Credential & hash cracking
When it applies
You've captured something crackable — an application DB hash, a Windows NTLM/NetNTLMv2 hash, a
Kerberos ticket (ad-kerberoasting), or a WPA2 handshake — and the plaintext unlocks the next step
(login, lateral movement, privesc). This is the offline counterpart to network-password-spraying.
Why it works
Most stored credentials are one-way hashes, but users pick guessable passwords and many hash schemes
are fast to compute. Given the format, you brute the hash offline against a wordlist (optionally
mutated by rules) at millions/billions of guesses per second — no lockout, no network.
Method
Identify the format first — this is the whole game. hashid/haiti on the sample, and look
at the shape: $2b$ = bcrypt, $6$ = sha512crypt, $argon2 = Argon2, pbkdf2:sha256:... =
Werkzeug PBKDF2, $krb5tgs$ = Kerberoast, $krb5asrep$ = AS-REP. A wrong mode wastes hours.
Map to the mode:
| Hash |
hashcat -m |
| MD5 / SHA1 / SHA-256 (raw) |
0 / 100 / 1400 |
bcrypt ($2*$) |
3200 |
sha512crypt ($6$) |
1800 |
| NTLM |
1000 |
| NetNTLMv2 (responder capture) |
5600 |
| Kerberoast TGS-REP |
13100 |
| AS-REP roast |
18200 |
| Werkzeug PBKDF2-SHA256 |
10900 |
WPA/WPA2 (hcxtools .22000) |
22000 |
Extract a hash from a protected file when the "hash" is a locked artifact, then crack that:
ssh2john id_rsa, zip2john f.zip, rar2john f.rar, keepass2john db.kdbx,
office2john doc.docx, pdf2john f.pdf, pfx2john cert.pfx → feed the output to john/hashcat.
An encrypted SSH key, Office doc, KeePass DB, or ZIP found on a target is often the fastest win.
Run wordlist + rules: hashcat -m <mode> hashes.txt rockyou.txt -r rules/best64.rule (start
with best64, escalate to OneRuleToRuleThemAll). Add target-specific words (company, seasons,
app names) to the wordlist — context beats a bigger dictionary. Build one with cewl <url> -m5
(words from the site), crunch (patterns), or username-anarchy (name → username permutations).
Mask/brute only when the keyspace is small or a pattern is known:
hashcat -m <mode> hashes.txt -a 3 '?u?l?l?l?l?d?d!'.
Reuse and pivot — a cracked password is worth spraying elsewhere (network-password-spraying)
and checking for reuse across accounts/services.
Gotchas
- Slow hashes (bcrypt/Argon2/sha512crypt) — a good rule + targeted wordlist beats raw brute;
don't waste days masking a bcrypt.
- Format ambiguity — a 32-hex could be raw MD5 or NTLM; try the likely context (Windows → NTLM).
- Kerberoast/AS-REP must be captured in hashcat's exact
$krb5*$ format — use Impacket/Rubeus
output verbatim.
- WPA2 is
-m 22000 now (the old -m 2500 .hccapx is deprecated) — convert with hcxpcapngtool.
- Handle cracked creds like live secrets — keep them in the git-ignored
engagements/ tree; the
report shows that a weak password existed, not a wall of plaintext.
Verify success
A recovered plaintext that authenticates against the intended service, or that demonstrably matches
the captured hash — the concrete lead for the next step.
References
hashcat mode reference & rule sets; John the Ripper; hcxtools; MITRE ATT&CK T1110.002.
Online counterpart: network-password-spraying.
1---2name: network-credential-cracking3description: Crack hashes and handshakes captured during an engagement — identify the format, pick the right hashcat/john mode, and run wordlist + rules. Load when you've recovered a hash, ticket, or handshake and need the plaintext. Signals: bcrypt $2b$/PBKDF2/sha512crypt $6$, NTLM/NetNTLMv2, Kerberos $krb5tgs$/$krb5asrep$, WPA2 .22000, a leaked DB hash column, "what hashcat mode".4---56# Credential & hash cracking78## When it applies9You've captured something crackable — an application DB hash, a Windows NTLM/NetNTLMv2 hash, a10Kerberos ticket (`ad-kerberoasting`), or a WPA2 handshake — and the plaintext unlocks the next step11(login, lateral movement, privesc). This is the offline counterpart to `network-password-spraying`.1213## Why it works14Most stored credentials are one-way hashes, but users pick guessable passwords and many hash schemes15are fast to compute. Given the format, you brute the hash offline against a wordlist (optionally16mutated by rules) at millions/billions of guesses per second — no lockout, no network.1718## Method191. **Identify the format first — this is the whole game.** `hashid`/`haiti` on the sample, and look20 at the shape: `$2b$` = bcrypt, `$6$` = sha512crypt, `$argon2` = Argon2, `pbkdf2:sha256:...` =21 Werkzeug PBKDF2, `$krb5tgs$` = Kerberoast, `$krb5asrep$` = AS-REP. A wrong mode wastes hours.222. **Map to the mode:**2324 | Hash | hashcat `-m` |25 |------|:---:|26 | MD5 / SHA1 / SHA-256 (raw) | 0 / 100 / 1400 |27 | bcrypt (`$2*$`) | 3200 |28 | sha512crypt (`$6$`) | 1800 |29 | NTLM | 1000 |30 | NetNTLMv2 (responder capture) | 5600 |31 | Kerberoast TGS-REP | 13100 |32 | AS-REP roast | 18200 |33 | Werkzeug PBKDF2-SHA256 | 10900 |34 | WPA/WPA2 (hcxtools `.22000`) | 22000 |35363. **Extract a hash from a protected file** when the "hash" is a locked artifact, then crack that:37 `ssh2john id_rsa`, `zip2john f.zip`, `rar2john f.rar`, `keepass2john db.kdbx`,38 `office2john doc.docx`, `pdf2john f.pdf`, `pfx2john cert.pfx` → feed the output to john/hashcat.39 An encrypted SSH key, Office doc, KeePass DB, or ZIP found on a target is often the fastest win.404. **Run wordlist + rules:** `hashcat -m <mode> hashes.txt rockyou.txt -r rules/best64.rule` (start41 with `best64`, escalate to `OneRuleToRuleThemAll`). Add target-specific words (company, seasons,42 app names) to the wordlist — context beats a bigger dictionary. Build one with `cewl <url> -m5`43 (words from the site), `crunch` (patterns), or `username-anarchy` (name → username permutations).445. **Mask/brute** only when the keyspace is small or a pattern is known:45 `hashcat -m <mode> hashes.txt -a 3 '?u?l?l?l?l?d?d!'`.466. **Reuse and pivot** — a cracked password is worth spraying elsewhere (`network-password-spraying`)47 and checking for reuse across accounts/services.4849## Gotchas50- **Slow hashes (bcrypt/Argon2/sha512crypt)** — a good rule + targeted wordlist beats raw brute;51 don't waste days masking a bcrypt.52- **Format ambiguity** — a 32-hex could be raw MD5 or NTLM; try the likely context (Windows → NTLM).53- **Kerberoast/AS-REP** must be captured in hashcat's exact `$krb5*$` format — use Impacket/Rubeus54 output verbatim.55- **WPA2** is `-m 22000` now (the old `-m 2500 .hccapx` is deprecated) — convert with `hcxpcapngtool`.56- **Handle cracked creds like live secrets** — keep them in the git-ignored `engagements/` tree; the57 report shows *that* a weak password existed, not a wall of plaintext.5859## Verify success60A recovered plaintext that authenticates against the intended service, or that demonstrably matches61the captured hash — the concrete lead for the next step.6263## References64hashcat mode reference & rule sets; John the Ripper; `hcxtools`; MITRE ATT&CK T1110.002.65Online counterpart: `network-password-spraying`.
NoorQureshi