It's harder to get hashes than to crack them. For best results, you need to compromise a corporate Microsoft Windows Active Directory domain controller or an Op

It's harder to get hashes than to crack them. For best results, you need to compromise a corporate Microsoft Windows Active Directory domain controller or an OpenLDAP server. Web apps are easier to compromise, but typically those passwords protect objects of lesser value. Either way, once you have easy hashes (MD5, SHA1, NTLM) the game is over. Edit: And remember that NTLM hashes are just Unicode strings that are MD4'ed. They are not much better than LANMAN hashes.