Password Cracking

Passwords are not stored as plaintext — they are stored as hashes, the output of one-way functions like MD5 or SHA-256. The string 5f4dcc3b5aa765d61d8327deb882cf99 is the MD5 hash of the word “password.” In NCL, you are given usernames and hashes and must recover the original passwords.

The approach is always the same: identify the hash type from its format, choose the right attack mode (dictionary, mask, or brute force), and run the cracker. NCL password challenges are the highest-scoring category — and the most straightforward if you know your tools.

Example Hash Dump

We’ll crack this password dump — the same format you will see in NCL:

By the end of this lesson, you will have cracked all five.

Identifying the Hash Type

Before cracking, you need to know what algorithm produced the hash. The length tells you almost everything:

Our hashes are 32 characters of hex — MD5. In NCL, MD5 is the most common hash type for password challenges.

The Trick: When unsure, use hashid or the hash-identifier tool to auto-detect the algorithm.

Choosing Your Attack

Dictionary Attack — “Try Every Known Password”

A dictionary attack tries every word in a list. The RockYou wordlist contains 14 million real passwords leaked from a 2009 breach. It is shockingly effective.

Save our hashes to a file, then crack:

# Create the hash file (user:hash format for John)
cat > hashes.txt << 'EOF'
Tom:68a96446a5afb4ab69a2d15091771e39
Laura:ec5f0b1826389df8622133014e88afde
Jenny:32e5f63b189b78dccf0b97ac41f0d228
Lindsay:2233287f476ba63323e60addca1f6b64
Zoe:6539bbb84fe2de2628fc5e4f2a31f23a
EOF

Now here is the command that does the work. Read the setup first, then look at the command, then read the explanation:

We are telling John the Ripper to try every password in the RockYou wordlist, hash each one with MD5, and compare against our target hashes.

john --format=raw-md5 --wordlist=/usr/share/wordlists/rockyou.txt hashes.txt

Within seconds, John will report the cracked passwords. View them with:

john --show --format=raw-md5 hashes.txt

All five should crack — because they were chosen from the RockYou list. In real NCL challenges, dictionary attacks solve most password cracking challenges.

Common Pitfall: If John says “No password hashes loaded,” you specified the wrong format. Try --format=raw-md5, --format=raw-sha1, or let John auto-detect by omitting --format.

Mask Attack — “I Know the Pattern”

Sometimes NCL tells you the password follows a pattern like SKY-HQNT-XXXX where X is a digit. With only 10,000 combinations, brute force within the mask is instant:

# Hashcat mask attack
# ?d = any digit (0-9), ?u = uppercase, ?l = lowercase
hashcat -m 0 -a 3 hashes.txt "SKY-HQNT-?d?d?d?d"

This tries SKY-HQNT-0000 through SKY-HQNT-9999 — done in under a second.

Windows and Linux Hashes

Windows NTLM

Windows stores passwords as NTLM hashes in the SAM database. The format is LM_HASH:NT_HASH. The LM hash is legacy (weak); focus on the NT hash.

# Crack NTLM hashes with John
john --format=nt --wordlist=/usr/share/wordlists/rockyou.txt ntlm_hashes.txt

# Or with hashcat (mode 1000 = NTLM)
hashcat -m 1000 ntlm_hashes.txt /usr/share/wordlists/rockyou.txt

Linux /etc/shadow

Linux stores password hashes in /etc/shadow. The format encodes the algorithm, salt, and hash:

username:$ALGORITHM$SALT$HASH:last_changed:...

# Combine passwd and shadow for John
unshadow /etc/passwd /etc/shadow > combined.txt

# Crack
john --wordlist=/usr/share/wordlists/rockyou.txt combined.txt

Key Insight: Not every hash in a shadow file will crack with RockYou. In NCL, typically only one or two users have crackable passwords. The rest used strong passwords or passphrases.

Why Password Cracking Matters

Password cracking is the single highest-scoring NCL category — challenges can total 500+ points. More importantly, it teaches you why password security matters. If 14 million leaked passwords can crack your hash in seconds, what does that say about password policies?

In professional security, password cracking is used in penetration testing (are employees using weak passwords?), incident response (what accounts were compromised?), and forensics (recovering access to encrypted evidence).

Next steps: Install John the Ripper and hashcat on your VM. Download rockyou.txt. Generate your own MD5 hashes with echo -n "password" | md5sum and practice cracking them. The tool muscle memory matters more than the theory.

Learning Resources

Video Tutorials

• NetworkChuck — Password Cracking with hashcat — Beginner-friendly hashcat walkthrough
• John Hammond — Password Cracking CTF — Real CTF password challenges
• IppSec — HackTheBox Password Cracking — Advanced techniques

Practice Platforms

• CrackStation — Online hash lookup (check your answers)
• HackTheBox — Machines with real password cracking
• TryHackMe — Search for “John the Ripper” and “hashcat” rooms

Tools

• John the Ripper — CPU-based, versatile, great format support
• hashcat — GPU-accelerated, fastest for large jobs
• hash-identifier — Auto-detect hash algorithms