You've dumped some password hashes. How do you crack them?

Hashes turn up everywhere on the exam — /etc/shadow, the Windows SAM, web app databases, config files, captured NetNTLMv2 from a Responder session. Cracking them is a deterministic process, not guesswork, and the first step is the one people skip.

Identify the hash

You cannot crack what you cannot classify. Use the context (Linux $6$ prefix means sha512crypt; a 32-hex string from the SAM is likely NTLM) and tools like hashid or an online hash identifier to narrow the format. The format dictates the exact mode flag you give the cracker — get it wrong and every guess is hashed differently from the target, so nothing matches.

Pick the tool and mode

• hashcat is GPU-accelerated and fastest; you pass a numeric mode (-m 1000 NTLM, -m 1800 sha512crypt, -m 5600 NetNTLMv2) and an attack mode (-a 0 for wordlist).
• John the Ripper auto-detects many formats and is convenient on CPU-only boxes; unshadow merges passwd and shadow first.

Drive it with wordlists and rules

The standard dictionary attack runs rockyou.txt. Add a rule set (hashcat's best64 or John's --rules) to mutate each word — appending years, capitalising, leetspeak — which catches the overwhelming majority of human passwords without resorting to slow pure brute force.

Crack or relay?

Slow hashes (sha512crypt, bcrypt) may not crack in exam time, so weigh alternatives. A captured NetNTLMv2 hash, for instance, often pays off faster relayed to another host than cracked, since it is deliberately slow to attack offline. (For the SAM/NTLM extract-then-crack flow specifically, see extracting and cracking the NTLM with hashcat.)

What interviewers look for

The disciplined order — classify the hash, set the correct mode, then wordlist-plus-rules — and knowing when slow hashes or relaying change the plan. "I'd just decrypt it" reveals a misunderstanding of how hashes work.