hash-cracking-workflow

name	Hash Cracking Workflow
description	This skill should be used when the user asks about "crack hash", "identify hash", "hashcat", "john", "found hash", or needs to crack password hashes. Provides complete workflow from hash identification to cracking.
version	1.0.0

Hash Cracking Workflow

Step 1: Identify Hash Type

By Length

Length	Possible Types
32	MD5, NTLM
40	SHA1
56	SHA224
64	SHA256
96	SHA384
128	SHA512

By Format

Format	Type	Hashcat Mode
$1$salt$hash	md5crypt	500
$5$salt$hash	sha256crypt	7400
$6$salt$hash	sha512crypt	1800
$2a$, $2b$, $2y$	bcrypt	3200
$apr1$	Apache MD5	1600
$P$ or $H$	phpass (WordPress)	400

Tools

# hashid
hashid '<HASH>'
hashid -m '<HASH>'  # Show hashcat mode

# hash-identifier
hash-identifier

# haiti (more accurate)
haiti '<HASH>'

Step 2: Find Wordlist

Common Locations

# Kali/Parrot
ls /usr/share/wordlists/rockyou.txt 2>/dev/null
zcat /usr/share/wordlists/rockyou.txt.gz > /tmp/rockyou.txt 2>/dev/null

# SecLists
ls /usr/share/seclists/Passwords/

# Custom locations
ls ~/wordlists/ /opt/wordlists/ 2>/dev/null

Wordlist Priority

1. rockyou.txt - 14M passwords, good coverage
2. top-passwords-shortlist.txt - Quick check
3. Custom company/target wordlist
4. Rule-based mutations

Step 3: Crack with Hashcat

Common Modes

# MD5
hashcat -m 0 hash.txt /path/to/rockyou.txt

# NTLM (Windows)
hashcat -m 1000 hash.txt /path/to/rockyou.txt

# SHA1
hashcat -m 100 hash.txt /path/to/rockyou.txt

# SHA256
hashcat -m 1400 hash.txt /path/to/rockyou.txt

# sha512crypt ($6$)
hashcat -m 1800 hash.txt /path/to/rockyou.txt

# bcrypt
hashcat -m 3200 hash.txt /path/to/rockyou.txt

# Kerberoast
hashcat -m 13100 hash.txt /path/to/rockyou.txt

# AS-REP Roast
hashcat -m 18200 hash.txt /path/to/rockyou.txt

With Rules (Better Coverage)

hashcat -m <MODE> hash.txt wordlist.txt -r /usr/share/hashcat/rules/best64.rule

Check Cracked

hashcat -m <MODE> hash.txt --show

Step 4: Alternative - John the Ripper

# Auto-detect format
john hash.txt --wordlist=/path/to/rockyou.txt

# Specific format
john --format=raw-md5 hash.txt --wordlist=/path/to/rockyou.txt
john --format=nt hash.txt --wordlist=/path/to/rockyou.txt

# Show cracked
john hash.txt --show

Quick One-Liners

MD5

echo "<HASH>" > /tmp/h.txt && hashcat -m 0 /tmp/h.txt /path/to/rockyou.txt --force

NTLM

echo "<HASH>" > /tmp/h.txt && hashcat -m 1000 /tmp/h.txt /path/to/rockyou.txt --force

Online Lookup (Faster)

For common hashes, try online databases first:

• CrackStation (crackstation.net)
• Hashes.com
• cmd5.com

# CrackStation API (if available)
curl -s "https://crackstation.net/crackstation-api.php?hash=<HASH>"

Common Hash Sources

Source	Command to Extract
Linux shadow	cat /etc/shadow
Windows SAM	secretsdump.py -sam sam -system system LOCAL
SQLite DB	sqlite3 db.sqlite "SELECT * FROM users"
MySQL	SELECT user,password FROM mysql.user
Web app config	Check config files for password fields

Performance Tips

# Use GPU
hashcat -m <MODE> hash.txt wordlist.txt -d 1

# Increase workload
hashcat -m <MODE> hash.txt wordlist.txt -w 3

# Skip slow rules on CPU
hashcat -m <MODE> hash.txt wordlist.txt --force

# Save session (resume later)
hashcat -m <MODE> hash.txt wordlist.txt --session=crack1
hashcat --restore --session=crack1