Hashcat

Hashcat is a password "recovery" utility.

Background

Passwords are most often stored using one-way cryptographic hash functions.

Windows uses their own proprietary NTLM protocols.

Most UNIX systems use the more common SHA-512 algorithm.

Password storage is a critical responsibility. Systems today employ increasingly complex solutions, such as hash and salt.

Computing a large number of hashes is resource intensive. An alternative method is to use rainbow tables, which are large databases of pre-hashed data. This is a trade-off between reducing computational load for greater disk storage requirements.

---

Passwords can be brute-forced (trying every possible combination) or you can try a dictionary attack (testing specific words from a list).

The Metasploit frameworks provides a few wordlists, which can be founds in Kali under the directory /usr/share/metasploit-framework/data/wordlists.

Example

To guess what kind of hash you have, try hash-identifier.

hashcat -m 100 -a 0 -w 3 --status --status-timer=1 -o hashcat.out input.hash /usr/share/metasploit-framework/data/wordlists/unix_passwords.txt

Flag	Option	Parameter setting
-m 100	hash mode	SHA1
-a 0	attack mode	straight (dictionary attack)
-w 3	workload profile	high performance (higher resource consumption)
--status	display status	enable automatic update of the status screen
--status-timer=10	status timer	update status screen every 10 seconds
-o hashcat.out	outfile	write recovered hashes to hashcat-run0.out

Using input.hash as an input file, and /usr/share/metasploit-framework/data/wordlists/unix_passwords.txt as the dictionary.

Helpful links

1. https://www.samsclass.info/123/proj10/p12-hashcat.htm