John the Ripper and Hashcat: Password Cracking on Kali Linux

Password hashes are everywhere in penetration testing – in /etc/shadow on Linux, in NTLM hashes from Windows SAM databases, in database dumps from web application attacks. John the Ripper and Hashcat are the two tools you need for password cracking. Knowing when to use which, and how to use them efficiently, is what separates a methodical pentester from someone who just runs rockyou.txt and hopes for the best.

What Hash Cracking Actually Does

Hash cracking is fundamentally about reversal through guessing. You take a known hash, generate candidate passwords, hash each one with the same algorithm, and compare. When they match, you’ve found the original password. This is why long, truly random passwords are so important – the search space becomes computationally infeasible.

Identifying Hashes

# hashid - accurate, shows Hashcat mode numbers
hashid '$6$rounds=656000$abc123$hashstring'
hashid -m '$6$rounds=656000$abc123$hashstring'

# Common hash types:
# $1$ = MD5 crypt        (Hashcat mode 500)
# $5$ = SHA-256 crypt    (Hashcat mode 7400)
# $6$ = SHA-512 crypt    (Hashcat mode 1800) ← most common Linux
# $y$ = yescrypt         (Hashcat mode 11800) ← newer Ubuntu/Kali
# NTLM: 32 hex chars     (Hashcat mode 1000) ← Windows

John the Ripper

# Auto-detect and crack with default wordlist
john hashes.txt

# Specify wordlist and format
john --wordlist=/usr/share/wordlists/rockyou.txt hashes.txt
john --format=sha512crypt --wordlist=/usr/share/wordlists/rockyou.txt shadow.txt

# Show cracked passwords
john --show hashes.txt

Cracking /etc/shadow

# Combine passwd and shadow for John
unshadow /etc/passwd /etc/shadow > combined.txt
john --wordlist=/usr/share/wordlists/rockyou.txt combined.txt
john --show combined.txt

John Cracking Modes

# Single mode - uses GECOS info, username variants (try first - fast)
john --single hashes.txt

# Wordlist mode
john --wordlist=/usr/share/wordlists/rockyou.txt hashes.txt

# Wordlist with rules (mangling)
john --wordlist=/usr/share/wordlists/rockyou.txt --rules hashes.txt
john --wordlist=/usr/share/wordlists/rockyou.txt --rules=jumbo hashes.txt

# Incremental (pure brute force - slow for long passwords)
john --incremental hashes.txt

Cracking Files

zip2john protected.zip > zip_hash.txt
john --wordlist=/usr/share/wordlists/rockyou.txt zip_hash.txt

pdf2john protected.pdf > pdf_hash.txt
john pdf_hash.txt

ssh2john id_rsa > ssh_hash.txt
john --wordlist=/usr/share/wordlists/rockyou.txt ssh_hash.txt

Hashcat

Hashcat is faster than John with GPU acceleration and has a more powerful rule system.

# Basic syntax
hashcat -m [mode] -a [attack_mode] [hashfile] [wordlist]

# Attack modes: 0=dictionary, 3=brute force/mask, 6=hybrid wordlist+mask

# Dictionary attack - SHA-512 Linux hashes
hashcat -m 1800 -a 0 shadow_hashes.txt /usr/share/wordlists/rockyou.txt

# NTLM (Windows)
hashcat -m 1000 -a 0 ntlm_hashes.txt /usr/share/wordlists/rockyou.txt

# Show cracked results
hashcat -m 1800 shadow_hashes.txt --show

Mask Attacks (Smarter Brute Force)

# Character sets: ?l=lowercase, ?u=uppercase, ?d=digit, ?s=special, ?a=all printable

# All 8-character lowercase passwords
hashcat -m 0 -a 3 hashes.txt ?l?l?l?l?l?l?l?l

# Common pattern: word + 4 digits (password1234)
hashcat -m 0 -a 6 hashes.txt /usr/share/wordlists/rockyou.txt ?d?d?d?d

Rules – Hashcat’s Most Powerful Feature

# Apply built-in rules
hashcat -m 1000 -a 0 hashes.txt /usr/share/wordlists/rockyou.txt 
        -r /usr/share/hashcat/rules/best64.rule

# Multiple rule files
hashcat -m 1000 -a 0 hashes.txt /usr/share/wordlists/rockyou.txt 
        -r /usr/share/hashcat/rules/best64.rule 
        -r /usr/share/hashcat/rules/toggles1.rule

ls /usr/share/hashcat/rules/

Getting Hashes from Meterpreter

# In Meterpreter session
meterpreter > hashdump
# username:uid:LM_hash:NTLM_hash:::

# Extract NTLM hash for Hashcat
cat hashes.txt | cut -d: -f4 > ntlm_only.txt
hashcat -m 1000 ntlm_only.txt /usr/share/wordlists/rockyou.txt

Performance

hashcat -I    # Check GPU status
hashcat -m 1000 -a 0 hashes.txt wordlist.txt -w 3   # High workload
hashcat -m 1000 -a 3 hashes.txt ?l?l?l?l?l?l --keyspace   # Estimate speed

When to Use Each Tool

• John the Ripper: File format conversions (zip2john, ssh2john), quick initial cracks, Linux shadow files
• Hashcat: GPU cracking (dramatically faster), large wordlists, complex rule attacks, Windows NTLM hashes

Conclusion

Hash cracking is a patience game. The combination of a good wordlist, well-chosen rules, and the right tool for your hardware often cracks 60–80% of hashes in a real engagement. The remainder typically requires targeted approaches – custom wordlists from OSINT, mask attacks based on known password policies, or combination attacks. Invest time in understanding rules; they’re the multiplier that makes your wordlist 10x more effective.

Only crack hashes from systems you own or have authorisation to test. Possession of stolen credentials is illegal regardless of whether you crack them yourself.