hashpwn

Quick run. There's still a lot of easy ones left.
8569 found.txt
34119 left.7z
42688 total

Title: Top hashpwn Rules Collection
Author: hashpwn
URL: https://github.com/hashpwn/rules
Description:
This repository contains hashpwn's Top Rules, a collection of high-performing hash-cracking rules that have been tested on hundreds of real-world leaks over the past decade. These rules include some of the best-performing publicly released rulesets to date.

• Included Rulesets:
  • hashpwn_250.rule
  • hashpwn_500.rule
  • hashpwn_1500.rule
  • hashpwn_3000.rule
  • hashpwn_5000.rule

Author: cyclone
URL: https://github.com/cyclone-github/writeups/blob/main/Intro to Hash Cracking - Cyclone.pdf
Description:
Intro to Hash Cracking

So you want to crack hashes? Let’s first briefly cover what hashing is, and why it’s used.

Rather than storing sensitive information, such as login credentials in plaintext, most databases use hashing to obscure sensitive database entries. For example, if you used an insecure password such as, password, and the server was using the hashing algorithm MD5, your hashed password would be, 5F4DCC3B5AA765D61D8327DEB882CF99. Databases store passwords in hashed entries, and hash cracking is the process of turning these hashed entries back into plaintext. Concerning modern hash algorithms, the only way to retrieve the plaintext is to crack the hash. Since hashing is a one-way function, the only way to crack the hash is to guess the plaintext. There’s no hack or “dehashing” exploit. Guessing the plaintext is cracking the hash. This is where good hash cracking practices come into play with efficient wordlists, rules, and fast GPU’s all playing an important part in this process. The most important part of this process is you as the hash cracker must know when and where to apply your skills for the process to be both effective and efficient.

Hash Cracking Programs

There are multiple programs that can be used for hash cracking such as John the Ripper or MDXfind, but we’ll focus on Hashcat. If you haven’t already, download the binary files here: https://hashcat.net and unzip the hashcat-x.x.x.7z file we just downloaded into a directory called “hashing” (or whatever you want to call it).

You’ll notice Hashcat includes binaries for both Windows (.exe) and Linux (.bin), but for this tutorial we’ll be demonstrating the commands from a Linux terminal. Keep in mind most of the commands we’ll be using for this tutorial are similar for both OS’s, so once you’ve learned how to run Hashcat on Linux, switching over to Windows is fairly easy and visa-versa.

Wordlists

The wordlist we use is extremely important to the success of our attack. A poor wordlist will give poor results, and just because a wordlist is huge with 10’s of gigabytes doesn’t mean it’s efficient. This is especially true with slow algorithms such as bcrypt where running a targeted wordlist without rules may be necessary due to time. What is all this talk about time and efficiency? Keep in mind that the same wordlist + rules that only takes a few minutes to run on a list of 100 MD5’s could take years to complete on 100 bcrypt.

Since we’ll need a wordlist for our attack, we’ll download one from weakpass.com which contains a short list of 100,000 most common passwords. Unzip this wordlist inside your Hashcat folder. I like to keep my wordlists in their own subfolder called “wordlist”, but you can choose to set up your folder structure however you like. Just keep in mind where you extract the wordlist as we’ll need to know that when we assemble our command line in terminal.
https://weakpass.com/wordlist/49

The Attack

We need a sample set of hashes to try our attack on, so copy and paste the following MD5 hashes into a file called hashes.txt and place this file in your Hashcat folder as well.
All of the password hashes listed below were derived from the wordlist we downloaded in the previous step.

5f4dcc3b5aa765d61d8327deb882cf99
0d107d09f5bbe40cade3de5c71e9e9b7
84d961568a65073a3bcf0eb216b2a576
f25a2fc72690b780b2a14e140ef6a9e0
8afa847f50a716e64932d995c8e7435a
55f9c405bd87ba23896f34011ffce8da
58e50f904aab05ac687efc1635421d78
72a97fb793d496318518aebc7e9298b2
c62d929e7b7e7b6165923a5dfc60cb56
e0e34c5ad05aac3eef6ab31eacbf7a5c
5e8667a439c68f5145dd2fcbecf02209
ce608d5892ee2872771f4b67144405e0
dbfd69abf4df53dee082a1165ded4f08
94d756215ab39626d9e84a5c1a63aef5
97db1846570837fce6ff62a408f1c26a
faf5ba124a0b97c9e59c1f9c8c7d2d24
0d2489f3616693c707709295fd091c84
eb01627e574fe1054d0e1be3dbd02335
cd08b61ac93896d976abde8694980166
9fceecbb0047b7f21a62ab4cb07d073d
1b4329e9b4051be1f368e300285b6903
084a0ff182baa188032cf8e9b4d632cc
cadac4d712c63f4cec146d91f18bfb85
e88d4453db667bfcf194521b5072fa63
5dcc146ae54e2f6ed3c0e1400b0bdc6b
a36d09f3df5a75f6814c74fa1b20a06a
bc11dd3115d29514c9362c77ffa7427c

Open a terminal in your Hashcat directory and run the following command:
Note: you may need to edit this command to match the folder structure on your system if your wordlists are in a subfolder, etc. If using Windows, use hashcat.exe.

./hashcat.bin -m 0 -a 0 -O -w 3 hashes.txt 10_million_password_list_top_100000.txt

Let’s take a moment to explain the command and options we’re using.

hashcat.bin		hashcat binary 
-m 0			-m = MODE		0 = MD5
-w 3			Workload profile	3 = High
-a 0		 	-a = attack		0 = wordlist
-O			Optimised kernel - speeds up attack on supported modes
hashes.txt 		Text file containing hashes we’re trying to crack
10_million_pass...	Wordlist we’re using for the attack

If everything went well, we should have cracked 13 / 27 hashes! If you received an error, double check your command syntax and make sure you’ve installed the correct drivers for your GPU. You can always run ./hashcat.bin -h to display a full list of commands and supported algorithms Hashcat supports.

0d2489f3616693c707709295fd091c84:PLATINUM        
f25a2fc72690b780b2a14e140ef6a9e0:iloveyou        
e0e34c5ad05aac3eef6ab31eacbf7a5c:victoria        
5e8667a439c68f5145dd2fcbecf02209:87654321        
8afa847f50a716e64932d995c8e7435a:princess        
72a97fb793d496318518aebc7e9298b2:cowboys         
97db1846570837fce6ff62a408f1c26a:1q2w3e4r5t      
c62d929e7b7e7b6165923a5dfc60cb56:q1w2e3r4        
5f4dcc3b5aa765d61d8327deb882cf99:password        
0d107d09f5bbe40cade3de5c71e9e9b7:letmein         
84d961568a65073a3bcf0eb216b2a576:superman        
55f9c405bd87ba23896f34011ffce8da:maverick        
58e50f904aab05ac687efc1635421d78:eagles  

Rules

Next, let’s expand our attack by using rules for our wordlist. This is done by adding the -r switch to our Hashcat command and specifying the ruleset to use. Hashcat includes several rulesets so we’ll start off by using a basic set of rules, best64.rule. Using rules will mangle each word contained in our wordlist. For example, the rule l (lower case L) will lower the case of each word, so PassWord becomes password.

Hashcat Rules: https://hashcat.net/wiki/doku.php?id=rule_based_attack

Run the following command from terminal.

./hashcat.bin -m 0 -a 0 -O -w 3 hashes.txt 10_million_password_list_top_100000.txt -r rules/best64.rule

Note the added -r rules/best64.rule appended to the previous command.

Applying best64.rule to our wordlist cracked 6 more hashes!

eb01627e574fe1054d0e1be3dbd02335:qweasdzxc13     
faf5ba124a0b97c9e59c1f9c8c7d2d24:garfield123     
94d756215ab39626d9e84a5c1a63aef5:liverpool77     
ce608d5892ee2872771f4b67144405e0:qwerty123123    
dbfd69abf4df53dee082a1165ded4f08:theqwerty123    
cd08b61ac93896d976abde8694980166:CzPS5NYNDWCkSC23

Let’s try another ruleset called generated.rule and see how many more hashes we can crack.

./hashcat.bin -m 0 -a 0 -O -w 3 hashes.txt 10_million_password_list_top_100000.txt -r rules/generated.rule

Running our attack with generated.rule cracked 3 more hashes.

1b4329e9b4051be1f368e300285b6903:uoyevo,li       
9fceecbb0047b7f21a62ab4cb07d073d:Mcoolbugi2000Mcoolbugi2000
cadac4d712c63f4cec146d91f18bfb85:9coolbugi2000G 

Rule Stacking

Let’s try something else, rule stacking. This is where we’ll run multiple sets of rules to further mangle our wordlist. This is typically only feasible with fast hash algorithms as rule stacking can add considerable time to the attack. To keep things simple, for this attack we’ll stack best64.rule. Make sure to add a second -r switch before the 2nd rule like our example below:

./hashcat.bin -m 0 -a 0 -O -w 3 hashes.txt 10_million_password_list_top_100000.txt -r rules/best64.rule -r rules/best64.rule

Two more hashes fell to our rule stacking attack.

a36d09f3df5a75f6814c74fa1b20a06a:seirrebnarc21   
bc11dd3115d29514c9362c77ffa7427c:|hecoolbugi2000 

The Last 20%

While our last 3 uncracked hashes do not equal 20% of the test set, the last remaining hashes that haven’t cracked are commonly referred to as The Last 20%. Some of these remaining hashes will crack with targeted wordlist and rules, but in the real world of hash cracking some hashes with long, complex plaintext will never crack even with mask / brute force attacks due to the time required to run through their entire keyspace. The good news for you is the 3 remaining hashes in this test set will crack if you find the right wordlist + ruleset, so explore some of your newly learned skills and have fun cracking these.

Conclusion

While we’ve only scratched the surface when it comes to hash cracking, I hope you’ve had fun cracking these hashes and learned a few things along the way.

cyclone

In case you couldn’t figure them out, I’ve included a master list of the hash:plaintext.

Spoiler

Up to 106690/200000 (53.34%)

duplicut -- quickly dedupe massive wordlists:
https://github.com/nil0x42/duplicut

gramify -- Create n-grams of wordlists:
https://github.com/0xVavaldi/gramify

hashgen -- hash generator and wordlist processor:
https://github.com/cyclone-github/hashgen

pipal -- the password analyser:
https://github.com/digininja/pipal

PACK -- Password Analysis and Cracking Kit:
https://github.com/Hydraze/pack

rling -- wordlist sorting and/or dedupe:
https://github.com/Cynosureprime/rling

Title: Riddled History
Author: cyclone
URL: https://github.com/cyclone-github/challenge/tree/main/RiddledHistory
Description:

• A fun challenge consisting of 4 main sets of challenges, each with their own set of hints, riddles and quests.
• Challenge contains hints of fairy tails, classic movies and American history, all incorporated into hashes, encrypted files, and finishes strong with a simple, but challenging, reverse engineering "capture the flag".

Experience Required:

• hash cracking = Beginner / Intermediate
• reverse engineering = Beginner / Intermediate

found_875.7z
left_28277.7z
29152 total

Author: digininja
URL: https://github.com/digininja/CeWL
Description:
CeWL - Custom Word List Generator
CeWL is a Ruby application that spiders websites to collect unique words, creating custom wordlists for use in password cracking tools like hashcat and John the Ripper. It allows users to control the spidering depth, follow external links, and output words of a specified length. CeWL can also extract metadata and email addresses from websites.

First of all, welcome to hashpwn! We're a group of hash cracking enthusiast with backgrounds in everything from infosec to software development. While we're here to have fun, we're also going to keep it professional. Here's a quick how-to for getting started.

Getting started:

1. Sign up and verify your email – Before you can post, you'll need to complete registration and verify your email address.

2. Temporary restrictions – As a new user, you'll start with limited permissions. This is not meant to discourage reputable users, but is to help protect the community from would be spammers and scammers. Reputation will automatically be granted 24 hours after signing up which will allow you to send chat messages to staff. As you participate by posting and replying to topics, you'll gain further reputation. If you want to participate in the Paid Section, you'll need to request Trusted status.

3. Follow the rules – We have strict guidelines to keep the community running smoothly. Take a moment to read the forum rules and make sure to follow them!
Repeated violations will result in a ban.

Forum Rules

1. General Forum Rules
2. Paid Section Rules
   2.a Request Trusted Status
3. Hash Posting Template
4. Content Posting Template

Currently at 123497/200000 (61.75%).

Title: Argon2id Hash Cracker
Author: cyclone
URL: https://github.com/cyclone-github/argon_cracker
Description:
I wrote this tool due to the limited selection of programs that can crack/verify argon2id hashes. Hashcat currently lacks support for any argon algo, and even though John the Ripper does support it in its bleeding-edge version, the high memory requirements of argon2id make it impractical for handling higher-cost memory argon2id hashes that demand more memory than most GPUs have. If your GPU allows it, I suggest running argon2id hashes with JTR first. If not, Argon2id Hash Cracker may be your only choice as it is only limited by your system RAM and CPU.

Example hash: $argon2id$v=19$m=65536,t=4,p=1$d2tycHJEYlBuenNEOUpqNg$pEXhocM661JmS3oRCR6MPQ

Plaintext: password

Usage:
./argon_cracker.bin -w wordlist.txt -h hashes.txt

 ---------------------------------
| Cyclone's Argon2id Hash Cracker |
 ---------------------------------

Hash file:      hash.txt
Valid Hashes:   4
Invalid Hashes: 1
CPU Threads:    56
Wordlist:       cyclone.txt
Working...

$argon2id$v=19$m=65536,t=4,p=1$d2tycHJEYlBuenNEOUpqNg$pEXhocM661JmS3oRCR6MPQ:password
$argon2id$v=19$m=100000,t=4,p=1$cXVrNUdUVHI1SmN3RjcwNw$hMBzEYMGeblwwhj56bW6ig:password
$argon2id$v=19$m=65536,t=4,p=1$VWF5MkY2S3pYdm1nZm1HdQ$V3CVYSZuo4hAIgAPicV0NA:password1
$argon2id$v=19$m=65536,t=4,p=1$VWF5MkY2S3pYdm1nZm1HdQ$3zL8i47o4/l9rhLuDZE1oQ:passwords

Cracked:        4/4
Hashrate:       81.09/s
Runtime:        00h:00m:58s

Title: Hashmob Official Wordlists
Author: hashmob
URL: https://hashmob.net/resources/hashmob/
Description: A set of comprehensive wordlists provided by Hashmob (sorted by frequency).

Title: cyclone_hk_v2.txt
Author: cyclone
URL: https://github.com/cyclone-github/wordlist/tree/master/cyclone_hk_v2
Description: A 6GB wordlist compiled from various sources and leaks (sorted by frequency).

Title: hashkiller-dict-2020-01-26.txt
Author: hashkiller
URL: https://hashkiller.io/download
Mirror: https://github.com/cyclone-github/wordlist/tree/master/hashkiller-dict
Description: Latest hashkiller dictionary released in Jan 2020.

Title: rockyou.txt
Author: rockyou
URL: https://github.com/cyclone-github/wordlist/tree/master/rockyou
Description: The infamous rockyou breach wordlist.

Nice @flagg! My total was 41 after running them through my main wordlists + rules.

General Forum Rules:

• Post your hashes in the correct forum section. Any unrelated posts will be removed instantly.
• Try to provide the algorithm/hash-type. If you don't know, let us know the source of the hashes. This will boost the chance of recovery.
• Do NOT post any PII (Personal Identifiable Information). If you have hints, post them them in a pastebin: paste.hashpwn.net
• No double posting or unnecessary thread bumping. Any double posting will lead to removing BOTH of your posts.
• If you have more than 25 hashes, post them in a new thread.
• If you have 25 or less, post them in the pinned "25 Hashes or Less Requests".
• Do not post more than 30 hashes or passwords in a post. Save them to a text file and attach it.
• Crackers, post a found and left list when posting your founds.
• DO NOT post hashes of emails, Facebook accounts, etc. They are FAKE. (No actual passwords)
• DO NOT ask us to hack other people's email accounts. We do NOT do this.
• DO NOT post details of debit, credit-cards or anything similar.
• DO NOT hijack others' threads. (Hijacking = Requesting in other members' threads). You will get your post removed.
• Be specific when naming your thread. No "please help!", "can you please"... etc.
• hashpwn.net is NOT a hacking site. Please phrase your questions / answers accordingly.
• No advertising or hinting for paid work outside the dedicated section.
• No advertising or hinting for paid work via PM.
• Do not use other services and then try to obtain the password here for free. (Instant ban if you do)
• Using automation tools to refresh pages is forbidden. (Zero tolerance and instant ban)
• For website advertising generating profit, contact @cyclone / @blandy.
• Multiple accounts are not allowed and will be banned.

Remember:

Switched-off brains are not welcome here. Repeated violations to the rules will result in your account being banned!

What version of jtr are you trying to run on Windows 11? TBH, hash cracking is better done from a linux distro (just my 2 cents).

You can download the latest official jtr-jumbo pre-combined windows binaries from their site:
https://www.openwall.com/john/

Look for the download link below the following text:

Download the latest John the Ripper jumbo release (release notes) or development snapshot:
1.9.0-jumbo-1 64-bit Windows binaries in 7z, 22 MB <-- download link

If you want the latest version from GitHub, you'll have to download the source and compile yourself.

• Source code:
  • https://github.com/openwall/john
• Compile instructions for Windows:
  • https://github.com/openwall/john/blob/bleeding-jumbo/doc/INSTALL-WINDOWS

@v1cvap0r
That's a neat idea. Feel free to submit an issue on github to request support for HashManger and/or mdxfind. If there's enough interest, I'll look into either adding support or developing a separate tool for them.

Do keep in mind, crackmon is specifically written to read hashcat's status and send control commands back to hashcat, like pressing "b" to bypass the current attack. Not much of the existing logic would work with HashManager or mdxfind, so supporting these tools would require a significant rewrite of crackmon’s codebase.

Author: cyclone
URL: https://github.com/cyclone-github/spider
Description:
Spider is a web crawler and wordlist/ngram generator written in Go that crawls specified URLs to produce frequency-sorted wordlists and ngrams. Users can customize crawl depth, output files, and ngram options, making it ideal for web scraping to create targeted wordlists for tools like hashcat or John the Ripper. Spider combines the web scraping capabilities of CeWL and adds ngram generation, and since Spider is written in Go, it requires no additional libraries to download or install.
Spider just works.

Usage Instructions:

• To create a simple wordlist from a specified url (will save deduplicated wordlist to url_wordlist.txt):

./spider -url https://github.com/cyclone-github

• To set url crawl url depth of 2 and create ngrams len 1-5, use flag "-crawl 2" and "-ngram 1-5"

./spider -url https://github.com/cyclone-github -crawl 2 -ngram 1-5

• To set a custom output file, use flag "-o filename"

./spider -url https://github.com/cyclone-github -o wordlist.txt

• To set a delay to keep from being rate-limited, use flag "-delay nth" where nth is time in milliseconds

./spider -url https://github.com/cyclone-github -delay 100

• Run ./spider -help to see a list of all options

Author: cyclone
URL: https://github.com/cyclone-github/ipscope
Description:
IPScope - Subdomain Discovery and IP Lookup Tool
IPScope is a CLI tool written in Go for discovering subdomains and resolving their IP addresses. Designed for security researchers and network admins, it includes features like reverse proxy and WAF detection, DNS server customization, and the ability to use custom subdomain lists. IPScope is a powerful, yet simple to use tool for security researchers and network administrators.

Title: RegX
Author: cyclone
URL: https://github.com/cyclone-github/regx
Description:
RegX - A Flexible Potfile Parsing Tool

RegX is a specialized tool designed to streamline parsing hashes from potfiles. Unlike general-purpose tools like grep or ripgrep, RegX offers pre-built support for popular hashcat modes, removing the need for complex or error-prone regular expressions. With just a simple command, you can quickly extract hashes like md5, bcrypt, phpass, crypto hashes, etc, by using their hashcat mode or algo name. RegX also allows advanced users to use custom RE2 regex patterns for unmatched flexibility.

Title: crackmon
Author: cyclone
URL: https://github.com/cyclone-github/crackmon
Description:
Hashcat wrapper tool to bypass current attack if crack rate drops below threshold.

Usage:

./crackmon -help
Examples:

(Defaults to -time 1m -crack 1)
./crackmon ./hashcat {hashcat args}

Custom: -time 2m -crack 100
./crackmon -t 2 -c 100 ./hashcat {hashcat args}

All flags:
	-t      	minimum runtime in minutes
	-c      	cumulative average cracks threshold
	-debug  	enable debug output
	-help   	show this help menu
	-version	show version info