Advanced Offensive Security
Password Cracking (Hashcat & John)
Turn captured hashes into plaintext with wordlists, rules, and masks.
Attacks constantly yield password hashes — from databases, AD, captured handshakes, or JWTs. Cracking converts those hashes back to plaintext offline, at millions of guesses per second on a GPU.
Attack modes
- Dictionary — try every word in a wordlist (rockyou.txt is the classic).
- Rules — mutate wordlist entries (Password → P@ssw0rd!) to massively expand coverage.
- Mask / brute force — try all combinations matching a pattern, e.g. ?u?l?l?l?l?d?d.
- Combinator & hybrid — join words or append masks to words.
# Identify the hash type, then crack with a wordlist + rules
hashcat -m 0 hashes.txt rockyou.txt -r rules/best64.rule # -m 0 = MD5
john --wordlist=rockyou.txt --rules hashes.txt
# Mask attack: 8 chars, upper+lower+digits
hashcat -m 1000 ntlm.txt -a 3 ?u?l?l?l?l?l?d?d # -m 1000 = NTLM