Skip to content
Pwnversity

hashcat & John

hashcat and John the Ripper are the reference password-cracking tools. hashcat uses the GPU (very fast); John excels on CPU and exotic formats. They’re used to audit passwords and in pentest/CTF to break captured hashes (see Hashing & cracking, Credential Dumping).

hashcat (GPU)

Section titled “hashcat (GPU)”
# structure: hashcat -m <mode> -a <attack> hashes.txt <dictionary/mask>
hashcat -m 0 hashes.txt rockyou.txt                 # MD5 + dictionary
hashcat -m 1000 ntlm.txt rockyou.txt -r rules/best64.rule   # NTLM + rules
hashcat -m 22000 hs.hc22000 rockyou.txt             # WPA/WPA2 (see wireless)
hashcat -m 1000 ntlm.txt -a 3 '?u?l?l?l?l?d?d'      # mask (structured brute force)
hashcat --identify hashes.txt                        # helps detect the mode

Common modes (-m)

Section titled “Common modes (-m)”
0      MD5           100    SHA1          1400   SHA256
1000   NTLM          1800   sha512crypt   3200   bcrypt
5600   NetNTLMv2 (responder, see ad-llmnr)   13100  Kerberoast TGS (see ad-kerberos)
18200  AS-REP (see ad-kerberos)              22000  WPA-PBKDF2 (see wireless)

Attack types (-a)

Section titled “Attack types (-a)”
0  dictionary (wordlist)          + rules (-r) for mutations
3  mask / brute force             ?l lower, ?u upper, ?d digit, ?s symbol, ?a all
6  hybrid wordlist+mask           7  hybrid mask+wordlist
# strategy: dictionary+rules first (cost-effective), masks after

John the Ripper

Section titled “John the Ripper”
john --wordlist=rockyou.txt --format=nt hashes.txt   # crack
john --show hashes.txt                                # see cracked
# "jumbo" brings hundreds of formats and *2john utilities (zip2john, ssh2john, etc.)
zip2john file.zip > hash ; john hash                  # break a password-protected zip

Rules and dictionaries

Section titled “Rules and dictionaries”
- rockyou.txt as a base; SecLists for more options
- rules (best64, dive, OneRuleToRuleThemAll) -> multiply the dictionary with mutations
- masks for known patterns (e.g. Company2024!) when the dictionary fails

Blue Team / use

Section titled “Blue Team / use”
  • hashcat (GPU) for volume; John (jumbo) for exotic formats and *2john utilities.
  • Strategy: dictionary + rules first (cost-effective), then masks by pattern.
  • For AD hashes (NetNTLMv2, Kerberoast, AS-REP) see ad-llmnr/ad-kerberos; for WPA, wireless.
  • Defense: Argon2/bcrypt and long passwords (Hashing & cracking) make cracking infeasible.

Tips and gotchas

Section titled “Tips and gotchas”
  • Identify the hash mode (-m) correctly first; the wrong mode won’t crack even a trivial password.
  • Start with dictionary + rules (best64, OneRuleToRuleThemAll) before pure brute force.
  • Common mistake: running it in a GPU-less VM; hashcat needs a real GPU. Use --status and --restore for long sessions.
  • For Kerberoasting/NTLM use the right modes (13100 TGS-REP, 1000 NTLM) and masks per the password policy.

Testing checklist

Section titled “Testing checklist”
  • Identify the hash type (—identify / hashid)
  • Choose the correct -m mode
  • Dictionary (rockyou) + rules (best64) first
  • Masks by pattern if the dictionary fails
  • AD/WPA formats with the right mode (ad-*/wireless)
  • John jumbo + *2john for zip/ssh/office
  • Verify defense: slow hashing + salt (Hashing & cracking)

References

Section titled “References”