Cracking Hashes

During an engagement you often recover password hashes from databases, config files, or memory dumps. Cracking them confirms weak passwords and demonstrates real impact to the client.

Remember: hashing is one-way. You cannot reverse a hash directly. Instead you guess inputs, hash each guess, and compare to the target.

Before cracking you must know which algorithm produced the hash. Clues come from length and format:

• 32 hex chars likely MD5.
• 40 hex chars likely SHA-1.
• 64 hex chars likely SHA-256.
• Starts with $2b$ means bcrypt; $argon2 means Argon2.

Tools automate hash identification so you do not have to guess. hashid and hash-identifier analyze the format and suggest likely algorithms.

The output guides which mode number to pass to your cracking tool.

A dictionary (wordlist) attack tries every word in a list, hashing each and comparing. It is fast and catches the huge number of users who pick common passwords.

The famous rockyou.txt wordlist contains millions of real leaked passwords and is the default starting point for most cracks.

A brute force attack tries every possible character combination. It is guaranteed to eventually succeed but is exponential in cost.

You constrain it with a mask: for example, exactly 8 characters of lowercase plus digits. Masks make targeted brute forcing feasible when you know the password policy.

People modify base words predictably: 'password' becomes 'Password1!'. Rule-based attacks apply transformations (capitalize, append year, swap letters for numbers) to each wordlist entry.

This catches realistic human passwords without the cost of full brute force. The best64 ruleset is a popular efficient starting point.

hashcat is the leading GPU-accelerated cracker. It uses numeric mode codes per algorithm and an attack mode flag (-a 0 dictionary, -a 3 brute force).

GPUs make hashcat enormously faster than CPU cracking for fast hashes like MD5 and SHA.

John the Ripper is another classic cracker, strong on CPU and with broad format support. It often auto-detects the hash type.

John has handy helper tools like unshadow for combining Linux /etc/passwd and /etc/shadow into a crackable file.

Cracking speed depends heavily on the algorithm:

• A GPU can try billions of MD5 guesses per second.
• bcrypt or Argon2 might allow only a few thousand per second by design.

Salts also force you to crack each hash separately, removing the rainbow-table shortcut. This is exactly why defenders use salted, slow hashes.

For unsalted fast hashes, online databases like CrackStation hold precomputed lookups, often cracking common hashes instantly.

Ethics: only crack hashes you are authorized to test. Cracking real credentials without permission is illegal. In engagements, report cracked passwords as evidence of weak policy, never reuse them maliciously.

Before committing hours to a crack, estimate feasibility:

• Algorithm speed: MD5 cracks fast; bcrypt is slow by design.
• Password complexity: length and character set explode the keyspace.
• Hardware: a strong GPU rig dwarfs a laptop CPU.

If a salted bcrypt with a long random password will take centuries, pivot to other attack paths instead of brute forcing.

You captured a database dump. Decide the smartest first move.

You learned the hash-cracking workflow:

• Identify the algorithm by length/format using hashid.
• Escalate attacks by cost: dictionary, then rules, then masked brute force.
• Use hashcat (GPU) and John the Ripper (CPU, auto-detect).
• Salts and slow hashes (bcrypt, Argon2) dramatically reduce cracking speed.
• Always stay within authorization.

This completes Cryptography for Hackers. Next module: Anonymity and OPSEC.