Romero Lab 1 Part 3 - Hashcat

Notes:

Task 1

┌──(kali㉿kali)-[~/Documents]
└─$ printf "Test1234" | sha256sum | awk '{print $1}' > hashes.txt

┌──(kali㉿kali)-[~/Documents]
└─$ cat hashes.txt
07480fb9e85b9396af06f006cf1c95024af2531c65fb505cfbd0add1e2f31573

Task 2

┌──(kali㉿kali)-[~/Documents]
└─$ cp /usr/share/wordlists/rockyou.txt.gz .

┌──(kali㉿kali)-[~/Documents]
└─$ gzip -d rockyou.txt.gz

┌──(kali㉿kali)-[~/Documents]
└─$ ls -l
total 136648
-rw-rw-r-- 1 kali kali        65 Mar 23 09:14 hashes.txt
-rw-r--r-- 1 kali kali 139921507 Mar 23 09:22 rockyou.txt

Task 3

┌──(kali㉿kali)-[~/Documents]
└─$ hashcat -a 0 -m 1400 -o cracked.txt hashes.txt rockyou.txt
hashcat (v7.1.2) starting

OpenCL API (OpenCL 3.0 PoCL 6.0+debian  Linux, None+Asserts, RELOC, SPIR-V, LLVM 18.1.8, SLEEF, DISTRO, POCL_DEBUG) - Platform #1 [The pocl project]
====================================================================================================================================================
* Device #01: cpu-haswell-Intel(R) Xeon(R) Gold 5318Y CPU @ 2.10GHz, 1466/2933 MB (512 MB allocatable), 2MCU

Minimum password length supported by kernel: 0
Maximum password length supported by kernel: 256

Hashes: 1 digests; 1 unique digests, 1 unique salts
Bitmaps: 16 bits, 65536 entries, 0x0000ffff mask, 262144 bytes, 5/13 rotates
Rules: 1

Optimizers applied:
* Zero-Byte
* Early-Skip
* Not-Salted
* Not-Iterated
* Single-Hash
* Single-Salt
* Raw-Hash

ATTENTION! Pure (unoptimized) backend kernels selected.
Pure kernels can crack longer passwords, but drastically reduce performance.
If you want to switch to optimized kernels, append -O to your commandline.
See the above message to find out about the exact limits.

Watchdog: Hardware monitoring interface not found on your system.
Watchdog: Temperature abort trigger disabled.

Host memory allocated for this attack: 512 MB (2417 MB free)

Dictionary cache built:
* Filename..: rockyou.txt
* Passwords.: 14344392
* Bytes.....: 139921507
* Keyspace..: 14344385
* Runtime...: 1 sec


Session..........: hashcat
Status...........: Cracked
Hash.Mode........: 1400 (SHA2-256)
Hash.Target......: 07480fb9e85b9396af06f006cf1c95024af2531c65fb505cfbd...f31573
Time.Started.....: Mon Mar 23 09:25:43 2026 (0 secs)
Time.Estimated...: Mon Mar 23 09:25:43 2026 (0 secs)
Kernel.Feature...: Pure Kernel (password length 0-256 bytes)
Guess.Base.......: File (rockyou.txt)
Guess.Queue......: 1/1 (100.00%)
Speed.#01........:  2507.2 kH/s (0.43ms) @ Accel:1024 Loops:1 Thr:1 Vec:8
Recovered........: 1/1 (100.00%) Digests (total), 1/1 (100.00%) Digests (new)
Progress.........: 1040384/14344385 (7.25%)
Rejected.........: 0/1040384 (0.00%)
Restore.Point....: 1038336/14344385 (7.24%)
Restore.Sub.#01..: Salt:0 Amplifier:0-1 Iteration:0-1
Candidate.Engine.: Device Generator
Candidates.#01...: Zechariah -> TEGLUSH4EVA

Started: Mon Mar 23 09:25:13 2026
Stopped: Mon Mar 23 09:25:44 2026

-a This option is the mode of attack, which is designated by a zero. This means that it will be a dictionary attack
-m This option is for the type of hash that it will be, which is designated by a 1400. This number is the code for SHA256 hashes.
-o This option tells the command to put the cracked hash output into the file “cracked.txt”
At this point, Hashcat will start to try to crack the hash that you have provided. After a couple of minutes, it will complete and put the output into the file “cracked.txt”. To check that hashcat did it successfully, type the following:

┌──(kali㉿kali)-[~/Documents]
└─$ ls
cracked.txt  hashes.txt  rockyou.txt

┌──(kali㉿kali)-[~/Documents]
└─$ cat cracked.txt
07480fb9e85b9396af06f006cf1c95024af2531c65fb505cfbd0add1e2f31573:Test1234

Task 4

┌──(kali㉿kali)-[~/Documents]
└─$ hashcat -a 0 -m 100 9a70e5557f85826cde208b0d11cd5a00ad4bc08f rockyou.txt
hashcat (v7.1.2) starting

OpenCL API (OpenCL 3.0 PoCL 6.0+debian  Linux, None+Asserts, RELOC, SPIR-V, LLVM 18.1.8, SLEEF, DISTRO, POCL_DEBUG) - Platform #1 [The pocl project]
====================================================================================================================================================
* Device #01: cpu-haswell-Intel(R) Xeon(R) Gold 5318Y CPU @ 2.10GHz, 1466/2933 MB (512 MB allocatable), 2MCU

Minimum password length supported by kernel: 0
Maximum password length supported by kernel: 256

Hashes: 1 digests; 1 unique digests, 1 unique salts
Bitmaps: 16 bits, 65536 entries, 0x0000ffff mask, 262144 bytes, 5/13 rotates
Rules: 1

Optimizers applied:
* Zero-Byte
* Early-Skip
* Not-Salted
* Not-Iterated
* Single-Hash
* Single-Salt
* Raw-Hash

ATTENTION! Pure (unoptimized) backend kernels selected.
Pure kernels can crack longer passwords, but drastically reduce performance.
If you want to switch to optimized kernels, append -O to your commandline.
See the above message to find out about the exact limits.

Watchdog: Hardware monitoring interface not found on your system.
Watchdog: Temperature abort trigger disabled.

Host memory allocated for this attack: 512 MB (2403 MB free)

Dictionary cache hit:
* Filename..: rockyou.txt
* Passwords.: 14344385
* Bytes.....: 139921507
* Keyspace..: 14344385

Approaching final keyspace - workload adjusted.

Session..........: hashcat
Status...........: Exhausted
Hash.Mode........: 100 (SHA1)
Hash.Target......: 9a70e5557f85826cde208b0d11cd5a00ad4bc08f
Time.Started.....: Mon Mar 23 09:36:22 2026 (4 secs)
Time.Estimated...: Mon Mar 23 09:36:26 2026 (0 secs)
Kernel.Feature...: Pure Kernel (password length 0-256 bytes)
Guess.Base.......: File (rockyou.txt)
Guess.Queue......: 1/1 (100.00%)
Speed.#01........:  3848.9 kH/s (0.21ms) @ Accel:1024 Loops:1 Thr:1 Vec:8
Recovered........: 0/1 (0.00%) Digests (total), 0/1 (0.00%) Digests (new)
Progress.........: 14344385/14344385 (100.00%)
Rejected.........: 0/14344385 (0.00%)
Restore.Point....: 14344385/14344385 (100.00%)
Restore.Sub.#01..: Salt:0 Amplifier:0-1 Iteration:0-1
Candidate.Engine.: Device Generator
Candidates.#01...:  kristenanne -> $HEX[042a0337c2a156616d6f732103]

Started: Mon Mar 23 09:36:05 2026
Stopped: Mon Mar 23 09:36:27 2026

Task 5

┌──(kali㉿kali)-[~/Documents]
└─$ mp64 ?d?d?s >> suffix.txt

mp64 = Maskprocessor
?d?d?s = Mask equivalent to 2 numbers + 1 special character
>> suffix .txt = Output to suffix.txt

┌──(kali㉿kali)-[~/Documents]
└─$ hashcat -a 1 -m 100 9a70e5557f85826cde208b0d11cd5a00ad4bc08f rockyou.txt suffix.txt

Output:

9a70e5557f85826cde208b0d11cd5a00ad4bc08f:gigemaggies25%

Session..........: hashcat
Status...........: Cracked
Hash.Mode........: 100 (SHA1)
Hash.Target......: 9a70e5557f85826cde208b0d11cd5a00ad4bc08f
Time.Started.....: Mon Mar 23 09:40:17 2026 (1 min, 54 secs)
Time.Estimated...: Mon Mar 23 09:42:11 2026 (0 secs)
Kernel.Feature...: Pure Kernel (password length 0-256 bytes)
Guess.Base.......: File (rockyou.txt), Left Side
Guess.Mod........: File (suffix.txt), Right Side
Speed.#01........: 12138.3 kH/s (11.13ms) @ Accel:84 Loops:1024 Thr:1 Vec:8
Recovered........: 1/1 (100.00%) Digests (total), 1/1 (100.00%) Digests (new)
Progress.........: 1380628032/47336470500 (2.92%)
Rejected.........: 0/1380628032 (0.00%)
Restore.Point....: 418320/14344385 (2.92%)
Restore.Sub.#01..: Salt:0 Amplifier:0-1024 Iteration:0-1024
Candidate.Engine.: Device Generator
Candidates.#01...: $HEX[67696d696c69303020] -> $HEX[676573736965333120]

Started: Mon Mar 23 09:40:02 2026
Stopped: Mon Mar 23 09:42:13 2026

Q1

Create a SHA256 hash for the password Password1234 using the method from Part 2.

Command used:

printf "Password1234" | sha256sum | awk '{print $1}' > newpasshash.txt

Paste the resulting 64-character hash below.

Options:

9f3d9f7c3a0c1c1d2e3e8c45a5b1d5f87c9b0f6c6cdb36805b97d2519d8cb12b
a0f3285b07c26c0dcd2191447f391170d6035e8d57e31a048ba87074f3a9a15
ef92b778bafe771e89245b89ecbc08a44a4e166c06659911881f383d4473e94f
a0f3285b07c26c0dcd2191447f391170d6035e8d57e31a048ba87074f3a9a15 -

Q2

What does the -a option mean in the hashcat command?

Explain what -a controls and what attack mode 0 and attack mode 6 represent.

The -a flag sets the "Attack Mode" (or attack type). Following the -a option, a number (0-9) is used to tell hashcat how to generate password candidates.

Attack mode 0 is the default dictionary attack. It takes a user-supplied wordlist (dictionary file) and tests each word against the target hashes.

Attack mode 6 is a Hybrid Attack that combines a wordlist with a mask attack. It specifically appends (adds to the end) characters generated by a mask to words from a dictionary.

Other attacks:

-a 0: Straight Dictionary
-a 1: Combination
-a 3: Brute-force
-a 6: Hybrid Wordlist + Mask
-a 7: Hybrid Mask + Wordlist

Q3

What does the -m option mean in the hashcat command?

Explain what -m specifies and provide the hash mode numbers for:

SHA256
SHA1

The -m option stands for "hash mode". It specifies the specific type or algorithm of the hash we are attempting to crack so that hashcat can use the correct algorithm to compute passwords.

From man hashcat:

Hash types
       0 = MD5
       10 = md5($pass.$salt)
       20 = md5($salt.$pass)
       30 = md5(unicode($pass).$salt)
       40 = md5($salt.unicode($pass))
       50 = HMAC-MD5 (key = $pass)
       60 = HMAC-MD5 (key = $salt)
       100 = SHA1
       110 = sha1($pass.$salt)
       120 = sha1($salt.$pass)
       130 = sha1(unicode($pass).$salt)
       140 = sha1($salt.unicode($pass))
       150 = HMAC-SHA1 (key = $pass)
       160 = HMAC-SHA1 (key = $salt)
       200 = MySQL323
       300 = MySQL4.1/MySQL5
       400 = phpass, MD5(Wordpress), MD5(phpBB3), MD5(Joomla)
       500 = md5crypt, MD5(Unix), FreeBSD MD5, Cisco-IOS MD5
       900 = MD4
       1000 = NTLM
       1100 = Domain Cached Credentials (DCC), MS Cache
       1400 = SHA256
       1410 = sha256($pass.$salt)
       1420 = sha256($salt.$pass)
       1430 = sha256(unicode($pass).$salt)
       1431 = base64(sha256(unicode($pass)))
       1440 = sha256($salt.unicode($pass))
       1450 = HMAC-SHA256 (key = $pass)
       1460 = HMAC-SHA256 (key = $salt)
       1600 = md5apr1, MD5(APR), Apache MD5
       1700 = SHA512
       1710 = sha512($pass.$salt)
       1720 = sha512($salt.$pass)
       1730 = sha512(unicode($pass).$salt)
       1740 = sha512($salt.unicode($pass))
       1750 = HMAC-SHA512 (key = $pass)
       1760 = HMAC-SHA512 (key = $salt)
       1800 = SHA-512(Unix)
       2400 = Cisco-PIX MD5
       2410 = Cisco-ASA MD5
       2500 = WPA/WPA2
       2600 = Double MD5
       3200 = bcrypt, Blowfish(OpenBSD)
       3300 = MD5(Sun)
       3500 = md5(md5(md5($pass)))
       3610 = md5(md5($salt).$pass)
       3710 = md5($salt.md5($pass))
       3720 = md5($pass.md5($salt))
       3800 = md5($salt.$pass.$salt)
...

Hash Mode Numbers (got from man hashcat)

SHA256: 1400
SHA1: 100

Q4

Where did you obtain the rockyou.txt wordlist in this lab?

Bonus: Provide the command you used to download it and explain why Ubuntu does not include it by default.

The rockyou.txt is built it to Kali by default and is found under /usr/share/wordlists/rockyou.txt.gz.

The command I used to copy it to the current working directory is:

cp /usr/share/wordlists/rockyou.txt.gz .

Then to unzip this file I used:

gzip -d rockyou.txt.gz

I believe Ubuntu will not include large wordlists like this one by default because they want to keep installation size minimal and wordlists are more like a specialized tool that is not required for general-purpose computing.

Q5

How are passwords stored on websites?

In 3–5 sentences, explain:

What a hash is
Why websites store hashes instead of plaintext passwords
Why hashes cannot be reversed directly

Answer:
When you create an account, a website takes your password and runs it through an algorithm to create a hash, which is essentially a unique, one-way digital fingerprint of your data. Instead of storing your actual password, sites store these hashes so that even if a hacker breaks into their database, they only see scrambled code rather than your actual login info. Because hashing is a one-way mathematical function, it’s designed to be impossible to reverse. To log you in, the site just hashes whatever you type and checks if that new fingerprint matches the one they have before.

Q6

What does the mask ?d?d?s represent in the hybrid attack?

Explain what each component means and describe the type of password pattern it generates.

The mask ?d?d?s is a placeholder string used to append or prepend specific character types to words from a dictionary.

Each component:

?d (Digit): Represents a single decimal digit (0-9).
?s (Special/Symbol): Represents a special character or symbol (e.g., !, @, #, $, %, etc.).

?d?d?s = Mask equivalent to 2 numbers + 1 special character

This mask is appended to a wordlist in a hybrid attack to generate things like:

password12!
etc.

Q7

What is the password recovered in Task 5 using the hybrid attack?

Provide the full recovered password.

The output from the hashcat command from above is:

9a70e5557f85826cde208b0d11cd5a00ad4bc08f:gigemaggies25%

Session..........: hashcat
Status...........: Cracked
Hash.Mode........: 100 (SHA1)
Hash.Target......: 9a70e5557f85826cde208b0d11cd5a00ad4bc08f
Time.Started.....: Mon Mar 23 09:40:17 2026 (1 min, 54 secs)
Time.Estimated...: Mon Mar 23 09:42:11 2026 (0 secs)
Kernel.Feature...: Pure Kernel (password length 0-256 bytes)
Guess.Base.......: File (rockyou.txt), Left Side
Guess.Mod........: File (suffix.txt), Right Side
Speed.#01........: 12138.3 kH/s (11.13ms) @ Accel:84 Loops:1024 Thr:1 Vec:8
Recovered........: 1/1 (100.00%) Digests (total), 1/1 (100.00%) Digests (new)
Progress.........: 1380628032/47336470500 (2.92%)
Rejected.........: 0/1380628032 (0.00%)
Restore.Point....: 418320/14344385 (2.92%)
Restore.Sub.#01..: Salt:0 Amplifier:0-1024 Iteration:0-1024
Candidate.Engine.: Device Generator
Candidates.#01...: $HEX[67696d696c69303020] -> $HEX[676573736965333120]

Started: Mon Mar 23 09:40:02 2026
Stopped: Mon Mar 23 09:42:13 2026

Password: gigemaggies25%