Everybody and welcome to next video we're going to be working with hash cat.
Now we worked with John in the previous video John the Ripper and John Ripper's good for a quick pass
over something.
And sometimes with brute forcing.
But if you want to get the speed and power the most power and speed out of your password cracking on
your current machine what you're going to want to use is something called hash cap.
Now hash out crack and you using GP use to process everything and that can make things a tad bit quicker
when you're looking at the GP.
Now when you're working with hash cat it doesn't always take the exact same parameters or hashes or
the format of the hash as such as John does.
So if we look here we've got two new files we've got wind hash cat and Linux hash cat.
So we'll look at windows first.
We do cat windows hash cat we can see that this looks a little bit different than our windows hats or
the cat windows we can see this right here is actually the second half of our guest account.
Now you're going to want to use this half of it for hash cat.
In this example.
So this is what we're actually going to be needing.
So it's just a copy paste drop it in there now to run hash cat takes quite a few parameters.
So the first one is hash cat of course and then we have dash and now dash M is the mode in which the
type of hash that we're going to want to use depending on the hash you were going to have a different
number.
So to figure out what number it is we can do dash dash help.
And if you scroll to the top you'll start seeing a large set here.
So you can see here sevens of Sha 512 with a salt pass.
This is this number.
So if you're ever unfamiliar with which one you need for example empty five ten empty five zero half
empty five shell one so you just pick whatever number you need in our case we need a thousand so we'll
go ahead and close this up.
So hash tag dash M 1000 then we have dash 8 which tells us what type of action we want.
We want a dictionary based attacks.
This is 0.
The list of the other options are in the help function as well.
Then we're going to want our output so to win final.
So this is just the output wherever it's going to dump our cracked password and the hash that goes along
with it in this file.
Now we're going to do dash dash remove and we're going to give it when hash cat and what this is going
to do is every hash that it finds and breaks inside this file it'll go ahead and remove it from the
file.
So you just kind of have a solid running list especially if you've got a thousand in there.
It's a little bit easier to check the size of the file to know how many have been cracked rather than
staring at the screen the old so following that we're going to use a password file or a dictionary.
Models use the same one for John the Ripper it's completely fine.
Users share John password and now we're gonna do dash dash force and this is because we're on a VM so
it has to.
You just have to pick it just have it let it automatically be forced to pick a device whatever the default
doesn't go with that.
And if you're on a physical machine with a graphics card nobody else like that you won't need to worry
about dashboards.
So we'll go ahead and run this so we can see here boom boom done.
So it says status was cracked.
It went through thirty five hundred passwords and your little statistics here and there.
So if we look at our files here we can see we have one final sofa cat when final we can see our house
here and the plain text characters password which is indeed correct.
So we've gotten that all kind of sorted out on the window side.
Now the Linux side is a tad bit different because different Linux environments will use different hashing
algorithms for their passwords now to figure out what it is when you compromise your system you'll do
grep dash a 18 and encrypt method inside of ATC log in depths.
So when you do this you're looking for this right here.
So you're looking for this.
And the amount of rounds that have been set up but it doesn't look like these are actually set up.
So we're just going to focus on this right here.
So this means it's running as SHA 512.
And if we do hash cat dextrose help grep SHA 512 we can see we're looking for this right here.
Operating Systems SHA 512 crypt which is eighteen hundred so we'll go ahead and we can do the same thing
for the one thousand as well.
So you see here until then for operating systems.
So for Linux it's slightly different.
We if we take a look at our Linux hash cap we're just dumping in the file.
So this is the exact same data that's in the Linux dot hash just all the way at the bottom I described
admin so luckily for the Linux side of things you don't need to do anything special.
So hash cap dash I'm in the mode that we picked which was eighteen hundred dash a zero and the rest
of it should be pretty much the same.
We'll just do the output is Lin final and we're gonna do Linux hash cat.
Same word list
and we're not going to need dash dash force in this particular case because of the type of hashing function
that we're using because if we tried to do dash dash force you'll get
Oh I'm sorry the forces find forces needed but you won't be you won't be using the dash remove.
Otherwise you'll come into problems so if we did we'll leave that off.
But if you ran dash dash remove it would fail.
So we can see here it worked.
So we do Cat when final we can see we do indeed have the correct password here.
So getting familiar with hash cat does take a little bit of extra learning.
However it is a very very good thing to understand.
Being able to crack things two different ways because if John fails for whatever reason you can always
try brute forcing the password on hashtag.