Password and Hash Cracking

Prerequisites: encoding-encryption-hashing (to understand how hash digests are identified by length and character set). sql-injection-data-extraction and user-credentials are helpful context — they show how an attacker extracts a hash from a live database — but the hash is provided here directly so you do not need to complete those lessons first.

In a real attack, an adversary who gains read access to a database — through SQL injection or a data breach — will find rows of password values that look like this:

0192023a7bbd73250516f069df18b500

This is the NovaCart administrator's stored password value: a 32-character (128-bit) MD5 hash. A hash is one-way. There is no key, and there is no "decrypt" operation.

So how does an attacker turn that digest back into a password? Not by reversing it - by cracking it:

Take a guess (a candidate password).
Hash the guess with the same algorithm (here, MD5).
Compare the result to the stolen digest. A match means the guess was the password.

The whole attack is supplying good guesses cheaply and hashing them fast. NovaCart loses this contest badly, because its hashes are fast (MD5) and unsalted - the worst case for a defender.

In this lesson you will:

Identify the algorithm behind the digest and choose the matching cracker mode.
Run an offline dictionary attack with hashcat (or John the Ripper) and a wordlist, and watch the password fall in seconds.
Submit the recovered administrator password.
Learn why a salted, slow, adaptive hash makes the same attack impractical.

Estimated time: 10 to 15 minutes.

Tools: hashcat or John the Ripper, plus a wordlist such as rockyou.txt (bundled in Kali Linux and the SecLists project). The crack runs entirely offline against the lab digest you already hold - no traffic is sent to NovaCart.

Terminal prerequisite: this lesson requires a command-line environment. If you have not yet set up Kali Linux or a terminal, complete linux-command-line-fundamentals and kali-linux-getting-started before proceeding.

Scope reminder: use these tools only on lab hashes or hashes you are explicitly authorized to assess.

When you are ready, send the Continue signal.

In a real attack, an adversary who gains read access to a database — through SQL injection or a data breach — will find rows of password values that look like this:

0192023a7bbd73250516f069df18b500

This is the NovaCart administrator's stored password value: a 32-character (128-bit) MD5 hash. A hash is one-way. There is no key, and there is no "decrypt" operation.

So how does an attacker turn that digest back into a password? Not by reversing it - by cracking it:

Take a guess (a candidate password).
Hash the guess with the same algorithm (here, MD5).
Compare the result to the stolen digest. A match means the guess was the password.

The whole attack is supplying good guesses cheaply and hashing them fast. NovaCart loses this contest badly, because its hashes are fast (MD5) and unsalted - the worst case for a defender.

In this lesson you will:

Identify the algorithm behind the digest and choose the matching cracker mode.
Run an offline dictionary attack with hashcat (or John the Ripper) and a wordlist, and watch the password fall in seconds.
Submit the recovered administrator password.
Learn why a salted, slow, adaptive hash makes the same attack impractical.

Estimated time: 10 to 15 minutes.

Scope reminder: use these tools only on lab hashes or hashes you are explicitly authorized to assess.

When you are ready, send the Continue signal.