1 1 00:00:00,870 --> 00:00:02,220 Hashcat. 2 2 00:00:02,220 --> 00:00:04,320 Hashcat is the last enumeration tool 3 3 00:00:04,320 --> 00:00:05,700 we want to talk about. 4 4 00:00:05,700 --> 00:00:06,900 Now, the reason we're bringing this up 5 5 00:00:06,900 --> 00:00:08,490 is because we just talked about the fact 6 6 00:00:08,490 --> 00:00:10,680 that you might want to brute force a password, 7 7 00:00:10,680 --> 00:00:12,840 such as a hash that you've collected over the network 8 8 00:00:12,840 --> 00:00:14,970 or something like a wireless password. 9 9 00:00:14,970 --> 00:00:17,760 And to do that, you're going to use something like hashcat. 10 10 00:00:17,760 --> 00:00:19,470 Hashcat is a command line tool 11 11 00:00:19,470 --> 00:00:21,000 that's used to perform brute force 12 12 00:00:21,000 --> 00:00:24,060 and dictionary attacks against password hashes. 13 13 00:00:24,060 --> 00:00:26,730 Now, hashcat could be really slow in the old days. 14 14 00:00:26,730 --> 00:00:28,650 The reason for this is you'd have to actually guess 15 15 00:00:28,650 --> 00:00:31,800 every single option as you're going through those hashes. 16 16 00:00:31,800 --> 00:00:33,990 But smart people had figured out 17 17 00:00:33,990 --> 00:00:35,610 there's a quicker way of doing this. 18 18 00:00:35,610 --> 00:00:37,620 Instead of relying on the CPU, 19 19 00:00:37,620 --> 00:00:41,550 let's rely on the GPU, or graphical processing units. 20 20 00:00:41,550 --> 00:00:44,070 Now, GPUs can be relied on by hashcat 21 21 00:00:44,070 --> 00:00:47,190 to perform the brute force cracking much quickly. 22 22 00:00:47,190 --> 00:00:48,240 Why is that? 23 23 00:00:48,240 --> 00:00:51,180 Well, because GPUs are made to do complex math 24 24 00:00:51,180 --> 00:00:52,890 in a very quick fashion. 25 25 00:00:52,890 --> 00:00:54,510 When you create graphics on a screen, 26 26 00:00:54,510 --> 00:00:57,090 it takes a lot of mathematical computations. 27 27 00:00:57,090 --> 00:00:59,850 And so these GPUs are extremely fast 28 28 00:00:59,850 --> 00:01:02,010 at churning out things for mathematics 29 29 00:01:02,010 --> 00:01:03,840 that would create those 3D graphics, 30 30 00:01:03,840 --> 00:01:07,170 and that same technology can be used for password cracking. 31 31 00:01:07,170 --> 00:01:08,970 For instance, here you can see a rig 32 32 00:01:08,970 --> 00:01:11,490 that is one of five servers that somebody put together. 33 33 00:01:11,490 --> 00:01:13,200 They put these five servers together 34 34 00:01:13,200 --> 00:01:15,510 and each of them had a bunch of GPUs. 35 35 00:01:15,510 --> 00:01:18,150 Together, they had 25 GPUs. 36 36 00:01:18,150 --> 00:01:22,590 Now, this rig was able to crack 348 billion, 37 37 00:01:22,590 --> 00:01:23,850 billion with a B, 38 38 00:01:23,850 --> 00:01:25,470 hashes per second. 39 39 00:01:25,470 --> 00:01:27,300 Now, luckily, this machine was built 40 40 00:01:27,300 --> 00:01:29,130 all the way back in 2012 41 41 00:01:29,130 --> 00:01:32,220 and it focused on LANMAN and NTLM hashes, 42 42 00:01:32,220 --> 00:01:34,800 both of which only took a few minutes to crack. 43 43 00:01:34,800 --> 00:01:37,740 But you can see here just the power of using these GPUs 44 44 00:01:37,740 --> 00:01:39,300 over traditional CPUs 45 45 00:01:39,300 --> 00:01:41,580 when you're conducting this type of hash cracking. 46 46 00:01:41,580 --> 00:01:43,860 Now, our modern hashes like SHA256 47 47 00:01:43,860 --> 00:01:46,950 are much more resilient to this type of attack, thankfully. 48 48 00:01:46,950 --> 00:01:49,260 But if you have enough GPUs put together, 49 49 00:01:49,260 --> 00:01:50,550 you could put together enough power 50 50 00:01:50,550 --> 00:01:52,290 to crack those things as well, 51 51 00:01:52,290 --> 00:01:54,090 and that's one of the things that we really worry about 52 52 00:01:54,090 --> 00:01:55,440 in the security industry. 53 53 00:01:55,440 --> 00:01:56,880 If people can get enough power, 54 54 00:01:56,880 --> 00:01:58,980 they can start cracking a lot of the passwords 55 55 00:01:58,980 --> 00:02:00,540 and security that we use. 56 56 00:02:00,540 --> 00:02:02,760 So how do you use hashcat? 57 57 00:02:02,760 --> 00:02:04,110 Well, it's pretty easy. 58 58 00:02:04,110 --> 00:02:06,060 It's actually a command line program, like I said. 59 59 00:02:06,060 --> 00:02:08,100 So you just type in the word hashcat, 60 60 00:02:08,100 --> 00:02:10,380 and then -m and give it the hash type, 61 61 00:02:10,380 --> 00:02:12,000 for instance MD5, 62 62 00:02:12,000 --> 00:02:13,800 then -a and the attack mode. 63 63 00:02:13,800 --> 00:02:16,050 Do you want to do brute force or dictionary attack? 64 64 00:02:16,050 --> 00:02:18,420 And then -o and you give it the output file. 65 65 00:02:18,420 --> 00:02:20,070 Where do you want to save your information to? 66 66 00:02:20,070 --> 00:02:21,660 And then you have to give it an input file 67 67 00:02:21,660 --> 00:02:23,070 with all those hashes. 68 68 00:02:23,070 --> 00:02:25,230 That's it, one simple line of code 69 69 00:02:25,230 --> 00:02:27,390 and you can start cracking hashes. 70 70 00:02:27,390 --> 00:02:29,130 When you do that, it's going to give you a screen 71 71 00:02:29,130 --> 00:02:30,900 that looks like this, and it's going to start running. 72 72 00:02:30,900 --> 00:02:32,400 It's going to tell you what kind of hash it's looking at. 73 73 00:02:32,400 --> 00:02:34,860 In this case, LTLM version two. 74 74 00:02:34,860 --> 00:02:37,320 It's telling you the hash target that it's going after, 75 75 00:02:37,320 --> 00:02:38,790 what the time started was, 76 76 00:02:38,790 --> 00:02:40,770 what the estimated time of completion is, 77 77 00:02:40,770 --> 00:02:43,170 and how many guesses it's going through. 78 78 00:02:43,170 --> 00:02:44,730 In this case, we're just trying to crack 79 79 00:02:44,730 --> 00:02:48,060 one administrator hash, but how fast can it do it? 80 80 00:02:48,060 --> 00:02:50,490 Well, if you look at the speed line, it tells you. 81 81 00:02:50,490 --> 00:02:54,960 It's currently doing 364,000 hashes per second. 82 82 00:02:54,960 --> 00:02:56,820 Now this is just on somebody's standard laptop. 83 83 00:02:56,820 --> 00:02:59,700 This isn't even using a full, dedicated GPU rig 84 84 00:02:59,700 --> 00:03:00,990 like I showed you earlier. 85 85 00:03:00,990 --> 00:03:01,823 So this just shows you 86 86 00:03:01,823 --> 00:03:04,740 how powerful using something like hashcat can be. 87 87 00:03:04,740 --> 00:03:07,530 Now, for the exam, do you need to know how to use hashcat? 88 88 00:03:07,530 --> 00:03:08,820 No, you don't. 89 89 00:03:08,820 --> 00:03:10,830 But you should know that hashcat is used 90 90 00:03:10,830 --> 00:03:11,970 for brute force attacks. 91 91 00:03:11,970 --> 00:03:14,670 And if you know that much, you'll do fine on the exam.