Techzone/Offline Password Cracking Tools

Offline Password Cracking Tools

3 min readArticle

Offline cracking means you've already obtained password hashes and are cracking them locally — not touching the target. This is much faster (no network latency, no lockout risk) and is how most serious password cracking is done. You dump hashes, then crack on your own hardware.

How Offline Cracking Works

  1. Get the hashes — from a database dump, SAM file, /etc/shadow, captured handshake, NTDS.dit, etc.
  2. Identify hash type — MD5, NTLM, bcrypt, WPA, etc.
  3. Choose attack mode — dictionary, rules, brute force, combinator
  4. Crack — run the tool, wait for results

Tools

hashcat-password-cracking-guide — GPU Cracking (Primary Tool)

Hashcat is the gold standard. Uses GPU for massively parallel cracking.

bash 
# Dictionary attack on NTLM hashes
hashcat -m 1000 ntlm.txt rockyou.txt

# WPA/WPA2 handshake
hashcat -m 22000 handshake.hc22000 rockyou.txt -r best64.rule

# With rules for better coverage
hashcat -m 0 md5.txt rockyou.txt -r /usr/share/hashcat/rules/best64.rule

john-the-ripper-guide — CPU Cracking

John the Ripper — CPU-based, versatile, excellent for many formats Hashcat doesn't support well.

bash 
# Auto-detect format
john hashes.txt --wordlist=rockyou.txt

# Linux shadow file
john /etc/shadow --wordlist=rockyou.txt

# Windows SAM file (with system file)
john --format=NT --wordlist=rockyou.txt ntlm.txt

rainbow-crack — Pre-computed Tables

Rainbow tables trade storage space for cracking time. Less popular now that GPU cracking is fast.

bash 
# Generate tables (one-time cost, huge storage)
rtgen md5 loweralpha-numeric 1 7 0 3800 33554432 0

# Crack using tables
rcrack . -h 5f4dcc3b5aa765d61d8327deb882cf99

Getting Hashes

Windows

bash 
# Dump SAM database (local users)
secretsdump.py -sam SAM -system SYSTEM LOCAL

# Domain hashes (from DC — requires Domain Admin)
secretsdump.py domain/admin:password@DC-IP

# Cached credentials (DCC2)
secretsdump.py -ntds ntds.dit -system SYSTEM LOCAL

Linux

bash 
# /etc/shadow — requires root
sudo cat /etc/shadow

# Extract with unshadow (for John)
unshadow /etc/passwd /etc/shadow > combined.txt
john combined.txt --wordlist=rockyou.txt

Network Captures

bash 
# WPA/WPA2 handshake → see wifi-hacking notes
# Convert cap to hashcat format:
hcxpcapngtool -o hash.hc22000 capture.cap
hashcat -m 22000 hash.hc22000 rockyou.txt

# NTLM Net hashes from network capture
# Responder captures these
hashcat -m 5600 ntlmv2_hashes.txt rockyou.txt

Hash Identification

bash 
# Identify unknown hash
hashid '5f4dcc3b5aa765d61d8327deb882cf99'
hash-identifier  # interactive

# Example hash formats
# MD5:       $1$ or 32 hex chars
# SHA1:      40 hex chars
# SHA256:    64 hex chars
# NTLM:      32 hex chars (looks like MD5 but different context)
# bcrypt:    $2y$10$...
# SHA512crypt: $6$...

Common Hash Modes (Hashcat)

Hash Mode Notes
MD5 0 Very common, easy
SHA1 100 Common
SHA256 1400 Common
NTLM 1000 Windows local
NetNTLMv2 5600 Network capture
WPA/WPA2 22000 WiFi
bcrypt 3200 Very slow to crack
Kerberoast 13100 AD attacks

Wordlists to Use

  1. /usr/share/wordlists/rockyou.txt — start here
  2. crackstation.net wordlist — 15GB, very comprehensive
  3. Custom (CeWL, WYD, Crunch) — target specific
  4. SecLists — multiple curated lists

Sub-pages

  • hashcat-password-cracking-guide — Hashcat reference
  • john-the-ripper-guide — John the Ripper reference
  • rainbow-crack — RainbowCrack reference
techzonesite.comUnlock Your IT Potential