How to crack database hashes (HQ GUIDE FOR BEGGINERS)

[said550]

So you dumped a database but all the passwords are hashed? dont panic! in this tutorial i will show u step by step how to dehash passwords in kali linux
Leave a like if u found this tutorial helpfull!!!
Hashing is one of the pillars of cybersecurity. From securing passwords to sensitive data, there are a variety of use cases for hashing.
Hashing is often confused with encryption. A simple difference is that hashed data is not reversible. Encrypted data can be reversed using a key. This is why applications like Telegram use encryption while passwords are hashed.
In this article, we will look at installing and working with https://hashcat.net/hashcat/. Hashcat is a simple but powerful command line utility that helps us to – you guessed it – crack hashes.
We will first start by looking at how hashing works in detail.

Quote:Note: All my articles are for educational purposes. If you use this information illegally and get into trouble, I am not responsible. Always get permission from the owner before scanning / brute-forcing / exploiting a system.

What is Password Hashing?Hashing is the process of converting an alphanumeric string into a fixed-size string by using a hash function. A hash function is a mathematical function that takes in the input string and generates another alphanumeric string.

42f749ade7f9e195bf475f37a44cafcb

If we use the input string as “HelloWorld1234”, this will be the result:
Code:

850eaebd5c4bb931dbb2bbcf7994c021

Now there is a similar algorithm called encoding. A popular encoding algorithm is base64. Here is how the same “Password123” will look if we encode it with base64:
Code:

UGFzc3dvcmQxMjM=

So what is the difference between hashing and encoding? When we encode a string, it can be easily decoded to get the source string. But if we hash a string, we can never get to the source string (maybe with quantum computers, but that's another topic for discussion).
Hashing and encoding have different use cases. We can apply encoding to mask/simplify strings while hashing is used to secure sensitive data like passwords.
If hashes are not reversible, how would we compare the strings? Simple – we compare the hashes.
When we signup for a website, they will hash our password before saving it (hopefully!). When we try to log in again, the same hashing algorithm is used to generate a hash for our input. It is then compared with the original hash saved in the database.
This approach is also what gives rise to hashing attacks. A simple way to attack hashes is to have a list of common passwords hashed together. This list is called a https://en.wikipedia.org/wiki/Rainbow_table. Interesting name for a table of hashes.
Now that we know how hashing works, let's look at what Hashcat is.
What is Hashcat?Hashcat is a fast password recovery tool that helps break complex password hashes. It is a flexible and feature-rich tool that offers many ways of finding passwords from hashes.
Hashcat is also one of the few tools that can work with the GPU. While CPUs are great for sequential tasks, GPUs have powerful parallel processing capabilities. GPUs are used in Gaming, Artificial intelligence, and can also be used to speed up password cracking.
Here is the https://www.intel.in/content/www/in/en/products/docs/processors/cpu-vs-gpu.htmlif you want to learn more.
Other notable features of Hashcat include:

• Fully open source.
• Support for more than 200 hashing algorithms.
• Support for Windows, Linux, and Mac.
• Support for cracking multiple hashes in parallel.
• Built-in benchmarking system.

Now that we know what Hashcat is, let's go and install it.
How to Install HashcatHashcat comes pre-installed in Kali and Parrot OS. To install it in Ubuntu / Debian-based systems, use the following command:
Code:

$ apt install hashcat

To install it on a Mac, you can use https://brew.sh/. Here is the command:
Code:

$ brew install hashcat

For other operating systems, a full list of installation instructions can be https://hashcat.net/hashcat/

Loading…

hashcat.net

Once the installation is done, we can check Hashcat’s help menu using this command:
Code:

$ hashcat -h

,

, subdomain wordlist, and so on.
A popular password wordlist is

It contains a list of commonly used passwords and is popular among pen testers. You can find the Rockyou wordlist under /usr/share/wordlists in Kali Linux.
How to Work with HashcatNow that we know what hashing and Hashcat are, let’s start cracking some passwords.
Before cracking a hash, let's create a couple of hashes to work with. We can use a site like https://www.browserling.com/tools/all-hashes to generate hashes for input strings.
Let’s create two hashes: A MD5 hash and a SHA1 hash for the string “Password123”. I'm using a weak password to help you understand how easy it is to crack these passwords.
Here are the generated hashes for the input strings.
Code:

MD5 hash -> 42f749ade7f9e195bf475f37a44cafcb SHA1 hash -> b2e98ad6f6eb8508dd6a14cfa704bad7f05f6fb1

We can store these hashes under the names md5.txt and sha1.txt to use them when working with Hashcat.
To crack a password using Hashcat, here is the general syntax.
Code:

$ hashcat -m value -a value hashfile wordlist

Let’s dissect the syntax. We have used two flags,
Code:

-m

and
Code:

-a

. The
Code:

-m

flag is used to specify the hash type and the
Code:

-a

flag is to specify the attack mode. You can find the https://hashcat.net/wiki/doku.php?id=hashcat.Let’s crack our md5 hash first. We will crack this hash using the Dictionary mode. This is a simple attack where we provide a list of words (RockYou) from which Hashcat will generate and compare hashes.
We can specify the hash mode as “md5” using the value 0. But Hashcat can also identify the hash type automatically for common hash algorithms.
For the attack mode, we will be using the dictionary mode (0) using the flag
Code:

-a

. Here is the full command:
Code:

$ hashcat -m 0 -a 0 md5.txt rockyou.txt

Hashcat will quickly find the value for the hash, in this case, “Password123”:

$ hashcat -m 100 -a 0 sha1.txt rockyou.txt

And here is the output from Hashcat:

passpass pass123 passhello 123pass 123123 123hello hellopass hello123 hellohello

As you can see, using a simple wordlist can give us a number of combinations. This attack is great if we know some terms that might be used in the password. Keep in mind that, the larger the initial wordlist, the more complicated the final wordlist gets.
Mask attack (-a 3)The mask attack is similar to the dictionary attack, but it is more specific. Brute-force approaches like dictionary attacks can take a long time to crack a password. But if we have information regarding the password, we can use that to speed up the time it takes to crack the password.
For example, if we know the length of the password and a few characters that might be in the password, we can generate a custom wordlist with those characters.
The mask attack is out of scope for this tuotrial but i will definetly include it my later guides.
in addition to these common attack types, there are more attack modes in Hashcat. This includes Hybrid mode, Permutation attack, Rule-based attack, and so on. Each of these modes can be used for specific use cases and to speed up password cracking