Password cracking turns captured hashes into credentials. Hashcat uses GPU acceleration for speed; John the Ripper is flexible and cross-platform. Both are essential in the toolkit.
Hash Identification
# hashid hashid 'HASH_VALUE' hashid -m 'HASH_VALUE'# include hashcat mode number
# hash-identifier hash-identifier # paste hash, it guesses the type
# Common formats reference: # MD5 $1$ or 32 hex chars # SHA-1 40 hex chars # SHA-256 64 hex chars # bcrypt $2a$ $2b$ $2y$ # NTLM 32 hex chars (like MD5 but from Windows) # NetNTLMv2 User::Domain:Challenge:Hash:Blob # Kerberos 5 $krb5tgs$23$ (RC4) or $krb5tgs$17$ (AES128) or $krb5tgs$18$ (AES256) # AS-REP $krb5asrep$23$ # SHA-512 crypt $6$ # WPA PMKID or 22000 format
Hashcat — Attack Modes
# Modes overview # -a 0: Wordlist (dictionary) # -a 1: Combinator (word1+word2) # -a 3: Mask (brute force with pattern) # -a 6: Hybrid (wordlist + mask) # -a 7: Hybrid (mask + wordlist)
Mode 0 — Dictionary Attack
hashcat -a 0 -m HASH_TYPE hashes.txt wordlist.txt
# With rules hashcat -a 0 -m 0 hashes.txt rockyou.txt -r /usr/share/hashcat/rules/best64.rule hashcat -a 0 -m 0 hashes.txt rockyou.txt -r /usr/share/hashcat/rules/d3ad0ne.rule
# Basic wordlist attack john hashes.txt --wordlist=rockyou.txt
# With format specified john hashes.txt --format=NT --wordlist=rockyou.txt john hashes.txt --format=sha512crypt --wordlist=rockyou.txt john hashes.txt --format=bcrypt --wordlist=rockyou.txt
# Auto-detect format john hashes.txt --wordlist=rockyou.txt
# Show cracked john hashes.txt --show
# List formats john --list=formats john --list=formats | grep -i ntlm
# Rules john hashes.txt --wordlist=rockyou.txt --rules john hashes.txt --wordlist=rockyou.txt --rules=All john hashes.txt --wordlist=rockyou.txt --rules=Jumbo
# Incremental (brute force) john hashes.txt --incremental john hashes.txt --incremental=Alpha john hashes.txt --incremental=Digits
# Restore interrupted session john --restore
# Pipes cat hashes.txt | john --stdin --format=NT
John Format Examples
# NTLM john ntlm.txt --format=NT --wordlist=rockyou.txt
# NetNTLMv2 john netntlmv2.txt --format=netntlmv2 --wordlist=rockyou.txt
# bcrypt john bcrypt.txt --format=bcrypt --wordlist=rockyou.txt
# Kerberoast john kerberoast.txt --format=krb5tgs --wordlist=rockyou.txt
# AS-REP john asreproast.txt --format=krb5asrep --wordlist=rockyou.txt
Format Converters (john helper scripts)
# Located in /usr/share/john/ or john's run/ folder
# Convert SAM/SYSTEM dump to john format samdump2 SYSTEM SAM > hashes.txt john hashes.txt --format=NT --wordlist=rockyou.txt
# /etc/shadow unshadow /etc/passwd /etc/shadow > shadow.txt john shadow.txt --wordlist=rockyou.txt
No comments yet. Be the first.