# Credential Attacks

> Master the art of stealing, cracking, and abusing credentials. From password spraying and offline hash cracking to Kerberoasting and Pass-the-Hash lateral movement.

Canonical: https://codelivly.com/learning-paths/credential-attacks
Last updated: 2026-07-15

| | |
|---|---|
| Level | Intermediate |
| Category | Cybersecurity |
| Rooms | 3 |
| Lessons | 17 |
| Estimated time | 1 h 30 min |

Amateurs think credential attacks are just about guessing "Password123" or running a generic brute-force script until the account locks out. When the lockout happens, they give up and assume the environment is secure.

Professionals know that credentials are the ultimate currency of the realm. We don't just guess; we harvest, we spray intelligently, we crack offline, and we pivot. A single compromised password is rarely the end goal. it is the first domino in a chain reaction that leads to total domain dominance.

In this comprehensive Learning Path, we transition from basic password guessing to advanced, enterprise-grade credential abuse. You will master the methodologies of password spraying without triggering account lockouts, wield Hashcat and John the Ripper to break offline hashes, and execute sophisticated Active Directory attacks like Kerberoasting, AS-REP Roasting, and Pass-the-Hash. Stop knocking on the front door. Steal the keys.

## Rooms in this path

1. [Hashcat](https://codelivly.com/rooms/hashcat) - Master the world's fastest password cracker. Learn to identify hashes, configure GPU-accelerated attacks, and crack…
2. [John the Ripper](https://codelivly.com/rooms/john-the-ripper) - Master the ultimate field-testing Swiss Army Knife. Learn to auto-detect obscure hashes, crack encrypted archives (ZIP,…
3. [Hydra & Online Brute Forcing](https://codelivly.com/rooms/hydra-online-brute-forcing) - Master the art of online credential attacks. Learn to configure Hydra, evade account lockouts, and systematically…

## Related

- [Career path: Junior Penetration Tester](https://codelivly.com/career-paths/junior-penetration-tester)
- [Career path: Cloud Security Engineer](https://codelivly.com/career-paths/cloud-security-engineer)
- [Bug Bounty Workflow & Disclosure](https://codelivly.com/learning-paths/bug-bounty-workflow-and-disclosure)
- [Security Monitoring and Compliance Automation](https://codelivly.com/learning-paths/security-monitoring-and-compliance-automation)
- [Software Supply Chain Security](https://codelivly.com/learning-paths/software-supply-chain-security)