Password Cracking Modes

Identify the hash first

hashid:

hashid '<hash>'

name-that-hash:

nth --text '<hash>'

hashcat modes you reach for

Mode	Hash
0	MD5
100	SHA1
1000	NTLM (Windows local / dumped)
5600	NetNTLMv2 (Responder capture)
13100	Kerberoast (TGS-REP, RC4)
18200	AS-REP roast
1800	sha512crypt $6$ (Linux /etc/shadow)
500	md5crypt $1$
3200	bcrypt $2*$
13400	KeePass
22921	RSA/OpenSSH private key

hashcat

NetNTLMv2:

hashcat -m 5600 hash.txt /usr/share/wordlists/rockyou.txt

NTLM with a rule:

hashcat -m 1000 hash.txt rockyou.txt -r /usr/share/hashcat/rules/best64.rule

Kerberoast:

hashcat -m 13100 hash.txt rockyou.txt

John the Ripper

With a format:

john --format=netntlmv2 hash.txt --wordlist=rockyou.txt

Auto-detect:

john hash.txt --wordlist=rockyou.txt

Show cracked:

john --show hash.txt

Convert things into crackable hashes

SSH key:

ssh2john id_rsa > hash

KeePass database:

keepass2john file.kdbx > hash

Zip:

zip2john file.zip > hash

Office document:

office2john file.docx > hash

NetNTLMv2 (5600) and Kerberoast (13100) are the two you will run most in AD. Always try best64.rule before bigger wordlists.