1. Crack NTLM hashes
hashcat cracks offline; -m 1000 selects the NTLM hash mode, then it tries each word in the rockyou.txt list.
hashcat -m 1000 ntlm.txt rockyou.txtTyporithm · hard
Password Cracking
password-crackingpentesthashcatjohnhydra
Saved on this device
Full lesson · 8 learning steps Open any exercise for focused practice
10%
Step 1 of 8 · intro card
Learn Password Cracking
Exploitation
Offline cracking with hashcat or John uses a mode for the hash type (NTLM is -m 1000) plus a wordlist and rules. Online attacks (hydra, crackmapexec) try credentials against a service and must respect lockout policy. This demonstrates weak-password risk; the remediation is long passphrases plus MFA.
Password cracking splits into two styles. Offline cracking works on captured hashes: hashcat and John hash each candidate word and compare it to the target hash. Picking the right mode matters — NTLM is hashcat's -m 1000 — and a wordlist like rockyou.txt, often combined with mangling rules, supplies the guesses.
John the Ripper auto-detects many formats and is a common alternative, running the same wordlist-and-rules approach. Because offline cracking never touches the live system, its only limit is compute and the strength of the password.
Online attacks instead try credentials directly against a running service: hydra against SSH, or crackmapexec spraying over SMB. These are noisy and must respect account lockout policy to avoid locking out real users. Either way, the finding is the same — weak, guessable passwords — and the remediation is long unique passphrases plus multi-factor authentication.
01
Offline: hashcat/John hash candidates and compare (NTLM is -m 1000).
02
Online: hydra and crackmapexec try creds against a live service.
03
Remediation: long unique passphrases plus MFA.
hashcat -m 1000 ntlm.txt rockyou.txt
john --wordlist=rockyou.txt hashes.txt
hydra -l admin -P pass.txt ssh://target
crackmapexec smb target -u users.txt -p pass.txtRead the implementation
Connect each part of the code to the concept before you type.
2. John the Ripper
John auto-detects many hash formats and runs a wordlist (optionally with rules) against the captured hashes.
john --wordlist=rockyou.txt hashes.txt3. Online brute force
hydra tries a list of passwords against a live service; online attacks must respect account lockout policy.
hydra -l admin -P pass.txt ssh://target4. Spray over SMB
crackmapexec sprays user/password combinations across SMB to find valid in-scope credentials.
crackmapexec smb target -u users.txt -p pass.txt5. NTLM mode
The -m flag picks the hash algorithm; 1000 is NTLM, so hashcat hashes candidates the right way before comparing.
-m 1000A complete learning loop
01
Understand
Read the concept map and follow the code breakdown.
02
Reconstruct
Type the implementation, repair mistakes and work through every recall exercise.
03
Verify
Use the final check without hints; revisit weak concepts in short practice sessions.