I have seen many hackers bruteforce password for gaining access to social media.
In famous Mr Robot series it is shown that Elliot(main character) brute forces people and the password is displayed on screen. But for brute forcing we need the encrypted password. So how does a hacker get this encrypted password? (Mainly for social media)
There are multiple ways to get access to accounts.
One way is to try to log into the account online, by just trying a bunch of different passwords. This usually only works with services that don't care at all about such attacks, as any more security-aware service would start to run anti-automation techniques, such as CAPTCHAs or just slowing down the connection. However, in such a case, the attacker only needs a password candidate and nothing else.
The biggest downside is that these are very noisy (meaning that the site can notice easily that something is amiss) and very slow - both things attacks generally don't want.
Offline attacks are what people think of when they hear "password cracking". Attackers steal the hash of a password, along other relevant information (e.g. salts, parameters, etc.), and attack those offline. This means they try to find the input that, using the same parameters and the same function, will result in the same output.
The advantage is that there is no need to continuously communicate with the service you are trying to attack. This makes things a hell of a lot faster (several orders of magnitude, in fact), and also less noisy.
The obvious disadvantage is that attackers need to gain access to the hash first. One way this is done is to simply look for existing leaked hashes. People love re-using passwords and as such, if you find that Alice uses some password for LinkedIn, chances are high she'll also use the same password for Facebook.
Another way is to attack the service directly and attempt to get access to the database. If it's a read-only access, then you can dump the hashes and crack them offline. If it's read-write access, you can be even more malicious and replace the original hash with one that corresponds to a known password, use this to log in as Alice, do something malicious, then set the hash back.
