**Slide 1: Password Attacks**
- People are not good at remembering passwords, choosing easy ones (e.g., 123456), and reusing them.
- Password entropy increases with length and character variation. Longer passwords and those with mixed characters (upper/lowercase, numbers, special symbols) have more entropy.
- Using password managers and multi-factor authentication is recommended.

**Slide 2: Real-World Password Attacks**
- Most common attacks target weak or default user/system passwords.
- Brute force and dictionary attacks are common. Tools like `medusa` and `ncrack` automate these attacks.
- Online password attacks target networked services like HTTP, SSH, FTP, SNMP, RDP.
- Offline password attacks use captured password files and tools like `john the ripper`.
- Key space brute force generates all possible combinations of characters for a given set and length.
- Social engineering and shoulder-surfing can also be used.

**Slide 3: Online Password Attacks Example**
- Example of an HTTP brute force attack using `medusa` against a protected web directory.
- Command: `medusa -h <target> -u <username> -P /usr/share/wordlists/rockyou.txt -M http -m DIR:/npttest -T 10 -s`
- Lessons: Be suspicious of the first password in a list, and don't put the correct one at the beginning when setting up demos.

**Slide 4: Key Space Brute-Force**
- `crunch` tool generates custom wordlists with defined character sets and password formats.
  - Example: `crunch 6 6 0123456789ABCDEF -o test.txt` generates a list of 6-character hexadecimal passwords.
- Password length quickly becomes unmanageable with more characters.

**Slide 5: John the Ripper Offline Cracking Tool**
- `john` supports automatic mode, dictionary mode (using wordlists), and mangling rules.
- Example commands:
  - Automatic mode: `john <password-file>`
  - Dictionary mode: `john --wordlist=/usr/share/wordlists/rockyou.txt <password-file>`
  - Mangling rules: `john --rules --wordlist=/usr/share/wordlists/rockyou.txt <password-file>`

**Slide 6: In-memory Attacks**
- Abusing OS handling of passwords, particularly useful for Windows due to shared identities.
- `pwdump` tool dumps SAM hashes by injecting a DLL into the LSASS process.

**Slide 7: Passing the Hash in Windows**
- Pass-The-Hash (PTH) allows authentication using hashes rather than passwords.
- `exploit/windows/smb/psexec` exploit with a reverse TCP meterpreter payload can be used for PTH.

**Slide 8: Task 3 – Password Attack**
- Demonstrate various password attacks using different tools.
- Target at least two protocols (e.g., HTTP, FTP, SSH, RDP).
- Crack provided offline password hashes using wordlists and `crunch`.
- Crack a password-protected Word file, `TradeSecret.docx`, using office2john or zip2john.
- Perform an in-memory attack using PTH to authenticate into the Windows XP system.