I was testing on my own router that how secure is my password. First I set a random 9 digit number as a password but the aircrack-ng was unable to crack it even in 45 minutes and tried other tools like pyrit, crunch but they also didn't work very well. So, what I was wondering is that the password cracking tools are unable to crack a mere 9 digit no. then how can they crack a strong password (combination of upper, lowercase, numbers, special characters) however it may crack the password but it can take days or even years. And the other way is phishing which doesn't work always.

How does password cracking work in the real world?

  • 45 minutes is not a lot of time, crunch is a password list creator (not relevant to your question)
    – schroeder
    Commented Dec 28, 2017 at 8:56
  • @schroeder In real scenarios during a pentest is it okay to crack a password in hours or even in days?
    – daya
    Commented Dec 28, 2017 at 8:59
  • It depends on the rules of engagement. You also do not explain how you are cracking the password. Have you seen that most tutorials use the GPU to speed up the process? Did you use GPU tools?
    – schroeder
    Commented Dec 28, 2017 at 9:00
  • Yes, ocl hashcat uses the GPU but I didn't tried that because I know it would take lot of time and also because i was demonstrating myself only. And the question I am asking it in general that professionals also uses the same tools or some another tricks?
    – daya
    Commented Dec 28, 2017 at 9:06
  • No special tools. It's a brute force situation and you use the tools to go as fast as you can go.
    – schroeder
    Commented Dec 28, 2017 at 9:09

1 Answer 1


WPA2 is indeed a slow hash. But in the real world, performance is better than you might suspect:

  • An attacker can leverage multiple GPUs. With hashcat, six GTX 1080s can exhaust ?d?d?d?d?d?d?d?d?d in about eight minutes (and equivalent capacity - for basic attacks - can be rented on AWS for relatively little money).

  • Simple brute force and simple dictionaries are just the beginning - other techniques include using rules, masks, combinator attacks, hybrid attacks, and using larger, higher-quality dictionaries made from actual leaked passwords. These attacks are faster than brute force (often dramatically so).

  • Since most passwords are human-selected and not random, analyzing the context and psychology of the target is often useful - and may be necessary to make any real progress against a non-poor (but non-random) password stored with a slow hash like WPA2.

But if that WPA2 password is truly random, and draws from all four character sets .. six 1080s would take 92 years to fully exhaust the keyspace.

  • Thanks for telling the other techniques. I didn't know this before execpt a simple bruteforce.
    – daya
    Commented Dec 28, 2017 at 16:48
  • 1
    Indeed! See hashcat.net/wiki/#core_attack_modes for tips on those other attacks using hashcat. Commented Dec 28, 2017 at 16:51
  • 1
    Might also want to mention just how damn many clever rulesets there are!
    – forest
    Commented Dec 29, 2017 at 6:06

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .