Password cracking — hashcat & ecosystem

# Backends (CUDA/OpenCL/Metal)
hashcat -I

# Benchmark NTLM on all GPUs
hashcat -b -m 1000

# Wordlist attack
hashcat -m 1000 -a 0 hashes.txt /usr/share/wordlists/rockyou.txt

# Rules (best64)
hashcat -m 1000 -a 0 hashes.txt rockyou.txt -r /usr/share/hashcat/rules/best64.rule

# Mask brute (8 lower + 2 digit)
hashcat -m 1000 -a 3 hashes.txt '?l?l?l?l?l?l?d?d'

# Show cracked
hashcat -m 1000 hashes.txt --show

# Resume session
hashcat --session lab_ntlm -m 1000 -a 0 hashes.txt rockyou.txt
hashcat --restore --session lab_ntlm

# WPA PMKID (after hcxtools)
hcxpcapngtool -o capture.22000 wlan.pcapng
hashcat -m 22000 capture.22000 rockyou.txt

# Distributed brain server (multi-GPU rack)
hashcat --brain-server
hashcat -z --brain-client --brain-host 10.77.0.5 -m 1000 hashes.txt rockyou.txt

# Combinator attack prep
combinator wordlist1.txt wordlist2.txt > combined.txt
hashcat -m 1000 -a 1 hashes.txt wordlist1.txt wordlist2.txt

# Auto-detect format
john hashes.txt

# Explicit format
john --format=nt hashes.txt --wordlist=rockyou.txt

# Show cracked
john --show hashes.txt

# Rules
john --wordlist=rockyou.txt --rules=Jumbo hashes.txt

# SSH
hydra -l admin -P pass.txt ssh://10.77.0.50 -t 4

# RDP
hydra -l administrator -P pass.txt rdp://10.77.0.10

# SMB
hydra -L users.txt -P pass.txt smb://10.77.0.0/24

# HTTP POST form
hydra -l admin -P pass.txt 10.77.0.50 http-post-form "/login:user=^USER^&pass=^PASS^:F=invalid"

# Medusa parallel
medusa -h 10.77.0.50 -U users.txt -P pass.txt -M ssh -t 10

# Crawl site vocabulary
cewl -d 3 -m 6 https://lab-app.local/ -w cewl.txt

# Crunch pattern
crunch 10 10 -t Lab@@@@@@ -o lab_patterns.txt

# Extract from rockyou for rules testing
head -n 100000 /usr/share/wordlists/rockyou.txt > rockyou_100k.txt

1. Identify hash type: hash-identifier or hashcat --identify
2. Select -m and attack: wordlist → rules → mask
3. Run hashcat -w 3 --session CASE001 ...
4. Output --show results to JSON for MES ticket

{
  "hash_type": "NTLM",
  "mode": 1000,
  "cracked": 3,
  "total": 10,
  "method": "rockyou + best64.rule"
}