlist Output
security password example domain illustration document information standard network administrator enterprise website server database system management service login access account
↑ Highlighted words = likely password candidates
$ cewl -d 2 -m 5 -w list.txt URL
Full targeted wordlist generation. Crawls 2 levels deep, keeps words 5+ characters, saves to wordlist.txt. Replace URL with your authorized target.
$ sort wordlist.txt | uniq | wc -l
Sort, deduplicate, and count words in your generated wordlist. This pipeline is essential for cleaning up CeWL output before feeding it to cracking tools.
Combined Workflows

Tools Working Together

Real-world password auditing chains multiple tools. Here's how each workflow connects in a complete security assessment methodology.

WORKFLOW 01
CeWL → Hashcat
1
CeWL
Crawl target website
2
Linux
sort | uniq → clean wordlist
3
Hashcat
-m 0 hashes.txt wordlist.txt
4
Result
hashcat --show hashes.txt

Uses organization-specific words to crack hashed passwords. Most effective when you know the target's industry, product names, or company culture. CeWL feeds Hashcat a custom vocabulary instead of a generic list.

WORKFLOW 02
CeWL → Hydra
1
CeWL
Generate targeted wordlist
2
Linux
ping to verify target reachability
3
Hydra
-l user -P wordlist.txt ssh://IP
4
Result
Valid credentials found

Pairs custom wordlist generation with live authentication testing. CeWL creates a targeted dictionary, which Hydra then uses to test against real running services like SSH or FTP on authorized systems.

WORKFLOW 03
John → Hashcat
1
John
Auto-detect hash, quick wordlist
2
John
john --show → identify uncompleted
3
Hashcat
GPU-accelerated mask/rule attack
4
Result
Comprehensive audit coverage

Uses John for quick initial auditing with auto-detection, then escalates to Hashcat's GPU power for remaining hashes. John's ease of use complements Hashcat's raw speed — covering more ground in less time.

Supporting Commands

Linux Commands
You Must Know

These core Linux utilities are essential companions for every password auditing workflow — from inspecting files to cleaning wordlists and checking network connectivity.

cat
File Viewing
Display the contents of a file to the terminal. Used to inspect hash files, wordlists, and output files.
$ cat hashes.txt
5e884898da28047151d0e56f8dc62927
482c811da5d5b4bc6d497ffa98491e38
grep
Pattern Search
Search for patterns within files. Used to filter cracked passwords, find specific hashes, or search wordlists.
$ grep "admin" wordlist.txt
admin
administrator
admin123
sort
Sorting
Sort lines alphabetically or numerically. Essential for organizing wordlists before deduplication.
$ sort wordlist.txt -o sorted.txt
access
admin
administrator
database
uniq
Deduplication
Remove duplicate lines from sorted input. Always pipe sort before uniq. Cleans wordlists by removing repeated entries.
$ sort wordlist.txt | uniq
access
admin
database
# Duplicates removed
wc
Word / Line Count
Count lines, words, or characters. Use wc -l to count how many passwords are in your wordlist.
$ wc -l wordlist.txt
14344392 rockyou.txt
124 wordlist.txt
head
File Preview
Display the first N lines of a file. Useful to preview the beginning of large hash files or wordlists.
$ head -10 rockyou.txt
123456
password
12345678
qwerty
abc123
tail
End of File
Display the last N lines. Used to check recent additions to log files or the end of cracking output files.
$ tail -5 output.txt
...cracking results...
Session complete.
Recovered: 5/8
ping
Network Check
Test network reachability. Always ping your target before running Hydra to confirm the host is up.
$ ping -c 3 192.168.1.10
3 packets transmitted
3 received, 0% packet loss
rtt min/avg = 1.2/1.4 ms
ip a
Network Interfaces
Display your machine's network interfaces and IP addresses. Know your own IP before testing network services.
$ ip a
eth0: inet 192.168.1.5/24
lo: inet 127.0.0.1/8
less
File Pager
View large files one page at a time. Unlike cat, less lets you scroll back. Use for reading large wordlists or hash files.
$ less rockyou.txt
Use arrows to scroll
Press q to quit
Press / to search
ss
Socket Statistics
Show active network connections and listening ports. Use ss -tlnp to see which services are running before testing.
$ ss -tlnp
State Port Process
LISTEN 22 sshd
LISTEN 21 vsftpd
netstat
Network Status
Display active connections and listening services. Use netstat -tlnp as an alternative to ss for checking open ports.
$ netstat -tlnp
Proto Local Address State
tcp 0.0.0.0:22 LISTEN
tcp 0.0.0.0:80 LISTEN
Learning Path

Your 7-Stage
Learning Roadmap

Follow this structured path from Linux basics to complete password auditing methodology. Each stage builds on the previous one.

1
Stage 01
Linux Fundamentals
Master the essential Linux commands that form the foundation of all cybersecurity workflows. You'll use these in every single audit.
cat grep sort uniq wc ping ip a ss
2
Stage 02
Password & Hash Concepts
Understand how passwords are stored, what hashing means, and why authentication works the way it does. Theory first, tools second.
Hash Functions MD5 / SHA / NTLM Salting Wordlists Auth Basics
3
Stage 03
John the Ripper
Your first password auditing tool. John's auto-detection makes it beginner-friendly. Learn wordlist and incremental modes here.
john hashes.txt --wordlist --show --incremental Hash detection
4
Stage 04
Hashcat
Unlock GPU-accelerated cracking. Hashcat handles complex attacks and multiple hash types at extraordinary speeds. Step up from John here.
-m hash modes -a attack modes Wordlist Mask ?a?d?l?u GPU accel
5
Stage 05
Hydra
Move from offline to online testing. Hydra tests real running services — understand the critical difference and authorization requirements.
SSH testing FTP testing -l / -L flags -P wordlist Protocol syntax
6
Stage 06
CeWL
Learn targeted intelligence gathering. CeWL turns a website's own vocabulary into a powerful custom password dictionary.
-d depth -m min length -w output file Web crawling Wordlist cleanup
7
Stage 07
Combined Workflows
Chain all tools together into complete password security assessment methodology. This is where everything comes together into professional practice.
CeWL → Hashcat CeWL → Hydra John → Hashcat Full audit flow Reporting
Practice

Interactive Terminal

Type commands or click suggestions to see simulated educational outputs. Practice the syntax before working in a real lab environment.

Hashcat
John
Hydra
CeWL
Linux
# Hashcat Practice Terminal — Type a command below └─$
hashcat --help hashcat -m 0 wordlist attack hashcat -m 1000 NTLM hashcat mask attack hashcat --show
┌─(kali@edwhere)
└─$ 
# John the Ripper Practice Terminal └─$
john hashes.txt john --wordlist john --show john --incremental
┌─(kali@edwhere)
└─$ 
# Hydra Practice Terminal └─$
hydra -h hydra SSH hydra FTP ping target
┌─(kali@edwhere)
└─$ 
# CeWL Practice Terminal └─$
cewl basic cewl full options sort | uniq | wc -l cat wordlist.txt
┌─(kali@edwhere)
└─$ 
# Linux Commands Practice Terminal └─$
cat hashes.txt grep admin wc -l sort | uniq head -10 ip a ss -tlnp
┌─(kali@edwhere)
└─$