Credential & hash cracking

When it applies

You've captured something crackable — an application DB hash, a Windows NTLM/NetNTLMv2 hash, a Kerberos ticket (ad-kerberoasting), or a WPA2 handshake — and the plaintext unlocks the next step (login, lateral movement, privesc). This is the offline counterpart to network-password-spraying.

Why it works

Most stored credentials are one-way hashes, but users pick guessable passwords and many hash schemes are fast to compute. Given the format, you brute the hash offline against a wordlist (optionally mutated by rules) at millions/billions of guesses per second — no lockout, no network.

Method

1. Identify the format first — this is the whole game. hashid/haiti on the sample, and look at the shape: $2b$ = bcrypt, $6$ = sha512crypt, $argon2 = Argon2, pbkdf2:sha256:... = Werkzeug PBKDF2, $krb5tgs$ = Kerberoast, $krb5asrep$ = AS-REP. A wrong mode wastes hours.

2. Map to the mode:

   Hash	hashcat -m
   MD5 / SHA1 / SHA-256 (raw)	0 / 100 / 1400
   bcrypt ($2*$)	3200
   sha512crypt ($6$)	1800
   NTLM	1000
   NetNTLMv2 (responder capture)	5600
   Kerberoast TGS-REP	13100
   AS-REP roast	18200
   Werkzeug PBKDF2-SHA256	10900
   WPA/WPA2 (hcxtools .22000)	22000

3. Extract a hash from a protected file when the "hash" is a locked artifact, then crack that: ssh2john id_rsa, zip2john f.zip, rar2john f.rar, keepass2john db.kdbx, office2john doc.docx, pdf2john f.pdf, pfx2john cert.pfx → feed the output to john/hashcat. An encrypted SSH key, Office doc, KeePass DB, or ZIP found on a target is often the fastest win.

4. Run wordlist + rules: hashcat -m <mode> hashes.txt rockyou.txt -r rules/best64.rule (start with best64, escalate to OneRuleToRuleThemAll). Add target-specific words (company, seasons, app names) to the wordlist — context beats a bigger dictionary. Build one with cewl <url> -m5 (words from the site), crunch (patterns), or username-anarchy (name → username permutations).

5. Mask/brute only when the keyspace is small or a pattern is known: hashcat -m <mode> hashes.txt -a 3 '?u?l?l?l?l?d?d!'.

6. Reuse and pivot — a cracked password is worth spraying elsewhere (network-password-spraying) and checking for reuse across accounts/services.

Gotchas

• Slow hashes (bcrypt/Argon2/sha512crypt) — a good rule + targeted wordlist beats raw brute; don't waste days masking a bcrypt.
• Format ambiguity — a 32-hex could be raw MD5 or NTLM; try the likely context (Windows → NTLM).
• Kerberoast/AS-REP must be captured in hashcat's exact $krb5*$ format — use Impacket/Rubeus output verbatim.
• WPA2 is -m 22000 now (the old -m 2500 .hccapx is deprecated) — convert with hcxpcapngtool.
• Handle cracked creds like live secrets — keep them in the git-ignored engagements/ tree; the report shows that a weak password existed, not a wall of plaintext.

Verify success

A recovered plaintext that authenticates against the intended service, or that demonstrably matches the captured hash — the concrete lead for the next step.

References

hashcat mode reference & rule sets; John the Ripper; hcxtools; MITRE ATT&CK T1110.002. Online counterpart: network-password-spraying.