Hash Cracking

---
name: Hash Cracking Workflow
description: |
  This skill should be used when the user asks about "crack hash", "identify hash",
  "hashcat", "john", "found hash", or needs to crack password hashes. Provides
  complete workflow from hash identification to cracking.
version: 1.0.0
---

# Hash Cracking Workflow

## Step 1: Identify Hash Type

### By Length
| Length | Possible Types |
|--------|----------------|
| 32 | MD5, NTLM |
| 40 | SHA1 |
| 56 | SHA224 |
| 64 | SHA256 |
| 96 | SHA384 |
| 128 | SHA512 |

### By Format
| Format | Type | Hashcat Mode |
|--------|------|--------------|
| `$1$salt$hash` | md5crypt | 500 |
| `$5$salt$hash` | sha256crypt | 7400 |
| `$6$salt$hash` | sha512crypt | 1800 |
| `$2a$`, `$2b$`, `$2y$` | bcrypt | 3200 |
| `$apr1$` | Apache MD5 | 1600 |
| `$P$` or `$H$` | phpass (WordPress) | 400 |

### Tools
```bash
# hashid
hashid '<HASH>'
hashid -m '<HASH>'  # Show hashcat mode

# hash-identifier
hash-identifier

# haiti (more accurate)
haiti '<HASH>'
```

## Step 2: Find Wordlist

### Common Locations
```bash
# Kali/Parrot
ls /usr/share/wordlists/rockyou.txt 2>/dev/null
zcat /usr/share/wordlists/rockyou.txt.gz > /tmp/rockyou.txt 2>/dev/null

# SecLists
ls /usr/share/seclists/Passwords/

# Custom locations
ls ~/wordlists/ /opt/wordlists/ 2>/dev/null
```

### Wordlist Priority
1. `rockyou.txt` - 14M passwords, good coverage
2. `top-passwords-shortlist.txt` - Quick check
3. Custom company/target wordlist
4. Rule-based mutations

## Step 3: Crack with Hashcat

### Common Modes
```bash
# MD5
hashcat -m 0 hash.txt /path/to/rockyou.txt

# NTLM (Windows)
hashcat -m 1000 hash.txt /path/to/rockyou.txt

# SHA1
hashcat -m 100 hash.txt /path/to/rockyou.txt

# SHA256
hashcat -m 1400 hash.txt /path/to/rockyou.txt

# sha512crypt ($6$)
hashcat -m 1800 hash.txt /path/to/rockyou.txt

# bcrypt
hashcat -m 3200 hash.txt /path/to/rockyou.txt

# Kerberoast
hashcat -m 13100 hash.txt /path/to/rockyou.txt

# AS-REP Roast
hashcat -m 18200 hash.txt /path/to/rockyou.txt
```

### With Rules (Better Coverage)
```bash
hashcat -m <MODE> hash.txt wordlist.txt -r /usr/share/hashcat/rules/best64.rule
```

### Check Cracked
```bash
hashcat -m <MODE> hash.txt --show
```

## Step 4: Alternative - John the Ripper

```bash
# Auto-detect format
john hash.txt --wordlist=/path/to/rockyou.txt

# Specific format
john --format=raw-md5 hash.txt --wordlist=/path/to/rockyou.txt
john --format=nt hash.txt --wordlist=/path/to/rockyou.txt

# Show cracked
john hash.txt --show
```

## Quick One-Liners

### MD5
```bash
echo "<HASH>" > /tmp/h.txt && hashcat -m 0 /tmp/h.txt /path/to/rockyou.txt --force
```

### NTLM
```bash
echo "<HASH>" > /tmp/h.txt && hashcat -m 1000 /tmp/h.txt /path/to/rockyou.txt --force
```

## Online Lookup (Faster)

For common hashes, try online databases first:
- CrackStation (crackstation.net)
- Hashes.com
- cmd5.com

```bash
# CrackStation API (if available)
curl -s "https://crackstation.net/crackstation-api.php?hash=<HASH>"
```

## Common Hash Sources

| Source | Command to Extract |
|--------|-------------------|
| Linux shadow | `cat /etc/shadow` |
| Windows SAM | `secretsdump.py -sam sam -system system LOCAL` |
| SQLite DB | `sqlite3 db.sqlite "SELECT * FROM users"` |
| MySQL | `SELECT user,password FROM mysql.user` |
| Web app config | Check config files for password fields |

## Performance Tips

```bash
# Use GPU
hashcat -m <MODE> hash.txt wordlist.txt -d 1

# Increase workload
hashcat -m <MODE> hash.txt wordlist.txt -w 3

# Skip slow rules on CPU
hashcat -m <MODE> hash.txt wordlist.txt --force

# Save session (resume later)
hashcat -m <MODE> hash.txt wordlist.txt --session=crack1
hashcat --restore --session=crack1
```