Study guide
16.1 Reverse Engineering & Password Cracking: Ghidra, IDA Pro, Hashcat & John the Ripper
Computer Hacking Forensic Investigator CHFI 312-49
Track your progress as you read
Finished sections get a check mark.
1 Chapter 1: Foundations of Digital Forensics & Cybercrime Investigation
1.1 Cybercrime Classifications, Forensic Science Principles & Legal Admissibility 1.2 RFC 3227 Order of Volatility, Live vs. Dead Acquisition & Forensic Readiness 1.3 Indicators of Compromise (IoCs), Cyber Attribution & Threat Intelligence 1.4 AI-Assisted Forensics, GitOps, Automation/Orchestration & Forensics-as-a-Service (FaaS)
2 Chapter 2: Modern Forensic Environments & Emerging Threats
2.1 Fileless Malware, In-Memory Execution & Living-off-the-Land (LotL) 2.2 IoT & Operational Technology (OT/SCADA) Forensic Fundamentals 2.3 Dark Web, Tor Network, Onion Routing & Hidden Services Forensics 2.4 Blockchain Transactions, Cryptocurrency Tracing & Digital Asset Investigations
3 Chapter 3: Legal Frameworks, Search Warrants & Evidence Rules
3.1 Federal Rules of Evidence (FRE 702, 901, 902, 1001-1003) & Daubert/Frye Standards 3.2 Fourth Amendment, Warrant Exceptions, Workplace Search & Consent Protocols 3.3 International Standards: ISO/IEC 27037, ACPO Principles & ENFSI Guidelines 3.4 Cybercrime Statutes, Privacy Compliance, CAN-SPAM & International Cooperation
4 Chapter 4: eDiscovery, Chain of Custody & Professional Ethics
4.1 Electronic Discovery Reference Model (EDRM) & Legal Spoliation Holds 4.2 Chain of Custody Documentation, Evidence Packaging & Tamper-Evident Handling 4.3 Expert Witness Testimony, Report Writing Standards & EC-Council Code of Ethics
5 Chapter 5: Storage Architecture, Boot Sequences & Media Forensics
5.1 Storage Media Architecture: Sectors, Clusters, RAM/File Slack & Unallocated Space 5.2 Partition Tables & Boot Structures: MBR, GPT, VBR, BIOS vs. UEFI Secure Boot 5.3 RAID Reconstruction (RAID 0, 1, 5, 6, 10) & SSD Forensic Challenges (TRIM, Wear Leveling)
6 Chapter 6: Windows File Systems: NTFS & FAT
6.1 NTFS Architecture: Master File Table ($MFT) Record Structure & Attribute Headers 6.2 NTFS Artifacts: Alternate Data Streams (ADS), Volume Shadow Copies (VSS) & $LogFile 6.3 FAT12/16/32 and exFAT Architecture, Directory Entries & File Deletion Mechanics
7 Chapter 7: Non-Windows File Systems & File Signatures
7.1 Linux File Systems: ext2/ext3/ext4 Inode Architecture, Superblocks & Journaling Forensics 7.2 macOS File Systems: HFS+ and Apple File System (APFS) Architecture & Snapshots 7.3 File Signatures, Magic Bytes, Hex Headers/Footers & File Carving Techniques
8 Chapter 8: Investigation Lifecycle, Lab Setup & First Response
8.1 Forensic Laboratory Accreditation: ISO/IEC 17025 Standards & Hardware/Software Controls 8.2 First Responder Duties: Crime Scene Containment, Electronic Triage & Volatile Triage 8.3 Physical Evidence Packaging, Anti-Static/Faraday Protection & Transport Security
9 Chapter 9: Forensic Acquisition & Verification Methodology
9.1 Hardware and Software Write-Blockers: Operational Validation & Bridge Verification 9.2 Bit-Stream Disk Imaging, Physical vs. Logical vs. Targeted Acquisition Methodology 9.3 Forensic Image Formats (RAW/DD, E01, AFF) & Cryptographic Hashing Verification (MD5, SHA-256)
10 Chapter 10: Anti-Forensics Techniques & Countermeasures
10.1 Steganography Detection: Spatial/Frequency Domain Steganalysis & Hidden Carrier Extraction 10.2 Timestomping Countermeasures: Comparing $STANDARD_INFORMATION vs $FILE_NAME Timestamps 10.3 Secure Wiping, Degaussing, File Shredding Countermeasures & Residual Artifact Recovery
11 Chapter 11: Windows Operating System Forensics
11.1 Windows Registry Forensics: SYSTEM, SOFTWARE, SAM & NTUSER.DAT Hive Analysis 11.2 Execution Artifacts: Prefetch (.pf), Shimcache (AppCompatCache), Amcache.hve & UserAssist 11.3 User Activity Artifacts: ShellBags, LNK Shortcut Files, Jump Lists & Recycle Bin ($I/$R) 11.4 Windows Event Log Forensics: Security Audit IDs (4624, 4625, 4688, 4720, 7045) & EVTX Parsing
12 Chapter 12: Memory Forensics & Malware Analysis
12.1 Volatile Memory Acquisition: RAM Capture, Crash Dumps, Hiberfil.sys & Pagefile.sys 12.2 Memory Analysis with Volatility 3: pslist, pstree, malfind, netscan & Vadinfo 12.3 Static Malware Triage: Strings, PE Headers, Import Tables, Hashes & YARA Rule Matching 12.4 Dynamic Malware Analysis: Sandboxing, Process Monitor (Procmon), Regshot & Network Callouts 12.5 .NET Managed Malware Analysis & the GOOTLOADER Fileless Infection Chain
13 Chapter 13: Network, Web Application & Email Forensics
13.1 Network Forensics: PCAP Analysis, Protocol Dissection, Snort/Suricata & Flow Analysis 13.2 Web Server Forensics: Apache/IIS Access Logs, SQL Injection, XSS & Web Shell Detection 13.3 Email Forensics: RFC 5322 Headers, Authentication (SPF, DKIM, DMARC) & Mbox/PST Extraction 13.4 SIEM Event Correlation, Cross-Source Timeline Analysis & Super-Timeline Construction 13.5 Investigating Directory Traversal, Command Injection, Parameter Tampering, XXE, Cookie Poisoning & Brute Force 13.6 Network Device & Service Log Forensics: Firewall, IDS, Honeypot, Router, DHCP, Switch, VPN, DNS & SSH 13.7 Wireless Network Forensics: Rogue APs, Evil Twins, MAC Spoofing, Deauthentication & Jamming
14 Chapter 14: Mobile, Cloud & IoT Forensics
14.1 Mobile Device Forensics: Manual, Logical, File System & Physical Extraction (Android/iOS) 14.2 Mobile Artifact Analysis: Call Logs, SMS/Chat SQLite Databases, Location Data & Plists 14.3 Cloud Forensics: AWS CloudTrail, Azure Activity Logs & Multi-Tenant Evidence Collection 14.4 IoT Forensics: UART/JTAG Physical Interfaces, Firmware Extraction & Sensor Telemetry
15 Chapter 15: Commercial & Open-Source Forensic Suites
15.1 Commercial Forensic Platforms: EnCase Forensic, FTK (Forensic Toolkit) & FTK Imager 15.2 Open-Source Forensic Platforms: Autopsy, The Sleuth Kit (TSK) & SIFT/CAINE Workstations 15.3 Specialized DFIR Utilities: Eric Zimmerman Tools (EZ Tools) & Sysinternals Forensic Suite
16 Chapter 16: Analysis Toolkits, Python Scripting & Tool Validation
16.1 Reverse Engineering & Password Cracking: Ghidra, IDA Pro, Hashcat & John the Ripper 16.2 Python for Digital Forensics: Parsing Raw Artifacts, Custom Scapy Scripts & Evidence Automation 16.3 Forensic Tool Testing & Validation: NIST CFTT Methodology, ISO/IEC 17025 Standards & Daubert Compliance
17 Chapter 17: Database Forensics & Web Application Firewalls
17.1 MySQL Forensics: Internal Architecture, Data Directory, Information Schema & Utility Programs 17.2 SQL Server Forensics: SSMS, ApexSQL, SQLCMD Transaction-Log Collection, Plan Cache & Trace Files 17.3 Web Application Firewall (WAF) Architecture, Audit Logs, Benefits & Limitations
18 Chapter 18: Social, Virtualized, Multimedia & Browser Investigations
18.1 Social Media, Social Engineering, Insider Threat & Identity Theft Forensics 18.2 Virtualization, Container & Microservices Forensics, Bluetooth and Electron Chat Applications 18.3 Multimedia Forensics: Image, Audio & Video Authentication, EXIF, PRNU and Deepfake Detection 18.4 Browser Artifact Recovery, Private Browsing, USB Enumeration, Partition Recovery & Packer Unpacking Tools
16.1 Reverse Engineering & Password Cracking: Ghidra, IDA Pro, Hashcat & John the Ripper
Key Takeaways Explain This Topic AI
Static binary analysis transforms digital forensics from behavioral observation into definitive code inspection, using decompilers and disassemblers to expose malicious algorithms, hardcoded credentials, and command-and-control infrastructure.
Hex-Rays IDA Pro utilizes Fast Library Identification and Recognition Technology (FLIRT) signatures to filter runtime library code, whereas NSA Ghidra provides a free native decompiler, Sleigh processor modeling, and native multi-user collaboration repositories.
Forensic password recovery targets offline cryptographic databases (SAM, SYSTEM, NTDS.dit, LSASS dumps) using structured attack strategies: dictionary, rule-based mangling, mask attacks, combinator, hybrid, and rainbow tables.
Hashcat leverages GPU parallel computing across specialized hash modes (-m 1000 NTLM, -m 3200 bcrypt, -m 13100 Kerberoast, -m 22000 WPA-PBKDF2) and attack modes (-a 0 dictionary, -a 3 mask).
John the Ripper (JtR) excels at CPU-based password recovery and provides critical evidence-extraction utilities (zip2john, rar2john, pdf2john, bitlocker2john) to convert encrypted container metadata into crackable hashes.
Last updated: September 2026
16.1 Reverse Engineering & Password Cracking: Ghidra, IDA Pro, Hashcat & John the Ripper
Quick Answer: In digital forensics, reverse engineering toolkits like NSA Ghidra and Hex-Rays IDA Pro enable examiners to perform deep static analysis of unknown binaries, disassembling machine code and decompiling it into human-readable C pseudocode to uncover malicious payloads, evasion mechanisms, and command-and-control (C2) channels. Concurrently, password recovery tools resolve access barriers presented by encrypted containers, locked user accounts, and password-protected files. Hashcat provides massively parallel GPU-accelerated hash cracking across hundreds of hash types ( -m 1000 NTLM, -m 3200 bcrypt, -m 13100 Kerberoast, -m 22000 WPA-PBKDF2) utilizing dictionary, rule-based, and mask attacks ( -a 3 ). Complementing this, John the Ripper (JtR) offers flexible CPU-based cracking and essential hash extraction utilities ( zip2john , rar2john , pdf2john , bitlocker2john ) to convert encrypted container headers into crackable targets.
Binary Reverse Engineering in Digital Forensics
Digital forensic investigators frequently encounter compiled binaries whose provenance, intent, and operational mechanics cannot be determined solely through dynamic sandbox execution. Malware authors frequently implement anti-analysis techniques, sandbox evasion routines, and environment-checking conditional branches (such as validating Active Directory domain membership, hypervisor detection, or sleep-timing thresholds) that prevent the binary from executing its malicious payload in automated sandbox environments.
Under such circumstances, examiners must transition to static binary analysis and software reverse engineering (SRE) . Reverse engineering allows the investigator to inspect the internal structure, control flow logic, imported API functions, and embedded cryptographic keys of an executable without running it.
Disassembly vs. Decompilation
Understanding the distinction between disassembly and decompilation is fundamental to forensic analysis:
Disassembly: The process of translating raw binary machine code (hexadecimal opcodes) into human-readable assembly language mnemonics (such as x86, x86-64, or ARM instructions: MOV , PUSH , CALL , JMP , XOR ). While disassembly preserves 100% of the instruction-level logic and architectural operations, it requires extensive knowledge of hardware registers, calling conventions, stack frames, and assembly-level branching.
Decompilation: The process of taking machine code or intermediate representations and reconstructing high-level, structured source code—most commonly C pseudocode . Decompilation abstracts away register allocations, stack manipulation, and low-level calling conventions into standard programming constructs ( if/else conditionals, while loops, structure definitions, and function prototypes). This dramatically accelerates forensic review. +-----------------------+ Disassembly +---------------------------+
- | Raw Machine Code | -----------------------> | Low-Level Assembly Code |
- | (e.g., 55 48 89 E5) | | (e.g., push rbp; mov ...) |
- +-----------------------+ +---------------------------+
- | |
- | Decompilation |
- +----------------------------------------------------+
- |
- v
- +---------------------------+
- | High-Level C Pseudocode |
- | int decrypt_payload(...) |
- +---------------------------+
- Core Analytical Constructs in Reverse Engineering
Graph View and Control Flow Graphs (CFGs): Rather than reading a linear listing of instructions, modern disassemblers render binary logic as a directed graph. Basic blocks of instructions (sequences of instructions with a single entry point and a single exit point) are displayed as nodes, connected by conditional edges (green for condition met / true , red for condition unmet / false , and blue for unconditional jumps). This enables investigators to map out decision branches, such as anti-debugging checks or command-dispatch tables.
Cross-References (XREFs): Cross-references identify every location in the binary where a specific function, variable, memory address, or string is accessed or invoked:
Code XREFs: Reveal all caller functions that execute a CALL or JMP instruction to a targeted subroutine (e.g., finding all locations where VirtualAlloc or CreateRemoteThread is called).
Data XREFs: Reveal where hardcoded strings (e.g., URLs, registry keys, C2 IP addresses, encryption passwords) or global variables are referenced in memory.
Symbol Identification & Type Recovery: Binary executables stripped of debugging symbols (such as Microsoft PDB files or DWARF symbols) lack human-readable function and variable names. Investigators must reconstruct data structures (e.g., PEB , IMAGE_NT_HEADERS , custom network protocol structures) to understand data flow.
NSA Ghidra vs. Hex-Rays IDA Pro: Forensic Comparison
Two enterprise platforms dominate software reverse engineering: Hex-Rays IDA Pro (Interactive DisAssembler) and NSA Ghidra .
Feature / Attribute Hex-Rays IDA Pro NSA Ghidra
Developer / Provenance Hex-Rays (Commercial, proprietary) National Security Agency (Open-source, public domain)
Core Architecture C++ native engine; desktop client Java-based application framework with native C++ decompiler backend
Decompiler Availability Proprietary Hex-Rays decompiler add-ons (requires separate expensive modular licenses per CPU architecture) Built-in native decompiler included at zero cost for all supported architectures
Processor Architectures Comprehensive (x86, x64, ARM, MIPS, PowerPC, AVR, RISC-V, etc.) Extensive via Sleigh specification language (x86, x64, ARM, AArch64, MIPS, PowerPC, SPARC, z80, etc.)
Intermediate Language (IR) Microcode (used internally by Hex-Rays decompiler) P-code (a formalized register-transfer language modeling all CPU semantics)
Library Recognition FLIRT (Fast Library Identification and Recognition Technology) Function ID plugin / FidDb database
Multi-User Collaboration Supported via IDA Teams (commercial server infrastructure) Built-in native Ghidra Server (version-controlled shared repository out of the box)
Scripting APIs Python ( IDAPython ), C++ SDK Python 3 (via PyGhidra), Java SDK
Headless / Batch Mode idat.exe / ida -B command-line processing Robust analyzeHeadless automation script engine
Hex-Rays IDA Pro Architecture & FLIRT Signatures
IDA Pro is widely recognized for its robust disassembly analysis engine and deterministic control flow recovery. A pivotal capability of IDA Pro in forensic malware analysis is FLIRT (Fast Library Identification and Recognition Technology) :
When standard programs are compiled with static runtime libraries (e.g., Microsoft Visual C++ runtime, OpenSSL, zlib), the compiled binary includes tens of thousands of bytes of standard library code that the developer did not write.
FLIRT scans the binary against databases of known compiler library signatures. When a match is found, IDA Pro automatically renames the subroutine (e.g., sub_4011A0 becomes _strcpy , _malloc , or AES_encrypt ).
This eliminates thousands of lines of boilerplate code from the investigator's review, allowing the examiner to focus exclusively on the author's custom malicious logic.
NSA Ghidra Architecture & Forensic Capabilities
Released open-source in 2019, Ghidra has become a critical asset for law enforcement and corporate incident response teams:
The Sleigh Processor Modeling Language: Ghidra separates the disassembly and decompilation engine from processor architectures using Sleigh , a domain-specific language used to describe the semantics of target processors. When analyzing esoteric firmware, IoT botnets, or embedded controllers, analysts can define custom processor modules without modifying core Ghidra code.
P-Code Intermediate Representation: Ghidra translates all machine instructions into P-code operations (e.g., INT_ADD , LOAD , STORE , BRANCH ). The decompiler analyzes P-code rather than CPU-specific assembly, performing dead-code elimination, type propagation, and control-flow restructuring to produce clean C pseudocode.
Native Ghidra Server: Forensic laboratories investigating advanced persistent threats (APTs) often deploy multiple examiners across a single malware campaign. Ghidra includes a multi-user server allowing examiners to check out files, view concurrent changes, merge function annotations, and bookmark evidentiary strings in real time.
Headless Analyzer: For incident triage, Ghidra's analyzeHeadless utility allows investigators to automate binary ingestion, run auto-analysis scripts, extract embedded strings, and output decompiled functions directly from command-line pipelines without launching the GUI.
Note
While IDA Pro remains an industry standard in commercial malware labs, Ghidra's zero-cost decompiler, native multi-user repository server, and extensible Sleigh architecture make it a primary subject of modern forensic certification exams.
Forensic Password Recovery & Hash Extraction
During a forensic examination, critical evidence is frequently locked behind user account passwords, full-disk encryption (BitLocker, FileVault, LUKS), encrypted archives (ZIP, RAR, 7-Zip), or password-protected office documents (PDF, DOCX, XLSX). In such cases, investigators must extract the underlying cryptographic hashes or iteration parameters and perform targeted offline recovery.
Sources of Cryptographic Hashes in Windows Forensics +-----------------------------------------------------------------------------+
- | Evidentiary Hash Extraction Sources |
- +-----------------------------------------------------------------------------+
- | 1. SAM Registry Hive | C:\\Windows\\System32\\config\\SAM |
- | SYSTEM Registry Hive | C:\\Windows\\System32\\config\\SYSTEM (Syskey)|
- | Target Hashes | Local User Account NTLM Hashes |
- +-----------------------------+-----------------------------------------------+
- | 2. Active Directory NTDS | C:\\Windows\\NTDS\\ntds.dit |
- | SYSTEM Registry Hive | Extracted from Volume Shadow Copy (VSS) |
- | Target Hashes | Enterprise Domain User NTLM Hashes & Kerberos |
- +-----------------------------+-----------------------------------------------+
- | 3. Volatile Memory (LSASS) | lsass.exe process address space |
- | Acquisition Technique | comsvcs.dll, ProcDump, WinPmem, Mimikatz |
- | Target Artifacts | Plaintext passwords, NTLM hashes, Kerberos |
- | | tickets (TGT/TGS), DPAPI master keys |
- +-----------------------------------------------------------------------------+
The SAM and SYSTEM Hives:
Local user account credentials on Windows systems reside in the Security Account Manager (SAM) hive ( C:\\Windows\\System32\\config\\SAM ).
However, modern Windows systems encrypt the password hashes stored in the SAM hive using a cryptographic key known as the Syskey (or Boot Key). The Syskey is derived from four keys stored across the SYSTEM hive ( C:\\Windows\\System32\\config\\SYSTEM ).
To dump local NTLM hashes offline, the investigator must acquire both the SAM and SYSTEM hives from the forensic image and parse them using tools like secretsdump.py or samdump2 .
Active Directory ntds.dit :
On Windows Domain Controllers, enterprise user credentials reside within the Extensible Storage Engine (ESE) database file: C:\\Windows\\NTDS\\ntds.dit .
The database is encrypted using the Password Encryption Key (PEK), which is stored within the domain controller's SYSTEM registry hive.
Because ntds.dit is continuously locked by the Active Directory Domain Services (NTDS) engine, forensic acquisition requires capturing it via the Volume Shadow Copy Service (VSS) ( vssadmin create shadow /for=C: ), invoking ntdsutil , or performing live DCSync attacks via the Microsoft Directory Replication Service Remote Protocol (MS-DRSR).
LSASS Process Memory:
The Local Security Authority Subsystem Service ( lsass.exe ) manages user authentication, security tokens, and active logon sessions.
When a user logs on interactively, via RDP, or through network services, credential material is cached within LSASS memory space.
Investigators can extract LSASS memory from live triage images or memory dumps ( memdump.raw ) using native utilities ( rundll32.exe C:\\windows\\System32\\comsvcs.dll, MiniDump <lsass_pid> lsass.dmp full ), Sysinternals procdump.exe , or offline Volatility plugins ( windows.lsass ).
LSASS dumps yield NTLM password hashes, Kerberos Ticket Granting Tickets (TGTs), Ticket Granting Services (TGSs), and DPAPI master keys used to decrypt stored browser credentials and encrypted file systems.
Password Cracking Methodologies & Attack Types
Forensic password cracking is an offline, non-destructive mathematical process where candidate plaintexts are transformed using the target cryptographic algorithm and compared against the recovered evidentiary hash. Candidate Word ----> [ Hash Algorithm (e.g. NTLM, SHA-256) ] ----> Computed Hash
- |
- v
- Target Evidence Hash <============================================= [ Match? ]
- / \
- Yes: Recovered! No: Continue
- Detailed Taxonomy of Password Attacks
Dictionary Attack:
The cracker reads candidate words sequentially from a precompiled wordlist (such as the standard rockyou.txt or breach-derived password lists).
Strengths: Extremely rapid; exploits human tendency to choose common dictionary words.
Limitations: Ineffective against non-dictionary passphrases or passwords modified with numbers, leetspeak, or special symbols.
Rule-Based Attack:
Applies deterministic mutation rules to each word in a dictionary list.
Common mutation rules include: capitalizing the first letter ( password -> Password ), leetspeak substitutions ( e -> 3 , a -> @ , o -> 0 ), appending common numeric patterns (such as years 2024 or sequences 123! ), and reversing strings.
Popular rule sets include Hashcat's best64.rule and OneRuleToRuleThemAll.rule .
Brute-Force Attack (Exhaustive Keyspace Search):
Tests every possible combination of characters across a defined character set (lowercase, uppercase, numbers, symbols) up to a specified maximum length.
The total keyspace search size is governed by the formula K = C^L, where C is the character set size and L is the password length. For an 8-character password containing all 95 printable ASCII characters, the keyspace is 95^8 ≈ 6.63 × 10^15 combinations.
Forensic application: Impractical for long passphrases, but viable for short numeric PINs (e.g., 4-digit to 6-digit PINs, 10^4 to 10^6 combinations) or short alphanumeric tokens.
Mask Attack (Targeted Positional Search):
A refined, highly efficient variant of the brute-force attack where the investigator configures specific character sets for specific character positions based on known organization password complexity policies.
For example, if a corporate policy mandates an 8-character password starting with one uppercase letter, followed by five lowercase letters, and ending with two digits, a pure brute-force attack would require searching 95^8 combinations. A mask attack restricts the search to: ?u?l?l?l?l?l?d?d (26 × 26^5 × 10^2 ≈ 3.09 × 10^9 combinations), reducing the required cracking time by over six orders of magnitude.
Combinator Attack:
Takes two separate wordlists and combines them sequentially (word from list 1 + word from list 2).
Effective against compound passwords (e.g., Summer + Coffee = SummerCoffee ).
Hybrid Attack:
Combines a dictionary wordlist with a mask attack.
Mode 6 (Wordlist + Mask): Appends mask characters to dictionary words (e.g., word + ?d?d?s -> password99! ).
Mode 7 (Mask + Wordlist): Prepends mask characters before dictionary words (e.g., ?d?d + word -> 01password ).
Rainbow Table Attack:
A precomputed time-memory tradeoff technique. Rainbow tables pre-calculate chains of hashes from plaintexts using alternating hash functions and reduction functions , storing only the starting plaintext and ending hash of each chain.
Critical Forensic Constraint: Rainbow tables are effective only against unsalted hashes (such as legacy LM hashes, raw MD5, or unsalted NTLM). When a cryptographic salt is introduced (e.g., in bcrypt, PBKDF2, or Argon2), every unique salt requires an entirely new, independently precomputed multi-gigabyte rainbow table, rendering rainbow table attacks mathematically useless against modern salted credentials.
Hashcat: High-Performance GPU-Accelerated Cracking
Hashcat is the industry standard for high-performance, GPU-accelerated hash recovery. While CPUs are optimized for low-latency, complex branching logic, modern Graphics Processing Units (GPUs) contain thousands of Arithmetic Logic Units (ALUs) running on Single Instruction, Multiple Threads (SIMT) architectures. This massively parallel architecture enables GPUs to compute millions or billions of cryptographic hash evaluations per second.
Essential Hashcat Parameters & Hash Types
Hashcat execution requires two primary configuration parameters:
-m [mode] : Specifies the target cryptographic hash type.
-a [mode] : Specifies the attack methodology.
- Hash Type Flag ( -m ) Algorithm / Target Artifact Evidentiary Context
- m 1000 NTLM Windows SAM, NTDS.dit, LSASS memory cache
- m 5600 NetNTLMv2 Captured Windows network authentication challenges (Responder/Inveigh)
-m 3200 bcrypt ( 2 a 2a 2 a , 2 b 2b 2 b , 2 y 2y 2 y ) Modern Linux shadow files, web application credential databases
-m 13100 Kerberos 5 TGS-REP etype 23 Active Directory Kerberoasting attacks targeting service accounts
-m 18200 Kerberos 5 AS-REP etype 23 Active Directory ASREPRoasting attacks (accounts without Kerberos pre-auth)
- m 16800 / -m 22000 WPA-PMKID / WPA-PBKDF2 Wireless 802.11 4-way handshakes and captured PMKID frames
- m 11600 7-Zip Encrypted 7-Zip archive files
- m 12500 RAR5 Encrypted WinRAR 5.x container archives
- m 13600 WinZip AES-256 Encrypted ZIP archives using WinZip AES encryption
- m 22100 BitLocker Windows BitLocker full-disk encryption volume recovery
- Attack Mode Flag ( -a ) Attack Mode Name Description
- a 0 Straight Standard dictionary attack reading from a wordlist (with optional rules)
- a 1 Combination Concatenates candidate words from two distinct wordlists
- a 3 Brute-force / Mask Generates candidate plaintexts based on character masks and positions
- a 6 Hybrid Wordlist + Mask Appends mask-generated characters to each dictionary word
- a 7 Hybrid Mask + Wordlist Prepends mask-generated characters to each dictionary word
- Hashcat Built-in Character Charsets for Mask Attacks
- ?l : Lowercase alphabetic characters ( abcdefghijklmnopqrstuvwxyz )
- ?u : Uppercase alphabetic characters ( ABCDEFGHIJKLMNOPQRSTUVWXYZ )
- ?d : Decimal digits ( 0123456789 )
- ?s : Special symbols (printable symbols including punctuation and space)
- ?a : All printable ASCII characters (combination of ?l , ?u , ?d , and ?s )
- ?b : All 256 binary byte values ( 0x00 through 0xff )
Practical Forensic Hashcat Commands # Scenario 1: Rule-based attack on Windows NTLM hashes extracted from SAM hive
# Uses rockyou.txt wordlist and the best64 mangling rule set
hashcat -m 1000 -a 0 ntlm_hashes.txt /usr/share/wordlists/rockyou.txt -r /usr/share/hashcat/rules/best64.rule -o cracked_ntlm.txt
- # Scenario 2: Positional mask attack on an 8-character corporate password
- # Mask: 1 Uppercase, 5 Lowercase, 2 Digits (e.g., Summer24)
- hashcat -m 1000 -a 3 ntlm_hashes.txt ?u?l?l?l?l?l?d?d -o cracked_mask.txt
# Scenario 3: Cracking Kerberoast TGS-REP hashes using an enterprise wordlist
hashcat -m 13100 -a 0 kerberoast_tgs.txt /usr/share/wordlists/passwords.txt -r /usr/share/hashcat/rules/d3ad0ne.rule
Tip
In forensic investigations where evidentiary hashes must be cracked against strict deadlines, always execute an initial pass using -a 0 with a focused breach wordlist, followed by a targeted -a 3 mask attack reflecting the suspect's known password complexity requirements before committing computational resources to long-running rule-based attacks.
John the Ripper (JtR) & Evidentiary Container Hash Extraction
While Hashcat is engineered primarily for GPU-based dictionary and mask operations, John the Ripper (JtR) , maintained by the Openwall project (specifically the community-enhanced JtR Jumbo suite), remains a premier CPU-based and OpenCL-capable cracking framework. JtR is distinguished by its automated cracking modes and its collection of container hash extraction utilities.
Core John the Ripper Cracking Modes
Single Crack Mode ( --single ):
The fastest initial cracking mode. JtR inspects the metadata associated with the target hash—such as the user's login name, GECOS field (full name, phone number, office location), home directory path, and email address.
It applies a specialized set of built-in mangling rules to these metadata strings (e.g., testing John , nhoJ , John123 , JSmith ).
Exam Tip: In security and forensic exams, Single Crack mode is cited as the mandatory first step when cracking Unix/Linux shadow files because it tests account-specific permutations before consuming time on general dictionaries.
Wordlist Mode ( --wordlist=[file] ):
Standard dictionary processing. Can be combined with JtR's internal rule engine ( --rules ) to apply leetspeak, truncation, and character casing transformations.
Incremental Mode ( --incremental ):
JtR's most powerful exhaustive cracking mode. Unlike naive brute-force attacks that test permutations sequentially ( aaaa , aaab , aaac ), Incremental mode uses statistical character frequency tables ( .chr files) derived from millions of analyzed passwords.
It attempts the most statistically probable letter and digraph combinations first, maximizing the likelihood of cracking within finite timeframes.
External Mode ( --external=[mode] ):
Allows examiners to write custom C-like filter and generation routines executed by JtR's internal virtual compiler at runtime.
The *2john Tool Suite: Extracting Evidentiary Container Hashes
Encrypted containers (ZIP archives, RAR files, PDFs, BitLocker volumes) cannot be fed directly into Hashcat or JtR as raw binary files. The cryptographic parameters—such as the salt, iteration count, initialization vector (IV), and encrypted verification payload—must first be parsed from the file's container header.
JtR Jumbo provides specialized Perl and Python extractors named *2john that output standardized hash strings suitable for cracking: +----------------------------+ *2john Utility +-------------------------------+
- | Encrypted Evidence File | ----------------------> | Standardized Hash String |
- | (.zip, .rar, .pdf, volume) | | ($zip$*0*1*... / $pdf$*4*...) |
- +----------------------------+ +-------------------------------+
- |
- v
- +-----------------------------+
- | John the Ripper / Hashcat |
- | Offline Recovery Engine |
- +-----------------------------+
- 1. zip2john (Encrypted ZIP Archives)
Extracts the encryption header from legacy PKZIP stream-encrypted archives or modern WinZip AES-128/256 containers: zip2john evidence_archive.zip > zip.hash
- john --format=zip zip.hash --wordlist=/usr/share/wordlists/rockyou.txt
- 2. rar2john (Encrypted RAR Archives)
Parses encryption metadata from RAR3 (AES-128, 262,144 SHA-1 iterations) and RAR5 (AES-256, PBKDF2 with HMAC-SHA256): rar2john financial_records.rar > rar.hash
- john --format=rar rar.hash --wordlist=/usr/share/wordlists/rockyou.txt
- 3. pdf2john (Password-Protected Adobe PDF Documents)
Extracts revision data, permission bytes, and User Password hash strings across standard PDF encryption revisions (Revision 2 [40-bit RC4], Revision 3 [128-bit RC4], Revision 4 [128-bit AES], and Revision 5/6 [256-bit AES]): pdf2john sensitive_contract.pdf > pdf.hash
- john --format=pdf pdf.hash --wordlist=/usr/share/wordlists/rockyou.txt
- 4. bitlocker2john (Windows BitLocker Encrypted Volumes)
Extracts the BitLocker Volume Master Key (VMK) encrypted header, Salt, and user password / recovery password hashes from raw disk partitions: bitlocker2john -i /dev/sdb1 > bitlocker.hash
- # The output hash can be cracked using JtR or passed to Hashcat using mode -m 22100
- hashcat -m 22100 -a 0 bitlocker.hash /usr/share/wordlists/rockyou.txt
Warning
Password cracking on forensic evidence must never be performed directly against the original physical media. Hashes must be extracted from verified bit-stream forensic images ( .E01 or .raw ), and cracking activities must take place on dedicated analysis workstations equipped with adequate GPU cooling and secure storage for recovered plaintexts.