Password Cracking

Password Cracking

What is password cracking?

Recovering plaintext passwords by testing guesses against password hashes.

How can a low-value host compromise lead to access to high-value systems?

An attacker dumps hashes, cracks passwords, and reuses recovered credentials.

What tool does Book 3 use for offline password cracking?

Hashcat.

What hardware can Hashcat use to accelerate cracking?

Graphics processing units (GPUs).

What Hashcat feature modifies candidate words into password variants?

Its password mutation rules engine.

What MITRE ATT&CK tactic includes password cracking and credential dumping?

Credential Access (TA0006).

What MITRE ATT&CK ID covers Brute Force attacks?

T1110.

What MITRE ATT&CK ID covers OS Credential Dumping?

T1003.

Which Hashcat option specifies the attack mode?

-a

What is Hashcat attack mode -a 0?

Straight wordlist attack.

What does a straight attack test?

Each word in a dictionary as a candidate password.

What is the default Hashcat attack mode?

Straight (-a 0).

What is Hashcat attack mode -a 1?

Combinator attack.

How does a combinator attack generate candidate passwords?

Joins each word from the first wordlist with words from the second.

Can a Hashcat combinator attack use the same wordlist twice?

Yes.

What is Hashcat attack mode -a 3?

Brute-force mask attack.

What does a Hashcat mask attack require?

A pattern describing candidate password characters and positions.

What is Hashcat attack mode -a 6?

Hybrid wordlist plus mask; append mask characters.

What is Hashcat attack mode -a 7?

Hybrid mask plus wordlist; prepend mask characters.

What is the difference between -a 6 and -a 7?

Mode 6 appends the mask; mode 7 prepends it.

What is Hashcat association attack mode used for?

Testing password hints against salted hashes.

Which five attack modes are demonstrated in this module?

0, 1, 3, 6, and 7.

Which Hashcat option manually selects the hash type?

-m followed by its numeric mode.

What Hashcat hash mode represents NTLM?

-m 1000.

How do you list supported Hashcat hash types?

hashcat -h

How do you filter Hashcat help for Oracle hash modes?

hashcat -h | grep -i oracle

How do you ask Hashcat to identify a hash without cracking it?

hashcat --identify hashes.txt

What happens if Hashcat is run without -m?

It attempts to autodetect the hash type.

What clues can Hashcat use to identify a hash type?

Hash length and formatting markers.

What hash format begins with $5$?

SHA-256-crypt.

Can Hashcat crack multiple hash modes simultaneously?

No. It handles one hash mode at a time.

What can happen if a file contains multiple possible hash types?

Hashcat may ask you to select a hash mode.

Which command in the example originally dumped Windows password hashes?

meterpreter > hashdump

Where are the sample Windows cracking files on Slingshot Linux?

/home/sec504/labs/wincreds

What sample file contains the password hashes?

hashes.txt

What sample file contains candidate passwords?

words.txt

Which command performs the book’s straight NTLM wordlist attack?

hashcat -m 1000 -a 0 hashes.txt words.txt

In Hashcat, what does -m 1000 indicate?

NTLM password hashes.

In the straight attack command, what does words.txt supply?

Candidate passwords, one per line.

What does Status: Cracked indicate?

The target hash was successfully matched to a password.

What can limit the speed of a very large straight wordlist attack?

Disk input/output while reading the wordlist.

Which command combines two wordlists to crack NTLM hashes?

hashcat -m 1000 -a 1 hashes.txt words.txt words2.txt

What does -a 1 do with words.txt and words2.txt?

Appends each word from words2.txt to each word from words.txt.

What does Keyspace represent in Hashcat output?

The total candidate combinations to test.

If one wordlist has 100 words and another has 6, what is combinator keyspace?

600 candidates.

What does the Linux sequence \n mean within printf text?

A newline.

Why can a combinator attack be faster than a straight attack?

It generates combinations efficiently and can use GPU parallelism.

Which mask marker represents lowercase letters?

?l

Which mask marker represents uppercase letters?

?u

Which mask marker represents digits?

?d

Which mask marker represents special characters?

?s

Which mask marker represents lowercase, uppercase, digits, and special characters?

?a

What password pattern does ?u?l?l?l?l?l?d?d represent?

One uppercase, five lowercase, then two digits.

Why is knowing an organization’s password policy useful for a mask attack?

It narrows candidate patterns to likely password formats.

Does a Hashcat mask apply to any password length automatically?

No. Each mask specifies a particular length.

Which command runs the example eight-character NTLM mask attack?

hashcat -m 1000 -a 3 hashes.txt "?u?l?l?l?l?l?d?d"

What password did the book recover with its first mask example?

Tcpsyn02.

What does the mask ?u?l?l?l?l?l?l?s test?

One uppercase, six lowercase, then one special character.

Why can mask attacks achieve very high hash rates?

They generate candidates without repeatedly reading a wordlist.

Does the fastest hashes-per-second rate always mean the fastest completed attack?

No. A smaller wordlist keyspace may finish sooner.

What does Hashcat status Exhausted mean?

All candidates in the selected search space were tested.

Which command runs the hybrid wordlist-plus-mask example?

hashcat -m 1000 -a 6 hashes.txt words.txt "?s?d"

In -a 6, where are generated mask characters placed?

At the end of each wordlist entry.

What does ?s?d add to each word in -a 6?

A special character followed by a digit.

Which mode helps test passwords like Bengals! or Bengals1?

Hybrid wordlist plus mask (-a 6).

What does Guess.Mod: Mask show in the hybrid output?

The mask applied to the base wordlist.

Which command runs the book’s hybrid mask-plus-wordlist attack?

hashcat -m 1000 -a 7 hashes.txt "?d?d?d?d" words.txt

In -a 7, where are generated mask characters placed?

At the beginning of each wordlist entry.

What does the mask ?d?d?d?d prepend?

Four digits.

What password demonstrates -a 7 in the book?

0000Silvermine.

Why does the book say -a 7 is generally less common?

Users more often append than prepend complexity characters.

What is the Hashcat potfile?

A file recording cracked hashes and their plaintext passwords.

What is the potfile usually named?

hashcat.potfile

Name a typical Linux Hashcat potfile directory.

~/.hashcat or ~/.local/share/hashcat

Which Hashcat option displays passwords that were already cracked?

--show

Which Hashcat option shows hashes not yet cracked?

--left

Which Hashcat option includes username fields in output?

--username

Which command lists remaining NTLM hashes with usernames?

hashcat -m 1000 windows.hashes --left --username

Why does Hashcat record recovered hashes in the potfile?

To avoid recalculating previously cracked hashes.

Why should a Hashcat potfile be protected?

It contains sensitive plaintext passwords.

What is a common cause of the Hashcat error No hash-mode matches?

Input hash format does not match the expected hash mode.

What should you try if hashes contain usernames and Hashcat rejects them?

Try again with --username.

Which option helps diagnose a mismatched Hashcat hash mode?

--identify

How can you see a cracked password that Hashcat will not crack again?

Run Hashcat with --show.

Why should you preserve all fields of a captured hash?

Dropping fields can break format recognition and cracking.

What must you check when troubleshooting a failed Hashcat run?

Hash mode, full hash data, wordlist path, mask, and username handling.

What three defenses against cracking does the course describe?

Make hashes hard to crack, hard to obtain, or useless after compromise.

What authentication control does the course recommend against password attacks?

Multi-factor authentication (MFA).

Why does MFA reduce the value of a cracked password?

The attacker still needs another authentication factor.

Where should MFA be required according to the course?

On-premises systems and cloud applications.

Which VM is required for SEC504 Lab 3.3: Hashcat?

Slingshot Linux VM.

Where are the instructions for Lab 3.3?

The lab workbook.