22.7 Red vs Blue, Project and Real Incidents

By Ravindra Bagale Last updated: 27 September 2026

Chala mitrano, John, Hashcat, Hydra, rockyou – aata Purple Team loop. Red lab madhe weak MD5 / no-salt hashes aani online SSH/FTP guessing dakhavto; Blue bcrypt/Argon2, fail2ban/lockout, MFA, key-only SSH aani rate limits lavto. Tumhi Raja-Rani Traders style OWN lab madhe build → hack → fix karun prove kara ki Hydra fail hote aani ban log madhe disto. Crack tool awareness; fix = career. Samjla ka?

Red Team vs Blue Team – password attacks

Red team (attacker) does	Blue team (defender) detects / stops
Offline crack of weak MD5 / SHA-1 / no-salt hashes with John or Hashcat + rockyou/rules	Use bcrypt / Argon2 / `password_hash()` + unique salt; never store MD5/SHA-1 for passwords
Hydra online against lab SSH / FTP / web login forms	fail2ban / account lockout after N failures; rate-limit login endpoints; alert on burst failures
Tries common and reused passwords from leaked lists	Long passphrases + check against known-breached lists; ban password reuse across apps
Keeps PasswordAuthentication on SSH so guessing works	Key-only SSH: `PasswordAuthentication no`; MFA on consoles and VPN
Leaves noisy Hydra runs aimed at public or classmate hosts	Written scope; host-only targets only (`192.168.56.20` / `.50`); ethics card
Trusts a cracked hash without checking policy	Re-hash on next login; force reset; document which algo was weak

Defender chi simple checklist: slow salted hash → MFA → fail2ban/lockout → key-only SSH → no reuse → re-verify Hydra fails. Attack tools Kali var; bachav hashing aani config Blue var. Interview madhe "I ran Hydra" peksha "I proved fail2ban banned me and PasswordAuthentication is off" jast strong.

# OWN host-only only – Kali 192.168.56.10 → lab target 192.168.56.20 or helper .50
mkdir -p ~/labs/raja-rani-passwords
# Create a DELIBERATE weak lab hash file YOU own (never real user dumps):
# echo 'labuser:$(echo -n "password" | md5sum | awk "{print \$1}")' > ~/labs/raja-rani-passwords/weak.md5
# Or capture hashes only from YOUR Metasploitable / helper after authorized lab dump
# Offline (lab hashes only):
# john --wordlist=/usr/share/wordlists/rockyou.txt ~/labs/raja-rani-passwords/weak.md5
# Online (lab SSH only – stop when you have proof):
# hydra -l msfadmin -P /usr/share/wordlists/rockyou.txt -t 4 ssh://192.168.56.20
# Defender on Amazon Linux / Ubuntu helper YOU own:
# sudo yum install epel-release -y && sudo yum install fail2ban -y
# sudo service fail2ban start
# sudo fail2ban-client status sshd
# Then harden SSH: PasswordAuthentication no (keys ready first!) and sudo service sshd restart

Ravindra Bagale's Tip

Students Hydra ne password milala ki "done" mhantat – pan Fix nahi kartat. Dusri common chuk: app madhe md5($password) thevun John/Hashcat sathi soft target thevne. Rule: crack proof → bcrypt/password_hash + fail2ban/MFA + key-only SSH → same Hydra/John re-run fails. CEH exam modules madhe password attacks yetat – defence line nehmi joda. Ghabru naka, practice ne yetay.

Lab

Kali 192.168.56.10 var ek OWN weak hash file banava (single fake lab user, MD5 of a known weak string – not a real dump). John/Hashcat ne crack prove kara. Mag Metasploitable 192.168.56.20 (kiwa tumcha helper .50) var Hydra SSH try kara – ethics card, host-only, short run. Target var fail2ban install/sudo service fail2ban start kara ani sudo fail2ban-client status sshd madhe Kali IP ban zala ka te screenshot. Output ~/labs/raja-rani-passwords/ madhe save.

Project: Build it, hack it, fix it

Build: For fictional Raja-Rani Traders (Nashik) password lab, use Metasploitable 192.168.56.20 and/or an OWN helper 192.168.56.50 with:

A deliberate weak MD5-style lab hash file YOU create (fake user only – never real customer dumps)
SSH still allowing password auth for the pre-fix phase (lab only)
Optional web login form on .50 that you will rate-limit later

Snapshot pre-password-surface. No bridged adapter. Ethics card apply kara.

Hack (lab only – awareness): From Kali 192.168.56.10:

John or Hashcat against YOUR weak hash file + rockyou (offline)
Hydra against lab SSH on .20 or .50 – stop when you have a clear success/fail log; do not invent new exploit chains
Optional: short Hydra against OWN web login on .50 with the correct failure string (as in 22.5)

Prove weak hashing + online guessing works in the open lab. Never aim Hydra/John at public shops, classmate accounts, or real LinkedIn/VPN targets.

Fix:

Replace MD5/SHA-1 password storage with bcrypt/Argon2 (password_hash / password_verify in PHP apps)
Install and start fail2ban: sudo yum install fail2ban -y then sudo service fail2ban start
Enable account lockout / login rate limits on the web form
Prepare SSH keys, then set PasswordAuthentication no and sudo service sshd restart
Turn on MFA for any console/VPN used by Raja-Rani staff accounts (lab policy note)
Ban password reuse in the written shop password policy

Re-verify: Same John job against a bcrypt sample fails or is impractically slow; same Hydra SSH run fails or shows Kali IP banned in fail2ban-client status sshd; PasswordAuthentication off confirmed. 1-page Purple note for owner Raja: finding → risk → fix → evidence. Peer-review with Zoya / Salman. No real user dumps, no internet targets.

Real incident: LinkedIn password breach (2012)

In 2012, LinkedIn reported that password hashes for member accounts had been taken and later appeared for sale / circulation online. Public reporting and LinkedIn's own statements described SHA-1 hashes without a proper modern salt/slow-hash design at the time, which made offline cracking far easier once the file leaked. LinkedIn later required password resets and moved toward stronger storage. Weakness: unsalted / fast hashes + large credential dump usable for reuse attacks elsewhere. What would have reduced it: slow salted hashes (bcrypt/Argon2-class), unique salts, breach detection, forced resets, and MFA so a cracked password alone is not enough. Lab lesson: John/Hashcat against YOUR weak MD5 file shows why Blue must never store fast hashes. Source: LinkedIn official blog / major news coverage of the 2012 LinkedIn password breach (verify current summaries).

Real incident: Colonial Pipeline ransomware (2021)

In 2021, Colonial Pipeline (U.S. fuel pipeline operator) suffered a ransomware incident that led to a widely reported operational shutdown and emergency response. Company and CISA-related reporting described that attackers gained entry using a compromised password / VPN account that did not have multi-factor authentication enabled – after which ransomware impact forced business decisions far beyond "IT only". Weakness: single-factor remote access + reused/leaked credential path + insufficient VPN hygiene. What would have reduced it: MFA on every VPN/remote path, disable unused VPN accounts, credential monitoring against breach dumps, network segmentation, and tested incident response. Lab lesson: Hydra against open password SSH is the classroom cousin of "password-only VPN" – Blue answer is MFA + lockout + key/cert where possible. Source: Colonial Pipeline / DarkSide reporting (2021); CISA advisories and major news (verify current summaries).

Interview model (clean English): "I run John, Hashcat and Hydra only against my host-only lab hashes and services. Every finding becomes a Blue task – bcrypt or Argon2, fail2ban or lockout, MFA, key-only SSH, no reuse – and I re-run the same attack to prove it failed or the IP was banned."

Thodkyaat: password tools shika, pan hashing + MFA + fail2ban shika. Aata pudhe Metasploit – ethics card sobat. Chala pudhe, mitrano!

Thodkyaat sangaycha tar

Never store plain-text passwords; use a slow, salted hash (bcrypt/Argon2), never md5/sha1.
Offline attacks (John, Hashcat) are very fast; online attacks (Hydra) are slow and logged.
Wordlists like rockyou.txt plus rules crack most human passwords; brute force is a last resort.
John auto-detects hashes; Hashcat is fastest and needs the right -m mode; Hydra needs the exact failure string for web forms.
Defend with strong hashing, MFA, account lockout/fail2ban, key-only SSH and long passphrases.

Samjla ka? Password todaycha ani vachvaycha – donhi kalale. Pudhchya chapter madhe sarvat prasiddha tool: Metasploit. Chala pudhe, mitrano!