> For the complete documentation index, see [llms.txt](https://alham-rizvi.gitbook.io/alhamrizvi/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://alham-rizvi.gitbook.io/alhamrizvi/cryptography/hashing/45.-cracking-strategies.md).

# 45. Cracking Strategies

## Strategy Decision Tree

```
Is hash known? (lookup online first)
    ↓ No
Is it salted?
    ├── No  → Dictionary / Brute-force
    └── Yes → Dictionary with salt rules / Hashcat with salt format
Is wordlist + rules failing?
    └── Try mask attack or combinator attack
Still stuck?
    └── Try Prince attack or PRINCE-based wordlist
```

## 1. Online Lookup (Fastest)

Try before cracking locally:

* <https://crackstation.net>
* <https://hashes.com>
* <https://md5decrypt.net>

## 2. Dictionary Attack

Use a wordlist directly against the hash.

```bash
hashcat -m 0 hash.txt rockyou.txt
john --wordlist=rockyou.txt hash.txt
```

## 3. Dictionary + Rules

Apply transformation rules to each word (leetspeak, append numbers, etc.).

```bash
hashcat -m 0 hash.txt rockyou.txt -r rules/best64.rule
hashcat -m 0 hash.txt rockyou.txt -r rules/OneRuleToRuleThemAll.rule
```

## 4. Brute-Force / Mask Attack

Enumerate all combinations matching a pattern.

```bash
# ?l=lowercase ?u=uppercase ?d=digit ?s=special ?a=all
hashcat -m 0 -a 3 hash.txt ?l?l?l?l?l?l?l?l   # 8 lowercase
hashcat -m 0 -a 3 hash.txt ?u?l?l?l?d?d?d?d   # Capital + 3 lower + 4 digits
```

## 5. Combinator Attack

Combine two wordlists.

```bash
hashcat -m 0 -a 1 hash.txt wordlist1.txt wordlist2.txt
```

## 6. Prince Attack

Chains words from a wordlist into combinations.

```bash
hashcat -m 0 -a 0 hash.txt --prince wordlist.txt
```

## 7. Hybrid Attack

Dictionary word + brute-force suffix/prefix.

```bash
hashcat -m 0 -a 6 hash.txt wordlist.txt ?d?d?d?d   # word + 4 digits
hashcat -m 0 -a 7 hash.txt ?d?d?d?d wordlist.txt   # 4 digits + word
```

## CTF-Specific Tips

* **Context clues**: username as password, challenge name, service name
* **Short hashes** (MD5/SHA1): try online first — saves time
* **bcrypt**: extremely slow to crack, focus on small wordlists
* **Common CTF passwords**: `password`, `flag`, challenge name, `admin123`
* Always try `rockyou.txt` → `rockyou.txt + best64.rule` → mask before giving up


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://alham-rizvi.gitbook.io/alhamrizvi/cryptography/hashing/45.-cracking-strategies.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.