The problem

Credential attacks are the most common way in, and the defenses against them are usually taught as bullet points. Understanding why each control works means watching the attack succeed without it — safely, against a local lab, with no real accounts involved.

The approach

1. 01Stage 1 — Attack: a dictionary attack falls common passwords in milliseconds, and an exhaustive brute force cracks a 4-digit PIN trivially, demonstrating how small keyspaces collapse.
2. 02Stage 2 — Defense: PBKDF2 salting with key stretching makes each offline guess cost ~54ms instead of ~0.000001ms for raw SHA-256; a simulated lockout stops online guessing after 5 failures.
3. 03Stage 3 — Detection: a log parser reads a realistic SSH auth log and flags any IP crossing 5 failures inside a sliding 5-minute window, then reports whether the attack ultimately succeeded.
4. 04Self-contained by design: no network calls, no external dependencies, everything runs locally with the Python standard library.

Demonstrates

• Credential-attack mechanics
• Defensive controls (hashing, lockout)
• Detection engineering
• Log analysis with sliding windows