Hashes
We might find passwords or other credentials in databases. These are often hashed, so we need to first identify which hash it is and then try to crack it. The first step is to identify the hash-algorithm that was used to hash the password.
There are generally speaking three pieces of data we can use to identify a hash.
In order to identify a hash we can either use specialized tools that analyze the hash and then return a guess on which algorithm it is. An easier way is of course to just look in the documentation of the software where you found the hashes. It usually says in the documentation or the source code which type of hash is being used.
In kali we can use hash-identifier or hashid:
hash-identifier
hashidjohn hashes.txt # Crack password hashes stored in hashes.txt
john --wordlist=wordlist.txt hashes.txt # Crack passwords using a wordlist
john --rules --wordlist=wordlist.txt hashes.txt # Apply word mangling rules to the wordlist
john --incremental hashes.txt # Perform incremental brute force attackjohn --format=md5 hashes.txt # Specify hash type as MD5
john --format=sha256 hashes.txt # Specify hash type as SHA256
john --format=bcrypt hashes.txt # Specify hash type as bcryptjohn --fork=4 hashes.txt # Run John with multiple threads (4 threads)
john --session=MySession # Specify session name for the cracking session
john --show # Show cracked passwords
john --format=dynamic hashes.txt # Detect hash type automaticallyjohn --test hashes.txt # Test hash cracking speed
john --make-charset=charset.txt # Generate custom character sethashcat -m 0 hashes.txt wordlist.txt # Crack MD5 hashes using a wordlist
hashcat -m 1000 hashes.txt wordlist.txt # Crack SHA256 hashes using a wordlist
hashcat -m 1800 hashes.txt wordlist.txt # Crack bcrypt hashes using a wordlisthashcat -m 0 -a 3 hashes.txt ?a?a?a?a # Brute force MD5 hashes using alphanumeric characters
hashcat -m 1000 -a 3 hashes.txt ?a?a?a?a?a # Brute force SHA256 hashes using alphanumeric characters
hashcat -m 1800 -a 3 hashes.txt ?a?a?a?a?a?a # Brute force bcrypt hashes using alphanumeric charactershashcat -m 0 -a 0 hashes.txt wordlist.txt -r rules/best64.rule # Apply rules from a rule file
hashcat -m 1000 -a 0 hashes.txt wordlist.txt -r rules/dive.rule # Apply specific rules from a rule file
hashcat -m 1800 -a 0 hashes.txt wordlist.txt -r rules/combinator.rule # Combine wordlist with wordlisthashcat --force # Ignore warnings and force hash cracking
hashcat --optimized-kernel-enable # Use optimized kernel for AMD/NVIDIA GPUs
hashcat --gpu-temp-disable # Disable temperature and fan speed checkshashcat --benchmark # Run a benchmark to measure hash cracking speed
hashcat --stdout # Output hash cracking results to stdout
hashcat --help # Display help message with all available optionszip2john protected.zip > ziphash.txtjohn --format=zip ziphash.txt --wordlist=/usr/share/wordlists/rockyou.txtfcrackzip -D -p /usr/share/wordlists/rockyou.txt 16162020_backup.zipssh2john id_rsa > id_rsa_hash.txtjohn id_rsa_hash.txt --wordlist=/usr/share/wordlists/rockyou.txtReference https://gist.github.com/h4rithd/0c5da36a0274904cafb84871cf14e271
python3 gitea3hashcat.py <gitea.db>import sqlite3
import base64
import sys
if len(sys.argv) != 2:
print("Usage: python3 gitea3hashcat.py <gitea.db>")
sys.exit(1)
try:
con = sqlite3.connect(sys.argv[1])
cursor = con.cursor()
cursor.execute("SELECT passwd_hash_algo,salt,passwd FROM user")
for row in cursor.fetchall():
if "pbkdf2" in row[0]:
algo, iterations, keylen = row[0].split("$")
algo = "sha256"
else:
raise Exception("Unknown Algorithm")
salt = bytes.fromhex(row[1])
passwd = bytes.fromhex(row[2])
salt_b64 = base64.b64encode(salt).decode("utf-8")
passwd_b64 = base64.b64encode(passwd).decode("utf-8")
print(f"{algo}:{iterations}:{salt_b64}:{passwd_b64}")
except Exception as e:
print(f"Error: {e}")
sys.exit(1)Última actualización