Cassage de hash

hashcat, john, DCC2.

Identifier le hash

hashid '<hash>'
hash-identifier
nth --text '<hash>'          # name-that-hash

Hashcat

hashcat -m <mode> hash.txt /usr/share/wordlists/rockyou.txt -r /usr/share/hashcat/rules/best64.rule

Modes fréquents

0=MD5   100=SHA1   1400=SHA256   1000=NTLM   3200=bcrypt
1800=sha512crypt ($6$)   500=md5crypt ($1$)   7400=sha256crypt
5600=NetNTLMv2   13100=Kerberoast (TGS)   18200=AS-REP   22000=WPA

John the Ripper

john --wordlist=/usr/share/wordlists/rockyou.txt hash.txt
john --show hash.txt
unshadow /etc/passwd /etc/shadow > unshadowed.txt

Convertir un fichier en hash (*2john)

ssh2john id_rsa > h ; zip2john f.zip > h ; keepass2john f.kdbx > h
office2john doc.docx > h ; pdf2john f.pdf > h