Blog
Guides on hash formats, password cracking, hashcat and John the Ripper.
Extract the hash from a locked ZIP, RAR or 7-Zip archive with zip2john / rar2john / 7z2john, pick the right hashcat mode, and crack it without guessing.
Extract the hash from an encrypted id_rsa or id_ed25519 with ssh2john, pick the right hashcat mode for legacy PEM keys, and know when only John the Ripper can touch a modern OpenSSH key.
Extract the hash from an encrypted Word, Excel or PDF file with office2john / pdf2john, then pick the right hashcat mode — 9400 to 10700 — to recover the password.
Memory hardness is the real defense against GPUs and ASICs. How argon2id, bcrypt, scrypt and PBKDF2 compare, how to tune them, and which one to actually pick.
How AS-REP roasting lets an unauthenticated attacker pull a crackable krb5asrep hash from accounts with preauth disabled, and how defenders catch it.
An HS256 token carries everything an attacker needs to verify a guessed secret offline. How weak HMAC keys fall to hashcat -m 16500, and how to forge tokens after.
Poison LLMNR and NBT-NS with Responder to capture a NetNTLMv2 challenge response, crack it with hashcat mode 5600, and know when to relay instead.
Extract DCC2 hashes from a domain-joined host with secretsdump, crack them with hashcat mode 2100, and understand why MS-Cache v2 is slow by design.
Two ways into a WPA2 network: capture the EAPOL handshake or pull a clientless PMKID. How to produce 22000 format and crack it with hashcat, plus why WPA3 resists.