/cracking-passwords

name: cracking-passwords
description: Crack password hashes using hashcat/john, perform password spraying, brute force authentication, and execute pass-the-hash attacks. Use when cracking credentials or performing password-based attacks.
verified: 2026-07-27

Password Attacks and Credential Cracking Skill

You are a password cracking and credential attack expert. Use this skill when the user requests help with:

• Password hash cracking (hashcat, john)
• Hash identification and extraction
• Credential spraying and brute forcing
• Rainbow table attacks
• Pass-the-hash techniques
• Wordlist generation
• Rule-based attacks

When to Use

Activate this skill when the user asks to:

• Crack password hashes
• Identify unknown hash types
• Perform password spraying
• Generate wordlists
• Optimize hashcat/john performance
• Extract and crack credentials
• Perform pass-the-hash attacks
• Help with credential-based attacks

**Scope and authorization.** Cracking is only as authorized as the hashes were. Confirm the material came from a system in scope, and treat recovered plaintext as live credentials — encrypt at rest, never paste into a shared doc or a third-party cracking service, and destroy it at engagement end per the contracted retention terms.

Three domain-specific traps:

• **Spraying is an availability risk, not just an access one.** Online

attempts against production auth can lock out real accounts and page a real SOC. You need the lockout threshold and observation window in writing, an agreed attempt rate, and a named contact — or you cause an outage and a false incident.

• **Breach-corpus material is not fair game by default.** Third-party dump

data belongs to people who are not your client. Using it to seed wordlists or validate reuse against live accounts needs explicit engagement coverage and a lawful basis under GDPR-style regimes.

• **Pass-the-hash is authentication, not analysis.** Replaying a hash is

unauthorized access unless lateral movement is explicitly in scope.

Report the fact of a weak credential and its policy implication; there is rarely a reason to put recovered plaintext in a deliverable.

When NOT to Use

• **Online brute force against a live service** — that is testing, not cracking;

use `testing-web-applications` or `enumerating-network-services`, and mind lockouts

• **Obtaining the hashes in the first place** — use the relevant privilege

escalation or `attacking-active-directory` skill

• **Reviewing how an application stores passwords** — use `reviewing-cryptography`

Core Methodologies

1. Hash Identification

**Identify Hash Type:**

# hashid
hashid 'hash_here'
hashid -m 'hash_here'  # Show hashcat mode

# hash-identifier
hash-identifier

# haiti
haiti 'hash_here'

# Manual identification by format
# MD5: 32 hex chars
# SHA1: 40 hex chars
# SHA256: 64 hex chars
# NTLM: 32 hex chars (same as MD5 but context differs)
# bcrypt: $2a$, $2b$, $2y$ prefix

**Common Hash Formats:**

MD5: 5f4dcc3b5aa765d61d8327deb882cf99
SHA1: 5baa61e4c9b93f3f0682250b6cf8331b7ee68fd8
SHA256: 5e884898da28047151d0e56f8dc6292773603d0d6aabbdd62a11ef721d1542d8
NTLM: 209c6174da490caeb422f3fa5a7ae634
NTLMv2: username::domain:challenge:response:response
bcrypt: $2a$10$N9qo8uLOickgx2ZMRZoMyeIjZAgcfl7p92ldGxad68LJZdL17lhWy
Linux SHA512: $6$rounds=5000$...

2. Hashcat Basics

**Installation:**

# Kali Linux
apt install hashcat

# Check GPUs
hashcat -I

**Basic Hashcat Usage:**

# Dictionary attack
hashcat -m <hash_type> -a 0 hashes.txt wordlist.txt

# Dictionary + rules
hashcat -m <hash_type> -a 0 hashes.txt wordlist.txt -r rules/best64.rule

# Brute force
hashcat -m <hash_type> -a 3 hashes.txt ?a?a?a?a?a?a?a?a

# Combination attack
hashcat -m <hash_type> -a 1 hashes.txt wordlist1.txt wordlist2.txt

# Show cracked passwords
hashcat -m <hash_type> hashes.txt --show

# Resume session
hashcat -m <hash_type> hashes.txt wordlist.txt --session mysession
hashcat --session mysession --restore

**Common Hash Types (-m flag):**

0     = MD5
100   = SHA1
1400  = SHA256
1700  = SHA512
1000  = NTLM
5600  = NetNTLMv2
3200  = bcrypt
1800  = sha512crypt (Linux)
7500  = Kerberos 5 etype 23 AS-REQ Pre-Auth  (sniffed pre-auth, not roasting)
13100 = Kerberos 5 etype 23 TGS-REP          (Kerberoasting, krb5tgs)
18200 = Kerberos 5 etype 23 AS-REP           (ASREPRoasting, krb5asrep)
16800 = WPA-PMKID-PBKDF2
22000 = WPA-PBKDF2-PMKID+EAPOL

**Hashcat Attack Modes:**

-a 0  # Dictionary attack
-a 1  # Combination attack
-a 3  # Brute-force attack
-a 6  # Hybrid wordlist + mask
-a 7  # Hybrid mask + wordlist

**Hashcat Masks:**

?l = lowercase letters (a-z)
?u = uppercase letters (A-Z)
?d = digits (0-9)
?s = special characters
?a = all characters (?l?u?d?s)
?b = binary (0x00 - 0xff)

# Examples
?u?l?l?l?l?d?d  # Password01
?d?d?d?d        # 4-digit PIN
?a?a?a?a?a?a    # 6 characters (any)

3. John the Ripper

**Basic John Usage:**

# Auto-detect and crack
john hashes.txt

# Specify format
john --format=NT hashes.txt
john --format=Raw-SHA256 hashes.txt

# With wordlist
john --wordlist=rockyou.txt hashes.txt

# With rules
john --wordlist=wordlist.txt --rules hashes.txt

# Show cracked passwords
john --show hashes.txt
john --show --format=NT hashes.txt

# List formats
john --list=formats

**Common John Formats:**

Raw-MD5
Raw-SHA1
Raw-SHA256
NT (NTLM)
LM
bcrypt
sha512crypt
krb5asrep
krb5tgs

**Unshadow (Linux):**

# Combine passwd and shadow files
unshadow passwd shadow > unshadowed.txt
john unshadowed.txt

4. Specific Hash Type Attacks

**NTLM Hashes:**

# Hashcat
hashcat -m 1000 -a 0 ntlm.txt rockyou.txt -r rules/best64.rule

# John
john --format=NT --wordlist=rockyou.txt ntlm.txt

**NTLMv2 (NetNTLMv2):**

# Hashcat
hashcat -m 5600 ntlmv2.txt rockyou.txt

# Captured from Responder
hashcat -m 5600 Responder-Session.txt rockyou.txt

**Kerberoast (