Hashcat Command Examples (hash cracking with John the Ripper and Hashcat)

Hashcat & John the Ripper Command cheatsheet (crack the hashes)

***************************************************************
Telegram private video: https://t.me/c/1480784123/2223/2861
Full command list and : https://t.me/c/1480784123/2509/2860
Join our telegram channel : https://t.me/efxtv
***************************************************************

- Hashcat is a powerful password recovery tool used for cracking passwords. It is mainly designed to help security professionals and penetration testers assess the strength of the passwords by attempting to crack them by trying out various attack methods. It might be quite confusing at first since there are over 300 hashing algorithms so we might not know which one to use.

- World's fastest password crackers

Q. What are the hash?
Ans. Hashes are the output of a hashing algorithm that takes your plaintext, scrambles it up, and aims to produce a hashed value for a given plaintext or word.

- Create a hash
$ echo -n "efxtv" | openssl md5
$ for i in $(cat wordlist.txt); do echo -n "$i"| md5sum | tr -d " -" >> hashes; done

- Syntax:
Hashcat		Attack mode	Hasht type	Hash	Wordlist

- Attack modes:
Wordlist -a 0
Wordlist + rule -a 0
Combinator -a 1
Bruiteforde -a 3

- Check the supported system and device list
hashcat --benchmark

- Dictionary attack (-a 0)
As we saw in our example above, a dictionary attack is performed by using a wordlist. A dictionary attack is also the default option in Hashcat. The better the wordlist is, the greater the chances of cracking the password.

- Combinator attack (-a 1)
The combinator attack will try different combinations of words from our wordlist. For example, if our wordlist contains the words “pass”, ”123", and ”hello”, Hashcat will generate the following wordlist.
passpass
pass123
passhello
123pass
123123
123hello
hellopass
hello123
hellohello

- Mask attack (-a 3)
The mask attack is similar to the dictionary attack but more specific. Brute-force approaches like dictionary attacks can take a long time to crack a password. But if we have information regarding the password, we can use that to speed up the time it takes to crack the password.

- For example, if we know the length of the password and a few characters that might be in the password, we can generate a custom wordlist with those characters.

- Hashcat supports a wide range of hashing algorithms such as :
- MD5
- SHA1
- SHA265
- bycrypt and many others…

This tool is used for various scenarios such as:
- Recovering lost passwords
- Testing the security of password-protected systems
- Auditing the strength of user passwords

Features of Hashcat
- Its free
- Fully open source
- Supports over 300 highly-optimized hashing algorithms!
- Supports Windows, Linux, and Mac.
- Supports cracking multiple hashes in parallel
- Built- in benchmarking system.

1. How to install Hashcat ?
$ sudo apt install hashcat

2. Help options
$ hashcat -h/--help

3. Locate wordlist
$ ls /usr/share/wordlists

4. Straight Attack
- The first attack we are going to perform is a straight attack or dictionary attack.
- It’s the default method that Hashcat uses.
- This attack is faster on simple passwords.
- The hash type I and using is MD5 and in the command, I have specified the hash type

$ hashcat -m 0 -a 0 ./target_hashes.txt /usr/share/wordlists/rockyou.txt.gz

-m 0 is for MD5 hash type
-a 0 is for a straight attack

- Attack with device type D1 D2 D3
$ hashcat -m 100 -a 0 sha1 ~/Downloads/rockyou.txt -D1


5. View previously cracked passwords
$ hashcat -a 0 -m 0 ./target_hashes.txt /usr/share/wordlists/rockyou.txt.gz --show

6. SHA1 hash using the same attack mode
$ hashcat -m 100 -a 0 sha1 ~/Downloads/rockyou.txt
-m 100 is for SHA1 hash type
-a 0 for a straight attack

7. Combination Attack
This attack is used to crack passwords that are two words joined together. Such as ‘passpass’ or ‘blue-bike’.

Hashcat exploits this using the combination attack that takes two wordlists (dictionaries).

So the two wordlists we will be using must contain the left and right parts of passwords.

The word list I’m using contains both the words from the password so I’ll be using the same for left and right side.

$ hashcat -m 0 -a 1 ./target_hashes.txt ./wordlist1 ./wordlist2
-m 0 for MD5 hash type
-a 1 for a combination attack

SHA1
$ hashcat -m 100 -a 1 ./target_hashes.txt ./wordlist1 ./wordlist2

8. Rule Based Attack (watch the video to know more)
This type of attack is used to form patterns in passwords using certain rules. This will help to generate new passwords in our present wordlist instead of manually adding them.

For this method, we only need our original wordlist and a file containing the rules to form patterns.

A rule-based attack allows us to form patterns that are applied to existing passwords to quickly generate new passwords to use.
Create hashes
echo -n "efxtv" | openssl sha1
echo -n "efxtv" | openssl md5

$ hashcat -a 0 -m 0 hash.txt wordlist/wordlist.txt -r /usr/share/hashcat/rules/rockyourockyou-30000.rule
-r rules


9. Bruiteforce mode (Mask Attack)
Mask attacks are similar to brute-force attacks since they try out all possible combinations from a set of characters.

In brute-force attack, all possible characters that exist are tried out but Mask attacks are more specific as the set of characters you try is reduced based on the information you know.

For example, if you know the last character in a password is a number, you can configure your mask only to try numbers at the end.

We know about humans and how they design passwords. For example, the password I’m going to use: ‘zaq123’ is a name and a 3 digit number which is commonly used. Mostly lower-case letters will be used as the first letter in many passwords.

We will be using the built-in charsets (character sets) to specify what our password is like.

Hashcat -h
  l | abcdefghijklmnopqrstuvwxyz [a-z]
  u | ABCDEFGHIJKLMNOPQRSTUVWXYZ [A-Z]
  d | 0123456789                 [0-9]
  h | 0123456789abcdef           [0-9a-f]
  H | 0123456789ABCDEF           [0-9A-F]
  s |  !"#$%&'()*+,-./:;<=>?@[\]^_`{|}~
  a | ?l?u?d?s
  b | 0x00 - 0xff

  ?l?u?d
  a  A 0
  z  Z 9

  ?l?l?l?l?l?l?l?l  (all the passwords are in lower case)
  first pass set: aaaaaaaa
  		  baaaaaaa
		  caaaaaaa
		  daaaaaaa
		  eaaaaaaa
		  zaaaaaaa
		  abaaaaaa
		  acaaaaaa

These custom charsets are equal to:

-1 abcdefghijklmnopqrstuvwxyz

-2 abcdefghijklmnopqrstuvwxyz

ABCDEFGHIJKLMNOPQRSTUVWXYZ

0123456789

-3 0123456789

$ hashcat -a 3 -m 0 ./hash "?d?d?d?d"
-a 3 bruiteforce mode

Increment-min Increment-max
It will check for password minimum of 2 characters up to 3 characters
00
01
100
200
.
.
300
hashcat -a 3 -m 0 --increment --increment-min 2 --increment-max 3 hash ?d?d?d?d

-How Crack Windows 10
hashcat -m 1000 -a 0 ./samfile /usr/share/wordlists/rockyou.txt.gz

- Crack zip password
zip2john zipfile_having_password.zip >hashes
hashcat -m 17200 -a 0 -o found.txt ./ziphashes ~/Downloads/rockyou.txt
-o save output as
-m 17200 PKZIP (Compressed)

- Crack RAR password
rar2john rarfile_with_password.rar >hashes
hashcat -m 12500 -a 0 -o found.txt hashes.txt ~/Downloads/rockyou.txt

- Crack ssh password from rsa_key
ssh2john rsakeys >hashes.txt
john --wordlist=~/Downloads/rockyou.txt hashes

- Crack almost any hashes you can use John the Ripper tool
eg to extract hashes:
$ zip2john file_with_password.zip >hashes

Crack the hashes
$ john --wordlist=~/pathto/rockyou.txt ./hashes

John supports a list of hash generators:

john    			1password2john
7z2john 			adxcsouf2john
aem2john        	aix2john
andotp2john     	androidbackup2john
androidfde2john 	ansible2john
apex2john       	applenotes2john
aruba2john      	atmail2john
axcrypt2john    	bestcrypt2john
bitcoin2john    	bitshares2john
bitwarden2john  	bks2john
blockchain2john 	ccache2john
cisco2john      	cracf2john
dashlane2john   	deepsound2john
diskcryptor2john        dmg2john
DPAPImk2john    	ecryptfs2john
ejabberd2john   	electrum2john
encfs2john      	enpass2john
enpass5tojohn   	ethereum2john
filezilla2john  	geli2john
hccapx2john     	htdigest2john
ibmiscanner2john        ikescan2john
ios7tojohn      	itunes_backup2john
iwork2john      	kdcdump2john
keychain2john   	keyring2john
keystore2john   	kirbi2john
known_hosts2john        krb2john
kwallet2john    	lastpass2john
ldif2john       	libreoffice2john
lion2john       	lotus2john
luks2john       	mac2john
mcafee_epo2john 	monero2john
money2john      	mosquitto2john
mozilla2john    	multibit2john
neo2john        	office2john
openbsd_softraid2john   openssl2john
padlock2john    	pcap2john
pdf2john        	pem2john
pfx2john        	pgpdisk2john