Password Cracking

Hashcat & John modes, hash identification, rules, masks & *2john tools

Password Cracking Cheat Sheet (Hashcat & John)

Identify a hash, pick the right mode, and crack it with Hashcat or John the Ripper — plus rules, masks, and the wordlists that actually work. For authorized testing only.

1. Identify the hash

hashid '$2y$10$...'          # or:
hash-identifier
nth --text '<hash>'          # name-that-hash

Common formats:

Looks like	Type	Hashcat -m
32 hex	MD5	0
40 hex	SHA1	100
64 hex	SHA-256	1400
$1$...	md5crypt	500
$6$...	sha512crypt (Linux shadow)	1800
$2[aby]$...	bcrypt	3200
aad3b...:...	NTLM	1000
$krb5tgs$...	Kerberoast TGS	13100
$krb5asrep$...	AS-REP	18200

2. Hashcat — the essentials

# Straight wordlist
hashcat -m 0 hashes.txt rockyou.txt

# Wordlist + rules (best ROI)
hashcat -m 0 hashes.txt rockyou.txt -r /usr/share/hashcat/rules/best64.rule

# Brute-force with a mask (8 chars: upper+lower+digit)
hashcat -m 0 hashes.txt -a 3 '?u?l?l?l?l?l?d?d'

# Show cracked results
hashcat -m 0 hashes.txt --show

Mask charsets: ?l a-z · ?u A-Z · ?d 0-9 · ?s symbols · ?a all.

3. John the Ripper

# auto-detect + wordlist
john --wordlist=rockyou.txt hashes.txt
# specify format
john --format=sha512crypt --wordlist=rockyou.txt hashes.txt
# rules
john --wordlist=rockyou.txt --rules=Jumbo hashes.txt
# show cracked
john --show hashes.txt

The *2john helpers (turn files into crackable hashes)

unshadow /etc/passwd /etc/shadow > hashes.txt   # Linux
zip2john secret.zip > hash.txt
rar2john file.rar > hash.txt
ssh2john id_rsa > hash.txt
office2john doc.docx > hash.txt
keepass2john db.kdbx > hash.txt

4. Wordlists & rules that work

/usr/share/wordlists/rockyou.txt          # start here, always
SecLists/Passwords/                       # huge curated set
best64.rule, OneRuleToRuleThemAll.rule    # rule files

Make a target-specific list with cewl (scrape the site) + hashcat rules.

5. Speed tips

• Crack on a GPU (hashcat -d 1), not a VM CPU.
• Slow hashes (bcrypt, sha512crypt) → use a focused wordlist + rules, not pure brute-force.
• --increment (John) / mask increment (Hashcat) for unknown lengths.

6. Defend against cracking

• Store passwords with bcrypt / scrypt / argon2 (slow, salted) — never MD5/SHA1.
• Enforce length over complexity; check against breached-password lists.
• Rate-limit + MFA so an offline crack is less useful.

Only crack hashes you're authorized to. Practice on the AYSEC crypto + forensics challenges. Pair with the Linux privesc and Windows privesc cheat sheets.