Online vs Offline Attacks
Know when to guess against a live service and when to steal the hash and run.
What you will learn
- -Distinguish online guessing from offline cracking
- -Use password spraying to dodge account lockouts
- -Name the defenses that stop each attack class
There are two worlds of attacks, and confusing them gets you caught or locked out. Online attacks guess against a live service. Offline attacks guess against a stolen hash on your own hardware. The rules, speed, and are completely different.
Online: guessing at the front door
An online attack sends candidates to a real login (, RDP, a web form) and reads the response. It is slow because it is limited by the and the , and it is loud: every failed attempt is a entry.
Worse, most services enforce lockout: too many failures and the account freezes. This is why blasting one account with a huge wordlist is a beginner mistake. You lock the account, the defender, and crack nothing.
Spraying beats brute force online
Password spraying flips the strategy. Instead of many passwords against one account, you try one common password against many accounts, then wait before the next round. You stay under the lockout threshold on every individual account.
$hydra -l admin -P rockyou.txt ssh://10.10.14.7$hydra -L users.txt -p 'Spring2024!' ssh://10.10.14.7The difference is -P (a password list against one user) versus -p (one
password against a user list). That single flag is the line between reckless and
careful.
Offline: the fast, silent world
If you can steal the hashes (a shadow file, a dump, a database leak), the game changes entirely. Now you crack on your own GPU with hashcat. There is no network limit, no lockout, and no login log to trip. This is why grabbing hashes is such a priority: it moves the fight to ground where you always win eventually.
Online attacks are slow, loud, and lockout-limited, but they need no prior access. Offline attacks are fast, silent, and unlimited, but you must first steal the hashes. Most engagements go online only long enough to grab something you can crack offline.
Defenses that actually work
Know these so you can both attack and advise:
- Lockout policies blunt online guessing but do nothing offline.
- Rate limiting and stop spraying cold.
- Slow hashes (bcrypt, argon2) with per-user make offline cracking expensive enough to abandon.
- Long passphrases beat every attack: length crushes both guessing and cracking budgets.
Read the target before you attack. A hardened login with MFA and lockout means online guessing is a dead end, so pivot to capturing a hash. A weak-hashed dump means the login barely matters. Match the attack to the terrain.
Why does password spraying avoid triggering account lockouts?
Which attack class, online or offline, is unaffected by account lockout policies?
Offline cracking happens on your own hardware against a stolen hash. The target service is never contacted, so its lockout is irrelevant.