> For the complete documentation index, see [llms.txt](https://d3ndr1t30x.gitbook.io/breaking-things-a-junior-pentesters-guide/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://d3ndr1t30x.gitbook.io/breaking-things-a-junior-pentesters-guide/password-cracking.md).

# Password cracking

### Cracking an MD5 file with John

```
sudo john --format=raw-md5 password.raw-md5
```

`sudo`: This command is being run with root privileges, which allows the user to have administrative access to the system.

`john`: This is the name of the command being executed.

`--format=raw-md5`: This option specifies the hash format of the password file being cracked. In this case, it is set to `raw-md5`, which indicates that the file contains MD5 hashes in their raw form.

`password.raw-md5`: This is the name of the password file being cracked. It is assumed to be in the `raw-md5` format due to the `--format` option.

### Using GPPdecrypt to crack passwords

```
gpp-decrypt <password>
```

### Using Hashcat to crack a SHA1 hash

```
hashcat -m 100 admin.sha1 /usr/share/wordlists/rockyou.txt --force
```

### Using keepass2john

```
keepass2john /path/to/your/keepass_database.kdbx > hashes.keepass
```

In this command:

* `/path/to/your/keepass_database.kdbx` should be replaced with the actual path to your KeePass 2 database file.
* `hashes.keepass` is the name of the output file where the extracted password hashes will be saved.

After running this command, you will have the password hashes stored in the `hashes.txt` file, which you can then use with password cracking tools like John the Ripper to attempt to recover the original passwords.

### Cracking keepass hashes with Hashcat

```
hashcat -m 13400 hashes.keepass /usr/share/wordlists/rockyou.txt
```

* `-m 13400`: This flag specifies the hash mode. In this case, `13400` represents the hash mode for KeePass 1 and KeePass 2 (AES/Twofish) password databases. Different hash modes are used for different types of hashes, and this mode is specifically for KeePass databases.
* `hashes.keepass`: This is the input file containing the password hashes you want to crack. It's assumed that this file contains the password hashes in a format compatible with the chosen hash mode (mode `13400` in this case). The `hashes.keepass` file should be a KeePass password database file from which you want to recover the passwords.
* `/usr/share/wordlists/rockyou.txt`: This is the path to the wordlist (dictionary) file used for password cracking. In this case, it's using the popular "rockyou.txt" wordlist, which is a common choice for password cracking due to its extensive list of passwords. Hashcat will attempt to crack the hashes in the `hashes.keepass` file by comparing them to the passwords in the wordlist.

### Searching for hash examples with Hashacat

```
hashcat --example-hashes | grep asrep
```

* `--example-hashes`: This is an option that tells `hashcat` to display a list of example hash types or formats that it supports. These example hashes are typically used as reference for understanding how different types of hashes look.
* `|`: This is a pipe symbol, and it's used to send the output of the command on its left to the input of the command on its right.
* `grep asrep`: This is a Unix command that is used to search for text patterns within a text file or input. In this case, you're using `grep` to search for lines in the output of `hashcat --example-hashes` that contain the text "asrep." It filters the list of example hashes to only show those that have "asrep" in their names.

### Cracking a Kerberos TGT with Hashcat

```
hashcat -m 18200 tgt.txt /usr/share/wordlists/rockyou.txt 
```

* `-m 18200`: This option specifies the hash mode or hash type. In this case, `18200` corresponds to the hash mode for Kerberos 5 TGT (Ticket Granting Ticket) hashes. Each hash mode represents a specific hashing algorithm and format.
* `tgt.txt`: This is the input file that contains the TGT hash you want to crack. It should be in a format that corresponds to the selected hash mode (in this case, Kerberos 5 TGT).
* `/usr/share/wordlists/rockyou.txt`: This is the path to the wordlist file that `hashcat` will use for the dictionary or wordlist attack. The "rockyou.txt" wordlist is a commonly used wordlist for password cracking because it contains a large number of common passwords and phrases.

### Using Zip2john

The command `zip2john backup.zip` is used for converting a password-protected ZIP file (`backup.zip`) into a format that can be used with John the Ripper, a popular password cracking tool. Here's a breakdown of the command:

* `zip2john`: This is the command you are running. It is part of John the Ripper, a password cracking tool used to recover lost or forgotten passwords. `zip2john` is a specific utility within John the Ripper that is designed to handle ZIP archive files.
* `backup.zip`: This is the name of the ZIP file you want to convert. Replace `backup.zip` with the actual name of the ZIP file you want to analyze. The purpose of running `zip2john` on this file is to extract information about the password hash used to protect the ZIP file.

The command `zip2john backup.zip 2>/dev/null` is a variation of the previous command `zip2john backup.zip` with some additional output handling. Here's a breakdown of the modified command:

* `zip2john`: This is the same command as in the previous breakdown. It's used to convert a password-protected ZIP file (`backup.zip`) into a format that can be used with John the Ripper for password cracking.
* `backup.zip`: This is the name of the ZIP file you want to convert, just like in the previous command.
* `2>/dev/null`: This part of the command deals with output redirection. Here's what it does:
  * `2>`: This is used for redirecting standard error (stderr).
  * `/dev/null`: `/dev/null` is a special file in Unix-like operating systems that essentially discards whatever is written to it. Redirecting stderr to `/dev/null` means that any error messages or diagnostic output produced by the `zip2john` command will be discarded and not displayed on the terminal.