Hashcat is the world’s fastest and most advanced password recovery tool that helps break complex password hashes. It is a flexible and feature-rich tool that offers many ways of finding passwords from hashes.
For those who don’t know password hashing is a process of using a hash function to convert a password into an unrecognizable series of characters like “1a1dc91c907325c69271ddf0c944bc72”.
This makes it difficult for malicious actors to gain access to the password, as the characters are not readable.
Install Hashcat
Hashcat comes pre-installed in Kali Linux. To install it in Debian-based systems, use the following command:
apt install hashcat
Once the installation is done, you can check Hashcat’s help menu using the hashcat -h command in the terminal.
Before cracking, let’s create some hashes to work with. There are many hashing algorithms like MD5, SHA1, SHA256, NTMLv2, and so on.
For this example, I will generate two hashes: A MD5 hash and a SHA256 hash for the password “letmein456” using an online tool.
0e88c5706dc5f028ac7c7d31d6cd1538 ==>MD5
b59717793d432dd2c4edf0c960948ef581d8499393aaef6214a5fbd4cb1c2e3d ==>SHA256
Here are the generated hashes for the password “letmein456”.
Crack the Hashes
In addition to Hashcat, you will also need a wordlist. A wordlist is a list of commonly used passwords in a text file. A popular password wordlist is rockyou.txt.
It contains a list of commonly used passwords and is popular among pen testers. You can find the rockyou wordlist under /usr/share/wordlists in Kali Linux.
Let’s crack the md5 hash first by copying the hash into a text file using nano.
nano md5hash.txt
Then use the following command to crack the hash.
hashcat -m 0 md5hash.txt rockyou.txt
-m 0: MD5 hash mode. You can see all codes on this page.
md5hash.txt: is the txt file containing the hash.
rockyou.txt:is the wordlist file.
The hash was successfully cracked and is “letmein456”.
Looks simple, doesn’t it. Now let’s crack the SHA256 hash. The hash mode value for SHA256 is 1400. Here is the command:
hashcat -m 1400 sha256hash.txt rockyou.txt
You can see that the status is “Cracked” and the “letmein456” password again. You can also crack multiple hashes by putting them in a text file.
nano hash-list.txt
Now run the following command.
hashcat -m 1400 -a 0 hash-list.txt rockyou.txt –o cracked.txt
hash-list.txt: is the text file containing multiple hashes.
cracked.txt: is the output text file for the cracked hashes.
To check the cracked hashes use the “cat” command in the terminal.
cat cracked.txt
Here you can see I have cracked three hashes.
Conclusion
Hashcat is a powerful tool that helps you to crack password hashes. To enforce security and protect hashes from attacks, use strong passwords with digits and special characters.
Tags: cybersecurity training, network security courses, ethical hacking tutorials, web penetration testing, linux security training, online cybersecurity classes, wireless network security, learn ethical hacking online, linux for cybersecurity professionals.