bb-crack

Hash Cracking Command

Overview

Automates hash cracking workflow: identifies hash type, finds wordlists, and cracks with hashcat/john.

Workflow

Step 1: Identify Hash Type

# By length
# 32 chars = MD5 or NTLM
# 40 chars = SHA1
# 64 chars = SHA256

# By format
# $1$ = md5crypt (mode 500)
# $5$ = sha256crypt (mode 7400)
# $6$ = sha512crypt (mode 1800)
# $2a$/$2b$ = bcrypt (mode 3200)

# Using hashid
hashid '<HASH>'
hashid -m '<HASH>'  # Shows hashcat mode

Step 2: Find Wordlist

# Check common locations
WORDLIST=""
for path in \
    "/usr/share/wordlists/rockyou.txt" \
    "/usr/share/wordlists/rockyou.txt.gz" \
    "/usr/share/seclists/Passwords/Leaked-Databases/rockyou.txt" \
    "$HOME/wordlists/rockyou.txt"; do
    if [ -f "$path" ]; then
        WORDLIST="$path"
        break
    fi
done

# Extract if gzipped
if [[ "$WORDLIST" == *.gz ]]; then
    zcat "$WORDLIST" > /tmp/rockyou.txt
    WORDLIST="/tmp/rockyou.txt"
fi

echo "Using wordlist: $WORDLIST"

Step 3: Crack with Hashcat

# Save hash to file
echo "<HASH>" > /tmp/hash.txt

# Common modes
# 0 = MD5
# 100 = SHA1
# 1000 = NTLM
# 1400 = SHA256
# 1800 = sha512crypt
# 3200 = bcrypt

hashcat -m <MODE> /tmp/hash.txt "$WORDLIST" --force -o /tmp/cracked.txt

# Check result
cat /tmp/cracked.txt

Step 4: Alternative - John

echo "<HASH>" > /tmp/hash.txt
john --wordlist="$WORDLIST" /tmp/hash.txt
john --show /tmp/hash.txt

Quick Reference

Hash Type	Length/Format	Hashcat Mode
MD5	32 hex chars	0
SHA1	40 hex chars	100
SHA256	64 hex chars	1400
NTLM	32 hex chars	1000
md5crypt	$1$salt$hash	500
sha512crypt	$6$salt$hash	1800
bcrypt	$2a$/$2b$/$2y$	3200
Kerberos TGS	$krb5tgs$	13100
AS-REP	$krb5asrep$	18200

Examples

Crack MD5

hashcat -m 0 /tmp/hash.txt /path/to/rockyou.txt --force

Crack NTLM

hashcat -m 1000 /tmp/hash.txt /path/to/rockyou.txt --force