Tagged: Password Cracking
8 posts · browse all tags
-
Password Cracking and Wordlist Engineering Part 1: The Hash Landscape and Why Offline Cracking Is a Different Game
Every post in the Impacket series ended with a hash. This one starts there: what NTLM, Kerberoast, and AS-REP hashes actually are, why offline cracking is a fundamentally different problem from an online login attempt, and the hash landscape the rest of this series works through.
-
Password Cracking and Wordlist Engineering Part 2: Hashcat Fundamentals and the GPU Economics of Cracking
Verified against a real hashcat v6.2.6 install and a published RTX 4090 benchmark run: the actual attack-mode syntax, the real mode numbers for NTLM, Kerberoast, and AS-REP, and what it genuinely costs — in dollars, not hand-waving — to exhaust a keyspace against each one.
-
Password Cracking and Wordlist Engineering Part 3: John the Ripper, Core vs Jumbo, and When to Reach for It
apt install john does not give you a tool that can crack a Kerberoast hash — verified firsthand, not assumed. The distinction between core John the Ripper and the Jumbo community fork, and the cases where JtR earns a place next to hashcat rather than duplicating it.
-
Password Cracking and Wordlist Engineering Part 4: Building Wordlists That Actually Work
rockyou.txt is fourteen million real, breached passwords from 2009 — and it's the wrong tool the moment a target has any pattern to its passwords at all. Verified cewl and crunch syntax for building wordlists that actually match how a specific organization names things.
-
Password Cracking and Wordlist Engineering Part 5: The Rule Engine, best64, and Writing Your Own Mutations
B4ckup$SQL2024 isn't in any wordlist — it's a wordlist entry plus a predictable transform. Walking hashcat's real, bundled best64.rule line by line, what its 102 rules actually do, and writing a custom rule for the one leetspeak substitution best64 doesn't cover.
-
Password Cracking and Wordlist Engineering Part 6: Mask and Hybrid Attacks, and the Keyspace Math Behind Them
No wordlist, no rules — masks build candidates character-position by character-position, and a 40,824-line "compliant password" mask set bundled with hashcat covers realistic complexity-policy shapes 65,000 times more efficiently than blind brute force. The keyspace math for why.
-
Password Cracking and Wordlist Engineering Part 7: Cracking CONTOSO.LOCAL End to End
Two hashes the Impacket series pulled off CONTOSO.LOCAL and stated the plaintext for without explaining how. This post runs the actual pipeline — baseline wordlist, OSINT-built vocabulary, custom rules, and a combinator-plus-hybrid chain — that gets from ciphertext to both passwords.
-
Password Cracking and Wordlist Engineering Part 8: The Defensive Mirror — Passphrases, KDFs, and Why Rotation Policies Miss the Point
Seven parts of offense, closing with the defense that actually follows from it: why bcrypt/scrypt/Argon2 cost tuning matters more than complexity rules, what NIST SP 800-63B Revision 4 actually changed about rotation, and what specifically would have stopped both CONTOSO.LOCAL cracks.