Hashcat
Last updated
Last updated
.
Hack the box Hashcat course on using Hashcat rocks!
Here is most hash modes that Hashcat supports.
Software to identify the different types of hashes
to scan potential words from the company's website and save them in a separate list.
The password cracking tool JohnTheRipper help us extract the password hashes from files etc, can be viewed .
There are also Python ports of most of these tools available that are very easy to work with. The majority of them are contained in the JohnTheRipper jumbo GitHub repo .
One additional tool ported to Python is tool for extracting a crackable hashes.
Hashcat can be used to attempt to crack password hashes extracted from some Microsoft Office documents using the tool.
Hashcat - Cracking MS Office Passwords
Extract Hash
Hashcat - Cracking ZIP Files
We can use keepass2john.py to extract the hash:
Extract Hash
Cracking Wireless (WPA and WPA2) Handshakes with Hashcat
To perform this type of offline cracking attack, we need to capture a valid 4-way handshake, by sending de-authentication frames to force a client (user) to disconnect from an AP. When the client reauthenticates (usually automatically), the attacker can attempt to sniff out the WPA 4-way handshake without their knowledge.
Hashcat-Utils - Installation
Cap2hccapx - Convert To Crackable File
Hashcat - Cracking WPA Handshakes
This attack can be performed against wireless networks that use WPA/WPA2-PSK (pre-shared key) and allows us to obtain the PSK being used by the targeted wireless network by attacking the AP directly. The attack does not require deauthentication (deauth) of any users from the target AP. The PMK is the same as in the MIC (4-way handshake) attack but can generally be obtained faster and without interrupting any users.
Hcxtools - Installation
To perform PMKID cracking, we need to obtain the pmkid hash. The first step is extracting it from the capture (.cap) file using the tool hcxpcaptool from the hcxtools GitHub repo.
We may run into compilation errors which can be solved as follows:
Missing Dependency - openssl/sha.h
Installation of Dependencies
Installation of Dependencies
Missing Dependency - curl/curl.h
Missing Dependency - curl/curl.h
Installation of Dependencies
Extract PMKID
There is as Change in Hash mode Hashcat 16800 So what are the benefits of hash mode 22000?
The hash mode 22000 hash line combines PMKIDs and EAPOL MESSAGE PAIRs in a single file
Having all the different handshake types in a single file allows for efficient reuse of PBKDF2 to save GPU cycles
It is no longer a binary format that allows various standard tools to be used to filter or process the hashes
It is no longer a binary format which makes it easier to copy / paste anywhere as it is just text
The best tools for capturing and filtering WPA handshake output in hash mode 22000 format (see tools below)
If you choose the online converter, you may need to remove some data from your dump file if the file size is too large. Most of the time, this happens when data traffic is also being recorded.
Optimized Kernels:
This is the -O flag, which according to the documentation, means Enable optimized kernels (limits password length). The magical password length number is generally 32, with most wordlists won't even hit that number. This can take the estimated time from days to hours, so it is always recommended to run with -O first and then rerun after without the -O if your GPU is idle.
Workload:
This is the -w flag, which, according to the documentation, means Enable a specific workload profile. The default number is 2, but if you want to use your computer while Hashcat is running, set this to 1. If you plan on the computer only running Hashcat, this can be set to 3.
Hybrid mode is a variation of the combinator attack, wherein multiple modes can be used together for a fine-tuned wordlist creation.
Mode 6 to append mask.
Mode 7 to prepend mask.
Tools :
Hashcat provides an option to generate random rules on the fly and apply them to the input wordlist. The following command will generate 1000 random rules and apply them to each word from rockyou.txt by specifying the "-g" flag. There is no certainty to the success rate of this attack as the generated rules are not constant
we may find an interesting zip file password protected! We can extract these hashes using the compiled version of the tool.
We can extract these hashes using the compiled version of the tool or using the Python port done by , .
We can extract the hash of the passphrase using . The following command will extract the hash into a format that Hashcat can use.
Once we have successfully captured a 4-way handshake with a tool such as , we need to convert it to a format that can be supplied to Hashcat for cracking, he format required is hccapxand Hashcat hosts an online service to convert to this format (not recommended for actual client data but fine for lab/practice exercises): . To perform the conversion offline, we need the hashcat-utils repo from GitHub.
hcxdumptool v6.0.0 or higher:
hcxpcapngtool from hcxtools v6.0.0 or higher:
hashcat v6.0.0 or higher:
Optionally there is hcxlabtool, which you can use as an experienced user or in headless operation instead of hcxdumptool:
For users who don't want to struggle with compiling hcxtools from sources there is an online converter:
For more information Visit this thread in Hashcat site ().
Mask attacks are used to generate words matching a specific pattern .
Common User Passwords Profiler ().
Advanced keyboard-walk with configureable basechars, keymap and routes.
Standalone password candidate generator using the PRINCE algorithm .
is a Custom Word List Generator.
Small utilities that are useful in advanced password cracking .
wordlist generator.
The attack is one of the most complicated of all the attack modes. The reason for this is very simple. The rule-based attack is like a programming language designed for password candidate generation. It has functions to modify, cut or extend words and has conditional operators to skip some, etc. That makes it the most flexible, accurate and efficient attack.
There are a variety of publicly available rules as well, such as the , , and the which is featured in the book . These are curated rulesets generally targeted at common corporate Windows password policies or based on statistics and probably industry password patterns.