/crack-hashcat

name: crack-hashcat
description: >
  Advanced password recovery and hash cracking tool supporting multiple algorithms and attack modes.
  Use when: (1) Performing authorized password auditing and security assessments, (2) Recovering
  passwords from captured hashes in forensic investigations, (3) Testing password policy strength
  and complexity, (4) Validating encryption implementations, (5) Conducting security research on
  cryptographic hash functions, (6) Demonstrating password weakness in penetration testing reports.
version: 0.1.0
maintainer: sirappsec@gmail.com
category: offsec
tags: [password-cracking, hashcat, forensics, password-audit, cryptography]
frameworks: [MITRE-ATT&CK, NIST]
dependencies:
  packages: [hashcat]
  tools: [opencl, cuda]
references:
  - https://hashcat.net/wiki/
  - https://hashcat.net/hashcat/
  - https://attack.mitre.org/techniques/T1110/

Hashcat Password Recovery

Overview

Hashcat is the world's fastest password recovery tool, supporting over 300 hash algorithms and multiple attack modes. This skill covers authorized password auditing, forensic password recovery, and security research applications.

**IMPORTANT**: Password cracking must only be performed on hashes you are authorized to crack. Unauthorized password cracking is illegal. Always ensure proper authorization and legal compliance.

Quick Start

Basic password cracking:

# Identify hash type
hashcat --example-hashes | grep -i md5

# Dictionary attack on MD5 hash
hashcat -m 0 -a 0 hashes.txt wordlist.txt

# Show cracked passwords
hashcat -m 0 hashes.txt --show

# Benchmark system performance
hashcat -b

Core Workflow

Password Cracking Workflow

Progress: [ ] 1. Verify authorization for password cracking [ ] 2. Identify hash algorithm type [ ] 3. Prepare hash file and wordlists [ ] 4. Select appropriate attack mode [ ] 5. Execute cracking operation [ ] 6. Analyze cracked passwords [ ] 7. Document password policy weaknesses [ ] 8. Securely delete hash files and results

Work through each step systematically. Check off completed items.

1. Authorization Verification

**CRITICAL**: Before any password cracking:

• Confirm written authorization from data owner
• Verify legal right to crack captured hashes
• Understand data handling and retention requirements
• Document chain of custody for forensic cases
• Ensure secure storage of cracked passwords

2. Hash Identification

Identify hash algorithm:

# Show all supported hash types
hashcat --example-hashes

# Common hash types
hashcat --example-hashes | grep -i "MD5"
hashcat --example-hashes | grep -i "SHA"
hashcat --example-hashes | grep -i "NTLM"

# Use hash-identifier (separate tool)
hash-identifier
# Paste hash when prompted

# Hashcat mode numbers (common)
# 0 = MD5
# 100 = SHA1
# 1000 = NTLM
# 1400 = SHA256
# 1800 = sha512crypt
# 3200 = bcrypt
# 5600 = NetNTLMv2
# 13100 = Kerberos 5 TGS-REP

3. Hash File Preparation

Prepare hash files:

# Simple hash file (one hash per line)
echo "5f4dcc3b5aa765d61d8327deb882cf99" > hashes.txt

# Hash with username (username:hash format)
cat > hashes.txt <<EOF
admin:5f4dcc3b5aa765d61d8327deb882cf99
user1:098f6bcd4621d373cade4e832627b4f6
EOF

# Hash with salt (hash:salt format for some algorithms)
echo "hash:salt" > hashes.txt

# From /etc/shadow (Linux)
sudo cat /etc/shadow | grep -v "^#" | grep -v ":\*:" | grep -v ":!:" > shadow_hashes.txt

# From NTDS.dit (Active Directory)
secretsdump.py -ntds ntds.dit -system SYSTEM -hashes lmhash:nthash LOCAL > ad_hashes.txt

4. Attack Modes

Choose appropriate attack mode:

**Dictionary Attack (Mode 0)**:

# Basic dictionary attack
hashcat -m 0 -a 0 hashes.txt rockyou.txt

# Multiple wordlists
hashcat -m 0 -a 0 hashes.txt wordlist1.txt wordlist2.txt

# With rules
hashcat -m 0 -a 0 hashes.txt rockyou.txt -r rules/best64.rule

**Combinator Attack (Mode 1)**:

# Combine words from two wordlists
hashcat -m 0 -a 1 hashes.txt wordlist1.txt wordlist2.txt

**Brute-Force Attack (Mode 3)**:

# All lowercase letters, 8 characters
hashcat -m 0 -a 3 hashes.txt ?l?l?l?l?l?l?l?l

# Mixed case and numbers, 6 characters
hashcat -m 0 -a 3 hashes.txt ?1?1?1?1?1?1 -1 ?l?u?d

# Custom charset
hashcat -m 0 -a 3 hashes.txt ?1?1?1?1?1?1?1?1 -1 abc123

**Mask Attack (Mode 3 with patterns)**:

# Password format: Uppercase + 6 lowercase + 2 digits
hashcat -m 0 -a 3 hashes.txt ?u?l?l?l?l?l?l?d?d

# Year pattern: word + 4 digits (2019-2024)
hashcat -m 0 -a 3 hashes.txt password?d?d?d?d

# Common patterns
hashcat -m 0 -a 3 hashes.txt ?u?l?l?l?l?l?d?d?s  # Capital + word + numbers + special

**Hybrid Attacks (Modes 6 & 7)**:

# Wordlist + mask (append)
hashcat -m 0 -a 6 hashes.txt wordlist.txt ?d?d?d?d

# Mask + wordlist (prepend)
hashcat -m 0 -a 7 hashes.txt ?d?d?d?d wordlist.txt

**Character Sets**:

• `?l` = lowercase (abcdefghijklmnopqrstuvwxyz)
• `?u` = uppercase (ABCDEFGHIJKLMNOPQRSTUVWXYZ)
• `?d` = digits (0123456789)
• `?s` = special characters (!@#$%^&*...)
• `?a` = all characters (l+u+d+s)
• `?b` = all printable ASCII

5. Performance Optimization

Optimize cracking performance:

# Use GPU acceleration
hashcat -m 0 -a 0 hashes.txt wordlist.txt -w 3

# Workload profiles
# -w 1 = Low (desktop usable)
# -w 2 = Default
# -w 3 = High (dedicated cracking)
# -w 4 = Nightmare (max performance)

# Specify GPU device
hashcat -m 0 -a 0 hashes.txt wordlist.txt -d 1

# Show performance benchmark
hashcat -b

# Optimize kernel
hashcat -m 0 -a 0 hashes.txt wordlist.txt -O

# Show estimated time
hashcat -m 0 -a 0 hashes.txt wordlist.txt --runtime=3600

6. Rules and Mutations

Apply password mutation rules:

# Use rule file
hashcat -m 0 -a 0 hashes.txt wordlist.txt -r rules/best64.rule

# Multiple rule files
hashcat -m 0 -a 0 hashes.txt wordlist.txt -r rules/best64.rule -r rules/leetspeak.rule

# Common Hashcat rules
# best64.rule - Best 64 rules for speed/c