The Toolkit
Password Attacks
Passwords are still how most things are protected, and password attacks split into two worlds. Offline cracking takes a stolen hash and throws enormous numbers of guesses at it on your own hardware, where speed is everything — that’s John the Ripper and hashcat. Online attacks guess credentials against a live service, where you’re limited by the network and by lockouts — that’s Hydra. Both are only as good as the guesses you feed them, which is why the category also ships the classic wordlists.
| Tool | Source | What it’s for |
|---|---|---|
| john | official | John the Ripper — flexible offline hash cracker with huge format support. |
| hydra | official | Fast online login brute-forcer across dozens of protocols. |
| hashcat | official | GPU-accelerated offline cracker — the fastest way to break hashes. |
| Wordlists | official | rockyou, SecLists, and the packaged wordlists collection. |
All live under Security → Password Attacks. John and hashcat are shown as a
single entry each rather than listing their scores of *2john/*2hashcat helper
converters — those are documented on their pages.