Homework

Objective

Benchmark three attack approaches against a set of hashes and compare their effectiveness and speed.

Setup

Create a file hw_hashes.txt with the following MD5 hashes:

5f4dcc3b5aa765d61d8327deb882cf99
e10adc3949ba59abbe56e057f20f883e
d8578edf8458ce06fbc5bb76a58c5ca4
0d107d09f5bbe40cade3de5c71e9e9b7
5baa61e4c9b93f3f0682250b6cf8331b7ee68fd8

The last hash is SHA-1 (-m 100). The others are MD5 (-m 0). Run each attack type separately for MD5 hashes first.

Instructions

1. Plain dictionary: Run hashcat -m 0 -a 0 --potfile-disable hw_hashes.txt rockyou.txt. Record: time, speed, hashes cracked.
2. Dictionary + rules: Run with -r rules/best64.rule. Record the same metrics.
3. Combinator: Split rockyou.txt into two halves (first 7M lines and last 7M lines) and run a combinator attack. Record the metrics. Note: this generates a very large candidate space — you may want to use smaller subsets.

Deliverable

A comparison table:

Write a short paragraph (100-150 words) explaining which approach you would use first in a real audit and why.

Objective

Create a targeted custom wordlist for a fictional company and test it against generated hashes.

Instructions

1. Choose a fictional company name (e.g., "SolarTech") and create a wordlist of 50+ entries that an employee might use as a password. Include:
   • Company name variations (solartech, SolarTech, SOLARTECH, solar, tech)
   • Product names (make up 2-3)
   • City where the company is "based"
   • Common suffixes: numbers (1-99, 2024, 2025, 2026), special characters (!, @, #)
   • Seasonal patterns (Summer2025, Winter2026)
2. Generate MD5 hashes of 5 passwords from your wordlist:

   echo -n "SolarTech2025" | md5sum
   echo -n "solartech!" | md5sum
   # ... etc.

3. Run a dictionary attack using your custom wordlist against those hashes.
4. Run the same hashes against rockyou.txt. How many does rockyou crack?

Deliverable

Your custom wordlist file, the generated hashes, and a written comparison: how does a targeted wordlist perform vs. a generic one for organization-specific passwords?

Objective

Learn hashcat's rule syntax by writing and testing 5 custom rules.

Instructions

1. Read the hashcat rule syntax documentation.
2. Create a file called custom5.rule containing exactly 5 rules. Each rule must use a different operation. Suggested operations:
   • Capitalize first letter + append a year (c $2 $0 $2 $6)
   • Leet-speak substitutions (sa@ se3 si1 so0)
   • Reverse + uppercase all (r u)
   • Duplicate the word + append "!" (d $!)
   • Truncate to first 6 characters + append "123" (]]]]] $1 $2 $3 — note: ] removes the last character; adjust count based on word length, or use '6 to truncate at position 6)
3. Test your rules by running:

   # Preview what rules generate (without cracking)
   echo "password" | hashcat -r custom5.rule --stdout

4. Document each rule: explain what it does and give an example of the input/output transformation.

Deliverable

The custom5.rule file and a table documenting each rule: