Credential & hash cracking

When it applies

You've captured something crackable — an application DB hash, a Windows NTLM/NetNTLMv2 hash, a Kerberos ticket (ad-kerberoasting), or a WPA2 handshake — and the plaintext unlocks the next step (login, lateral movement, privesc). This is the offline counterpart to network-password-spraying.

Why it works

Most stored credentials are one-way hashes, but users pick guessable passwords and many hash schemes are fast to compute. Given the format, you brute the hash offline against a wordlist (optionally mutated by rules) at millions/billions of guesses per second — no lockout, no network.

Method

1. Identify the format first — this is the whole game. hashid/haiti on the sample, and look at the shape: $2b$ = bcrypt, $6$ = sha512crypt, $argon2 = Argon2, pbkdf2:sha256:... = Werkzeug PBKDF2, $krb5tgs$ = Kerberoast, $krb5asrep$ = AS-REP. A wrong mode wastes hours.
2. Map to the mode: