Note
This repository is archived and read-only.
It has been superseded by ethical-hacking-docker-labs, where this lab is maintained as labs/week6. The maintained version pulls the prebuilt ghcr.io/michael-borck/ethical-base image rather than installing tools at container start, and worksheet.md now lives there as LAB-GUIDE.md.
Please use the lab series instead. This repository is preserved for reference only.
A comprehensive, beginner-friendly lab environment for teaching password security, ethical hacking principles, and professional penetration testing techniques.
This repository contains all materials needed to deliver a 90-minute hands-on workshop on password security. Students will learn how passwords are stored, common attack methods, and defensive strategies - all within a safe, legal Docker environment.
- Understand password hashing and storage mechanisms
- Identify different hash types and their vulnerabilities
- Use industry-standard tools (John the Ripper, Hashcat, Hydra)
- Apply ethical hacking principles and legal boundaries
- Create and evaluate strong password policies
- Document findings in professional reports
- Docker Desktop installed (Download here)
- 4GB RAM minimum
- 2GB free disk space
- Terminal/Command prompt access
# 1. Clone this repository
git clone https://github.com/your-username/password-security.git
cd week06-password-security
# 2. Run the setup script
chmod +x setup.sh
./setup.sh
# 3. Start the lab environment
docker-compose up -d
# 4. Enter the lab container
docker exec -it password-cracking-lab sh
# You're ready to start!week06-password-security/
├── README.md # This file
├── docker-compose.yml # Docker lab environment
├── setup.sh # Auto-setup script
├── slides/ # Lecture materials
│ ├── module1-foundations.pdf
│ ├── module2-offensive.pdf
│ └── module3-defense.pdf
├── worksheets/
│ ├── student-worksheet.pdf # Main lab exercises
│ └── student-worksheet.docx
├── facilitator/
│ ├── facilitator-guide.pdf # Teaching guide with answers
│ ├── answer-key.pdf # Quick reference answers
│ └── grading-rubric.xlsx # Assessment criteria
└── resources/ # Auto-generated by setup.sh
├── wordlists/ # Password dictionaries
├── hashes/ # Sample hashes to crack
└── scripts/ # Helper Python scripts
- Follow the Quick Start guide above
- Open
worksheets/student-worksheet.pdf - Complete exercises in order
- Ask for help if you get stuck!
- Module 1 (40 min): Password fundamentals and legal framework
- Module 2 (60 min): Offensive techniques and tools
- Module 3 (40 min): Defense strategies and reporting
- ✅ ONLY test passwords in this lab environment
- ✅ Work with a partner if you need help
- ❌ NEVER test passwords on real websites
- ❌ DO NOT share cracked passwords outside class
| Problem | Solution |
|---|---|
| "Cannot connect to Docker" | Make sure Docker Desktop is running |
| "Command not found" | Check for typos, commands are case-sensitive |
| "No hashes cracked" | Try the simpler wordlist first: /wordlists/basic.txt |
| Need help? | Ask your instructor or partner |
- Slides: Three modular presentations (can be combined or separate)
- Facilitator Guide: Complete teaching guide with answers, tips, and timing
- Answer Key: Quick reference for all exercises
- Grading Rubric: Clear assessment criteria
- Traditional: 90-minute guided workshop
- Flipped: Students review slides before, class for hands-on only
- Self-paced: Students work through modules independently
- Split: Two 45-minute sessions
- Technical completion (60%)
- Screenshot evidence (20%)
- Reflection questions (20%)
- Optional CTF bonus (+10%)
- Emphasize legal boundaries throughout
- Monitor for unauthorized testing
- Provide safe practice alternatives for homework
- Document any concerning behavior
- password-cracking-lab: Main workspace with all tools
- ssh-target: Practice target for network attacks
- web-target: Optional HTTP target
- John the Ripper: CPU-based password cracking
- Hashcat: GPU-accelerated cracking
- Hydra: Network service attacks
- Python 3: With zxcvbn for password strength testing
- Helper scripts for hash identification
- Sample MD5, SHA-1, SHA-256 hashes
- Basic wordlist (10 passwords)
- Extended wordlist (1000+ passwords)
- Python scripts for hash generation/identification
- All testing occurs in isolated Docker containers
- No external systems are accessed
- Students own the test environment
- Educational purpose under controlled conditions
- Testing on any website without permission
- Attempting on university/company systems
- Sharing cracked passwords maliciously
- Using skills for unauthorized access
This lab teaches skills used by:
- Penetration testers
- Security auditors
- Security researchers
- Incident responders
Always obtain written authorization before testing any system you don't own.
# Reset everything
docker-compose down -v
docker system prune -a
# Then start fresh- Verify hash format is correct
- Try simpler wordlist first
- Check for extra spaces/characters
- Some hashes are meant to be uncrackable (teaching point)
- Reduce Hashcat workload
- Use John instead of Hashcat
- Close other applications
- Try cloud-based alternatives (TryHackMe)
- SANS Teaching Resources
- NIST Password Guidelines
- Have I Been Pwned - breach examples
- Kerberos attacks
- Pass-the-Hash techniques
- Rainbow table generation
- GPU cluster cracking
Contributions welcome! Please:
- Fork the repository
- Create a feature branch
- Commit your changes
- Push to the branch
- Open a Pull Request
- Additional hash challenges
- More wordlists
- Alternative Docker configurations
- Translations
- Video tutorials
This educational material is provided under the MIT License. See LICENSE file for details.
Important: While the materials are free to use, the techniques taught must only be used legally and ethically.
- First: Check the troubleshooting section
- Then: Ask your instructor or classmates
- Finally: Open an issue on GitHub
- Email: instructor-support@university.edu
- Office hours: [Schedule]
- GitHub Issues: Technical problems only
Week 1-5: Networking & Reconnaissance
→ **Week 6: Password Security** ← You are here
Week 7: Vulnerability Scanning
Week 8: Exploitation Techniques
Week 9: Post-Exploitation
Week 10: Reporting & Remediation
- Basic command line knowledge
- Understanding of networking concepts
- Completed Week 1-5 materials
After completing this lab:
- Practice on TryHackMe
- Try the advanced challenges
- Research password managers
- Learn about multi-factor authentication
# Start lab
docker-compose up -d
docker exec -it password-cracking-lab sh
# Generate hash
echo -n "password" | md5sum
# Crack with John
john --wordlist=/wordlists/basic.txt hash.txt
# Crack with Hashcat
hashcat -a 0 -m 0 hash.txt /wordlists/basic.txt
# Attack with Hydra
hydra -l admin -P /wordlists/basic.txt ssh://target
# Stop lab
exit
docker-compose down- v1.0.0 (2024-01): Initial release
- v1.1.0 (2024-02): Added beginner-friendly worksheet
- v1.2.0 (2024-03): Enhanced with ethical hacking focus
- RockYou breach data for statistical examples
- OWASP for security guidelines
- Alpine Linux for lightweight containers
- The security community for tools and knowledge
Remember: With great power comes great responsibility. Use these skills to protect, not to harm.
Last updated: [Current Date]