You have retrieved the raw hash values from a Windows 2000 Domain Controller. Using social engineering, you come to know that they are enforcing strong passwords. You understand that all users are req

An online attack sends guesses directly to a live authentication service, which is throttled by lockout policies and network latency, making it the slowest and most detectable option.

A pure dictionary attack tests unmodified wordlist entries and would largely fail against an 8-character policy requiring mixed character categories, since most dictionary words alone will not match.

A brute-force attack tries every possible character combination and will eventually succeed, but against 8-character mixed-category passwords the search space is enormous, making it the slowest offline approach.

A hybrid attack starts with a wordlist and appends or prepends numbers, special characters, and capitalization variations - exactly how users typically create passwords that barely meet complexity requirements. Because users predictably add digits or symbols to familiar words, a hybrid attack finds these passwords far faster than pure brute force while covering ground that a plain dictionary attack misses on strong-policy environments.