Lion Cipher Lab
Read an authentication-test result: which credentials are weak, and did lockout actually work?
- SOC Analyst / Blue Team
- Intermediate
- ~35 min
- Free · no account required
Why it matters
Anybody can run a password-guessing tool; the job is reading what it produced and turning it into a decision. When a red-teamer, a vendor, or your own tooling hands you the raw output of an authorised credential-strength test against a service you own, a hiring manager and a real incident both want the same thing: can you look at it and say, in one breath, which credentials are weak, which one to fix first, and whether the lockout control you paid for actually did its job? This drill trains exactly that read. You will learn to find the two lines in a wall of text that mean 'this account's…
What you'll learn
- reading raw Hydra output: the run banner, the [DATA] plan, [STATUS] rate lines, the success lines, and the [ERROR] lines
- spotting the '[port][service] host: ... login: X password: Y' line that means a valid credential was recovered
- interpreting a recovered credential as a CONTROL FAILURE (that account had a guessable password) rather than a 'win'
- prioritising remediation: privileged / service accounts before ordinary user accounts
- reading whether — and after how many attempts — an account-lockout or source-ban control engaged, from the pattern of [ERROR] lines
- the double-edged nature of lockout: it stops brute force but hands an attacker an account-lockout denial-of-service, so rate-limiting + MFA usually beat a hard lockout
- knowing the limits of the result: it proves guessability of the TESTED accounts, not overall exposure, and MFA changes the whole picture
- connecting the test to the defender's view: the same run produces a burst of failed logons in the auth log
- authorized-testing discipline: only assess a service you own or are explicitly authorised to test
Steps in this lab
- The situation: you commissioned this test on your own service
- Anatomy of Hydra output — what each kind of line is telling you
- The artifact: the raw output from your authorised test
- Read the result — which credentials were recovered
- Prioritise — a service account outranks an ordinary user
- Did the lockout control actually engage? Read the error pattern
- The trap in lockout — it can be turned into a denial-of-service
- What the result proves — and what it does NOT
- The defender's mirror — this same run lit up your auth log
- Write the assessment — turn the output into decisions