You have retrieved the raw hash values from a Windows 2000 Domain Controller. Using social engineering, you come to know that they are enforcing strong passwords. You understand that all users are…

An online attack attempts to crack passwords directly against an active authentication service, which is much slower due to network latency, risks account lockouts, and is generally easily detectable.

A pure dictionary attack might miss passwords that incorporate numbers, special characters, or slight variations, even if based on dictionary words, making it less effective against strong password policies.

A pure brute-force attack would be computationally too expensive and time-consuming for passwords that are at least 8 characters long and have complexity requirements, even with knowledge of user tendencies.

A hybrid attack combines elements of dictionary attacks and brute-force attacks by taking dictionary words or user names and adding common mutations (e.g., appending numbers, symbols, common patterns, or variations of user names). This approach is ideal when you have intelligence about likely password choices and complexity requirements, allowing for faster cracking of predictably complex passwords than pure dictionary or brute-force methods.