HashCat what is it, and how to use!

HashCat is hash cracking software that can be used on Windows, Mac and Linux. What is a hash? you might be asking. A hash is an encryption method to store your passwords. Lets take a quick look at what that looks like. Lets say you make an account on instagram and they use a MD5 hashing algorithm. You create a super strong password: P@ssw0rd. Then the server takes that and hashes your password to the following: 161ebd7d45089b3446ee4e0d86dbcf92. Now lets say you were a pentester and you were asked to pentest instagram. You hack away and eventually are able to exfiltrate a list of passwords, But oh no the passwords have been hashed. What do you do, well first things first you want to figure out what type of hash algorithm it is so that you can crack it. Luckily there is a tool that can help you its called “hashid”. Once you have hashid all you have to do is open a terminal and run the following commnand: hashid “HASH YOU WANT TO ID”. In this case it would look like this:

hashid 161ebd7d45089b3446ee4e0d86dbcf92

Once you hit enter you’ll get something like the following:

Analyzing '161ebd7d45089b3446ee4e0d86dbcf92'
[+] MD2
[+] MD5
[+] MD4
[+] Double MD5
[+] LM
[+] RIPEMD-128
[+] Haval-128
[+] Tiger-128
[+] Skein-256(128)
[+] Skein-512(128)
[+] Lotus Notes/Domino 5
[+] Skype
[+] Snefru-128
[+] NTLM
[+] Domain Cached Credentials
[+] Domain Cached Credentials 2
[+] DNSSEC(NSEC3)
[+] RAdmin v2.x

With that we can deduce the type of hash it is. Once we know the hash algorithm we can now try to crack it using hashcat. The command in hashcat to try and crack MD5 is as follwed:

hashcat -a 0 -m 0 161ebd7d45089b3446ee4e0d86dbcf92 wordlist.txt

Lets quickly break down the command.
-a or –attack-mode
-m or –hash-type (the numbers for hash type can be found here)
This will then run hashcat and attempt to crack the hash using a wordlist of your choice. What is nice about using hashcat over other tools like aircrack-ng is that hashcat can use GPU over only using CPU which can cut down cracking time quite alot. But cracking passwords is not the only thing hashcat can do, it can also crack password protected .zip files, .pdf, .word and more. You will have to convert the file to one that hashcat is comfortable with but that can easily be done using another tool like johntheripper (another password cracking tool). With all that being said Hashcat is a nice and easy tool to use. Happy hunting and only use the tool on applications you own or have been given the right to hack on!