Explore the full password attack arsenal, from phishing to offline cracking, and prove yourself in a live challenge.

This module steps into the attacker’s playbook for stealing and cracking credentials, opening with phishing, the social engineering classic that still catches cautious users off guard. From there, you’ll run online attacks with Hydra, build custom wordlists tailored to a target, and use them to crack captured password hashes offline. A live password challenge closes the module, putting every technique into a realistic credential attack chain.

Phishing Basics

Explore phishing techniques and tools for penetration testing.

Hydra

Learn about and use Hydra, a fast network logon cracker, to bruteforce and obtain a website's credentials.

Introduction to Wordlists

Learn to build targeted wordlists using OSINT and apply them in penetration testing.

Password Cracking

Learn how passwords are hashed, identify hash types, and crack them with Hashcat and John the Ripper.

Checkmate

Exploit weak password practices across Marco’s internal systems to achieve full compromise.

Lock in what you learned with a recap. Earn points and keep your streak.

Next steps

Metasploit and Exploitation

Master Metasploit and the manual exploitation skills behind it, from scanning and post-exploitation to building your own shells and payloads.

What are modules?

A learning pathway is made up of modules, and a module is made of bite-sized rooms (think of a room like a mini security lab).

Hierarchical diagram showing how learning pathways contain modules, which contain individual rooms.

Password Attacks

Phishing Basics

Hydra

Introduction to Wordlists

Password Cracking

Checkmate

Topic Rewind Recap