🔐 Password Cracking Flow
Get Hash
→
Identify Type
→
Online Lookup
→
Wordlist
→
Rules
→
Masks
Try online lookups first (CrackStation, hashes.com) - they're instant!
1
Hash Identification
Don't guess - identify the hash type before wasting GPU cycles!
hashid - identify hash type
hashid '$6$rounds=5000$salt$hash...'
hashid -m 'hash' # Show hashcat mode
hashid -j 'hash' # Show john format
hash-identifier - interactive tool
hash-identifier
# Paste hash when prompted
Name-That-Hash - modern alternative
nth --text '5d41402abc4b2a76b9719d911017c592'
nth --file hashes.txt
📏 Hash Length Quick Reference
32 → MD5/NTLM
40 → SHA1
64 → SHA256
128 → SHA512
⚠️ MD5 and NTLM are both 32 chars - context matters! (Windows = NTLM, web = MD5)
2
Hashcat - GPU Cracking
The world's fastest password cracker. Uses GPU for blazing speed.
Basic Wordlist Attack
Crack MD5 with wordlist
hashcat -m 0 hash.txt /usr/share/wordlists/rockyou.txt
Common hash types
# NTLM (Windows)
hashcat -m 1000 hash.txt rockyou.txt
# sha512crypt (Linux /etc/shadow)
hashcat -m 1800 hash.txt rockyou.txt
# Kerberos TGS (Kerberoasting)
hashcat -m 13100 hash.txt rockyou.txt
# AS-REP roast
hashcat -m 18200 hash.txt rockyou.txt
# NetNTLMv2 (Responder captures)
hashcat -m 5600 hash.txt rockyou.txt
Rule-Based Attacks
Rules mutate wordlist entries (password → P@ssword, Password1, PASSWORD!, etc.)
Apply rules for more coverage
# Best64 rule - fast, good coverage
hashcat -m 0 hash.txt rockyou.txt -r /usr/share/hashcat/rules/best64.rule
# Dive rule - thorough but slower
hashcat -m 0 hash.txt rockyou.txt -r /usr/share/hashcat/rules/dive.rule
# OneRuleToRuleThemAll - community favorite
hashcat -m 0 hash.txt rockyou.txt -r OneRuleToRuleThemAll.rule
# Stack multiple rules (SLOW but thorough)
hashcat -m 0 hash.txt rockyou.txt -r best64.rule -r toggles1.rule
Mask Attacks (Brute Force)
When you know the password pattern but not the characters.
Mask attack examples
# ?l=lowercase ?u=uppercase ?d=digit ?s=special ?a=all
# 8 lowercase chars
hashcat -m 0 hash.txt -a 3 ?l?l?l?l?l?l?l?l
# Capital + 6 lower + digit (Password1 pattern)
hashcat -m 0 hash.txt -a 3 ?u?l?l?l?l?l?l?d
# Company name + 4 digits (Company2024 pattern)
hashcat -m 0 hash.txt -a 3 Company?d?d?d?d
# Increment mask length 1-8
hashcat -m 0 hash.txt -a 3 --increment --increment-min 1 --increment-max 8 ?a?a?a?a?a?a?a?a
Mask Characters
?l = a-z (lowercase)
?u = A-Z (uppercase)
?d = 0-9 (digits)
?s = special chars
?a = all printable
💡 Pro Tips
• Use
-O for optimized kernels• Use
-w 3 for workload tuning• Use
--show to see cracked• Use
--username if hash has user:Session Management
Save, restore, and show sessions
# Save session for later
hashcat -m 0 hash.txt rockyou.txt --session mycrack
# Restore session
hashcat --session mycrack --restore
# Show cracked passwords
hashcat -m 0 hash.txt --show
# Output cracked to file
hashcat -m 0 hash.txt rockyou.txt -o cracked.txt
3
John the Ripper
The classic cracker. Great at auto-detecting hash types and extracting from files.
Basic Cracking
Auto-detect hash type and crack
# John auto-detects hash type!
john hash.txt --wordlist=/usr/share/wordlists/rockyou.txt
# Specify format if needed
john hash.txt --wordlist=rockyou.txt --format=raw-md5
john hash.txt --wordlist=rockyou.txt --format=nt # NTLM
# Show cracked passwords
john hash.txt --show
# List available formats
john --list=formats | grep -i sha
*2john - Extract Hashes from Files
John includes tools to extract crackable hashes from encrypted files.
Extract hashes from various file types
# ZIP files
zip2john protected.zip > zip.hash
john zip.hash --wordlist=rockyou.txt
# Encrypted SSH keys
ssh2john id_rsa > ssh.hash
# KeePass databases
keepass2john database.kdbx > keepass.hash
# PDF files
pdf2john protected.pdf > pdf.hash
# Office documents
office2john secret.docx > office.hash
# 7-Zip archives
7z2john archive.7z > 7z.hash
# RAR files
rar2john archive.rar > rar.hash
# PGP/GPG keys
gpg2john private.key > gpg.hash
💡 Finding *2john tools
locate *2john | head -20 # or ls /usr/share/john/
Linux /etc/shadow
Crack Linux password hashes
# Combine passwd and shadow (if you have both)
unshadow /etc/passwd /etc/shadow > unshadowed.txt
# Crack it
john unshadowed.txt --wordlist=rockyou.txt
# Or just crack shadow directly
john shadow.txt --wordlist=rockyou.txt
4
Hydra - Online Brute Force
Attack live services directly - SSH, FTP, HTTP, RDP, SMB, and more.
⚠️ Warning
Online attacks can lock accounts and trigger alerts. Check lockout policy first!
Common Service Attacks
SSH brute force
# Single user, password list
hydra -l admin -P /usr/share/wordlists/rockyou.txt ssh://192.168.1.10
# User list + password list
hydra -L users.txt -P passwords.txt ssh://192.168.1.10
# Limit threads to avoid lockout
hydra -l admin -P pass.txt -t 4 ssh://192.168.1.10
FTP / SMB / RDP
# FTP
hydra -l admin -P rockyou.txt ftp://192.168.1.10
# SMB
hydra -l administrator -P rockyou.txt smb://192.168.1.10
# RDP (slow, be patient)
hydra -l admin -P rockyou.txt rdp://192.168.1.10
HTTP Form Attacks
HTTP POST form (most common)
# Format: "path:POST_params:failure_string"
hydra -l admin -P rockyou.txt 192.168.1.10 http-post-form \
"/login.php:username=^USER^&password=^PASS^:Invalid credentials"
# With HTTPS
hydra -l admin -P rockyou.txt 192.168.1.10 -s 443 https-post-form \
"/login:user=^USER^&pass=^PASS^:F=incorrect"
HTTP Basic Auth
hydra -l admin -P rockyou.txt 192.168.1.10 http-get /admin
🔍 Finding the right parameters
Use Burp Suite or browser DevTools → Network tab to capture the login request and see exact parameter names.
5
Password Spraying
Try ONE password against MANY users - avoids account lockouts!
❌ Brute Force
Many passwords → 1 user = LOCKOUT
✓ Spraying
1 password → Many users = SAFE
NetExec spray (AD environments)
# Spray single password
nxc smb <DC_IP> -u users.txt -p 'Summer2024!' --continue-on-success
# Multiple passwords (one at a time)
nxc smb <DC_IP> -u users.txt -p passwords.txt --no-bruteforce --continue-on-success
Kerbrute spray (stealthier - no logon events!)
kerbrute passwordspray -d domain.local --dc <DC_IP> users.txt 'Password123!'
🎯 Passwords to Spray
• Season+Year (Winter2024!)
• Company123!
• Password1
• Welcome1
• Changeme1
• P@ssw0rd
• Qwerty123
• Monday01!
6
Advanced Techniques
Custom Wordlist Generation
CeWL - crawl website for words
# Extract words from company website
cewl https://company.com -d 2 -m 5 -w company_words.txt
# Include emails too
cewl https://company.com -d 2 -m 5 -e -w words.txt
CUPP - create user-specific wordlist
# Interactive - enter target's info
cupp -i
# Uses name, birthdate, pet names, etc to generate likely passwords
Combinator Attack
Combine two wordlists
# word1 + word2 = combined password
hashcat -m 0 hash.txt -a 1 list1.txt list2.txt
# Example: "admin" + "2024" = "admin2024"
PRINCE Attack
Intelligent word combination (princeprocessor)
# Generate candidates and pipe to hashcat
pp64.bin wordlist.txt | hashcat -m 0 hash.txt
Best Wordlists
Essential
/usr/share/wordlists/rockyou.txt
SecLists
/usr/share/seclists/Passwords/
Weakpass
weakpass.com/wordlist (multi-GB)
CrackStation
crackstation.net/buy-crackstation-wordlist-password-cracking-dictionary.htm