Hack Forums
Cracking Hashes - How-to's and What-Nots [Pics|Vids|Downloads] - Printable Version

+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Grayhat • Purple Team • Hybrid Security (https://hackforums.net/forumdisplay.php?fid=449)
+---- Forum: Beginner Hacking (https://hackforums.net/forumdisplay.php?fid=4)
+----- Forum: Hacking Tutorials (https://hackforums.net/forumdisplay.php?fid=47)
+----- Thread: Cracking Hashes - How-to's and What-Nots [Pics|Vids|Downloads] (/showthread.php?tid=588963)

Pages: Pages 1 2 3 4 5 6 7 8 9 10

Cracking Hashes - How-to's and What-Nots [Pics|Vids|Downloads] - Ugleh - Aug 4, 2010

1. Intro
Ive seen a few requests for people to crack hashes, and some people aren't doing it right, just leaving a hash is not enough to help us help you.
This tutorial will walk threw the basics and try and help you out in your future of hashing.

2. Hashes
It is common practice for most web programmers to secure passwords by storing the encrypted value of the password in a database, because if they don't they risk a major security flaw which can harm their customers and themselves.

Hashes are also known as Cryptography, in a way.
Some hashes can decode on purpose, while others you need to brute force.
An example of encryption that allows decoding is Base64.

2.1 Need-To-Know's about Hashes

Widely used Hash Types include:
MD5 | SHA-1 | SHA-2
This means these 3 are the ones you need to be looking into when you grab a hash.
Quote:Type | Word Size| Collision |
MD5 | 32 | | Yes |
SHA-1 | 32 | Yes |
SHA-2 | 64 | No |

2.1.1 Hash Collisions
From the graph I made above you can see MD5 and SHA-1 have Hash Collisions. This means that more then 1 value can equal the same hash value.
This is common sense seeing as MD5 and SHA-1 are both 32 Characters long, and there is a limit of how many 32 random characters you can make, I mean it isnt infinite. So their aught to be a Collision at some point.
Code
H(a) = H(b)
H representing the hash function.

3 Hash Decrypt Sites
many sites host services where you can md5 encode whatever you want, but at the same time this service saves both values for later.
So be aware when you use these services your md5 input and output will be saved in their database for their "md5 decode" service.

A list of Hash Decrypt Sites you can use.

- http://www.cmd5.com/english.aspx (457,354,352,282)
- http://www.md5crack.com
- http://www.hashchecker.com
- http://md5cracker.tk/ (MD5 Search engine by searches a total of 14 on-line crackers.)
- http://www.md5decrypter.com (5,889,729)
- http://www.md5oogle.com
- http://md5-db.com (The database is approximately 70gb)
- http://md5.rednoize.com (56,502,235)
- http://gdataonline.com/seekhash.php (3,251,106)
- http://www.tmto.org/?category=main&page=search_md5 (306.000.000.000)
- http://www.milw0rm.com/cracker/insert.php (Milw0rm Cracker db)
- http://blacklight.gotdns.org/cracker/crack.php (2,456,288)
- http://www.shell-storm.org/md5 ( The data base currently contains 169582 passwords )
- http://md5.xpzone.de (Need Account)
- http://passcracking.com/ (Register to increase your priority)
- http://www.xmd5.org

4 Brute Forcing
Most secure CMS's (Content Management Systems) use Salts and different algorithms.
an example is
Quote:Common: md5($password);
PHP-Fusion: md5(md5($password));
VBulliten: md5(md5($password).$salt);
MyBB: md5(md5($salt).$password);
Knowing the Hash + Hash Algorithm is needed when requesting help on cracking a hash.

Recommended Brute Forcing Programs
HashCat
http://hashcat.net/hashcat/
[Image: rYuWLU0.png]
HashCat = Linux
HashCat GUI = Windows.
PasswordsPro
http://www.insidepro.com/eng/passwordspro.shtml
[img]http://www.insidepro.com/passwordspro.jpg[/img]

4.1 WordLists
To brute force passwords its common sense you need a list of words.
Depending on the site of your CPU it all depends on how much space you want to use.
You can look at all the different word lists here
http://hashcrack.blogspot.com/p/wordlist-downloads.html
http://www.net-comber.com/wordurls.html

OR Download the wordlists I used in the HashCat video above.
NamesNumbers - 4MB - 4000800 Words
Quote:Really useful list, it provides top 200 popular male and female names followed by numbers.
Jacob
Jacob0
Jacob1
Jacob2
....
Jacob1000

28GB Wordlist - 28GB - 4103549326 Words
Quote:I Opened this up and it looked pretty useless as well as a waist of time to look threw. Around 28GB of just 6-7 characters long with special characters, letters, and numbers. Like ()D@WFOWI.

wordlist1 - 107MB - 9657365 Words
Quote:This file contains alot of number combination's as well as common passwords. This has gotten me afew cracks in the past.

UrbanDictionarySlangA-Z - 26KB - 3087 Words
Quote:I took the time and copying and pasting the top popular A-Z Urban Dictionary words, because some people use slang terms like faggot and cumdumpster as a password.

Last Resort
If this tutorial doesn't help you or teach you how to crack hashes, then you can post a thread, but before you post a thread look at this layout:
Quote:Hash:
Hash Algorithm(if known):
Salt (if any):
CMS(if known):


* - eXeSoul™ - Aug 4, 2010

Nice and easy tut mate :-)

* - Ugleh - Aug 4, 2010

(Aug 4, 2010 01:57 PM)eXeSoul™ Wrote:  Nice and easy tut mate :-)

thanks :)
It looks like something someone would get easily, then be pro haxor in a week xD

* - Suma - Aug 4, 2010

Great first tut, gotta luv the info and breakdown. Nice list
of decrypt sites too.

* - Ugleh - Aug 4, 2010

(Aug 4, 2010 06:20 PM)Suma Wrote:  Great first tut, gotta luv the info and breakdown. Nice list
of decrypt sites too.

Thanks, if you watch the video, off recording i got like 3/4th of the database passwords.

* - Suma - Aug 4, 2010

(Aug 4, 2010 06:27 PM)Ugleh Wrote:  Thanks, if you watch the video, off recording i got like 3/4th of the database passwords.

Yep, also picked them up :)
I must of got carried away cause I think I went through that whole UrbanDictionary list.

* - helpforhack - Aug 4, 2010

sweet alot of help to me hopefully i will learn more

* - MiikexD - Aug 4, 2010

Good tut. You can also use John the Ripper for DES Hashes. I like how you wrote this though, this will definitely help the guys just getting into hacking.

* - Prank Calling - Aug 4, 2010

Thanks man short and sweet and to the point.

* - Ugleh - Aug 5, 2010

np, i kind of find it a downer how like 200 people read this thread but only a rare few actually commented on if it helped them or not, i ask cuz i might make more informal stuff like this.

* - Relikk - Aug 11, 2010

This is really for beginners.

The most of the hashes are based on an one-way function.. you can not decode it. You can try to crack it which means you check words if they match..

Code
pass1 -> hash ≠ hash
pass2 -> hash ≠ hash
pass3 -> hash = hash
= pass3

Quote:Knowing the Hash + Hash Algorithm is needed when requesting help on cracking a hash.
This is wrong. You jsut need more time to crack it. You can crack a few algorithms so fast without knowing the salt.👹

Quote:Recommended Brute Forcing Programs
Bruteforcing on CPU?🙃 Welcome to 2010. Did you ever heard of GPU which is more than x100 faster then CPU?👍

Quote:To brute force passwords its common sense you need a list of words.
If you download all listed wordlists you waste time and space. I generate them way faster on my CPU/GPU.😝

My opinion about this:
- hashcat wasn't made to help kids who try to steal accounts and other stuff
- If you are able to get a hash you should know what it is used for and you should know what to do with it.
- If you try to destroy the work of others just stop, please.

* - Ugleh - Aug 11, 2010

Relikk before you try to prove me wrong, how about you read the thread. You got 3 posts and is trying to prove me wrong.

HashCat is GPU not CPU, obviously you didn't see that. HashCat is based on a command prompt. What it does is you input what you want in the GUI and it goes into console.

as for knowing the Hash Algorithm, obviously you need to know it. You cant say please crack this hash, when it could be any algorithm, i.e md5(md5($pass).md5(md5($pass)))
IF it was that, and someone asked me to crack a hash, I WOULD NEVER think to input that has the hash type.

As for the wordlist, I don't care what you do it is common scene you need a word list. You cant generate every common word on your CPU and thats what you aren't cracking any passes while I am.

* - Relikk - Aug 11, 2010

Quote:You got 3 posts and is trying to prove me wrong.
The post count is important? 🙃 I just registered on this board.

Quote:HashCat is GPU not CPU, obviously you didn't see that.
Wrong again. 🤮
hashcat is CPU. http://hashcat.net/hashcat/
oclhashcat is GPU http://hashcat.net/oclhashcat/

Quote:as for knowing the Hash Algorithm, obviously you need to know it
No 😅 You don't need to know the salt. You will need more time to crack it but you don't need to know it.
Prove at youtube: http://www.youtube.com/watch?v=DLEYQCzoxVo
Of course it works with others too..

Quote:You cant generate every common word on your CPU and thats what you aren't cracking any passes while I am.
I never said I don't use wordlsits. I just said the most of them are useless.

For example this:
Quote:Jacob
Jacob0
Jacob1
Jacob2
You could use rules to add a number behind each word.

* - Ugleh - Aug 11, 2010

Or you can simply use a wordlist and it'll go faster then a generator making them for you.

And yea it might take longer to crack, but its much easier to post the algorithm if the person knows it.

and Hashcat has a GPU and CPU version, thats what i was talking about.
If you don't like the information in this forum, go make another one and stop posting negative feedback.

* - TheAxis - Aug 11, 2010

Great tutorial, thank you so much! Best one I've seen for cracking hashes; I think this will help alot of ppl. Good job 🤝