# Module Pentest Crypto - Rex::Crypto

> **Parent Agent**: Rex (pentest.md)
> **Sources**: bb-kali-linux-pentest-full.json, hard-hatter-hacking.json
> **Focus**: Hash Cracking, Password Attacks, Cryptography

---

## Specialisation

Ce module couvre le cracking et la cryptanalyse:
- Hash Cracking (Hashcat, John)
- Password Attacks (Dictionary, Brute-force, Mask)
- Common Hash Types (MD5, SHA, NTLM)
- Online Password Attacks
- Rainbow Tables
- Wordlist Generation

---

## HASH TYPES - Reference

### Hash Identification

```bash
# hash-identifier
hash-identifier
[paste hash]

# hashid
hashid -m "HASH_VALUE"

# Identification visuelle
# 32 chars hex = MD5
# 40 chars hex = SHA1
# 64 chars hex = SHA256
# 128 chars hex = SHA512
# 32 chars avec ":" = NTLM (Windows)
# $1$ = MD5crypt
# $5$ = SHA256crypt
# $6$ = SHA512crypt
# $2a$, $2b$, $2y$ = bcrypt
```

### Hashcat Mode Numbers

```bash
# Common modes
-m 0      # MD5
-m 100    # SHA1
-m 1400   # SHA256
-m 1700   # SHA512
-m 1000   # NTLM (Windows)
-m 3000   # LM (Legacy Windows)
-m 500    # md5crypt ($1$)
-m 7400   # sha256crypt ($5$)
-m 1800   # sha512crypt ($6$)
-m 3200   # bcrypt
-m 2500   # WPA/WPA2
-m 22000  # WPA-PBKDF2-PMKID+EAPOL
-m 13100  # Kerberos TGS-REP
-m 18200  # Kerberos AS-REP
-m 5600   # NetNTLMv2

# Liste complete
hashcat --help | grep -A 500 "Hash modes"
# Ou: https://hashcat.net/wiki/doku.php?id=example_hashes
```

---

## HASHCAT - Guide Complet

### Installation & Benchmark

```bash
# Installer (Kali)
apt install hashcat

# Benchmark GPU
hashcat -b

# Benchmark mode specifique (NTLM)
hashcat -m 1000 -b

# Options benchmark
hashcat -m 1000 -w 3 -b
# -w 3 = High performance workload
```

### Workload Profiles

```markdown
| Profile | Performance | Desktop Impact |
|---------|-------------|----------------|
| -w 1    | Low         | Minimal        |
| -w 2    | Default     | Noticeable     |
| -w 3    | High        | Unresponsive   |
| -w 4    | Nightmare   | Headless only  |
```

### Attack Modes (-a)

```bash
# -a 0 : Dictionary/Wordlist (Straight)
# -a 1 : Combinator (2 wordlists)
# -a 3 : Mask/Brute-force
# -a 6 : Hybrid: Wordlist + Mask
# -a 7 : Hybrid: Mask + Wordlist
```

### Dictionary Attack (-a 0)

```bash
# Basique
hashcat -a 0 -m 1000 hashes.txt wordlist.txt

# Avec output
hashcat -a 0 -m 1000 -o cracked.txt hashes.txt wordlist.txt

# Avec rules
hashcat -a 0 -m 1000 hashes.txt wordlist.txt -r rules/best64.rule

# Multiple rules
hashcat -a 0 -m 1000 hashes.txt wordlist.txt -r rules/best64.rule -r rules/toggles1.rule

# Rules disponibles (du plus petit au plus grand)
/usr/share/hashcat/rules/best64.rule
/usr/share/hashcat/rules/rockyou-30000.rule
/usr/share/hashcat/rules/generated2.rule
/usr/share/hashcat/rules/dive.rule
```

### Mask Attack (-a 3)

```bash
# Built-in charsets
# ?l = lowercase (a-z)
# ?u = uppercase (A-Z)
# ?d = digits (0-9)
# ?s = special (!@#$%...)
# ?a = all printable (?l?u?d?s)
# ?h = hex lowercase (0-9a-f)
# ?H = hex uppercase (0-9A-F)

# 8 caracteres lowercase
hashcat -a 3 -m 1000 hashes.txt ?l?l?l?l?l?l?l?l

# Avec increment (1-8 caracteres)
hashcat -a 3 -m 1000 hashes.txt ?l?l?l?l?l?l?l?l --increment

# 8 caracteres all printable
hashcat -a 3 -m 1000 hashes.txt ?a?a?a?a?a?a?a?a

# Custom charset
# Premier caractere upper ou lower, reste lower, 4 digits
hashcat -a 3 -m 1000 -1 ?l?u ?1?l?l?l?l?l?l?l?d?d?d?d hashes.txt

# Static + mask
hashcat -a 3 -m 1000 hashes.txt Password?d?d?d?d

# Utiliser mask files
hashcat -a 3 -m 1000 hashes.txt /usr/share/hashcat/masks/rockyou-1-60.hcmask
```

### Combinator Attack (-a 1)

```bash
# Combiner 2 wordlists
hashcat -a 1 -m 1000 hashes.txt wordlist1.txt wordlist2.txt

# Avec rules (left et right)
# -j : rule sur wordlist gauche
# -k : rule sur wordlist droite
hashcat -a 1 -m 1000 hashes.txt wordlist1.txt wordlist2.txt -j '$-' -k '$!'
# Resultat: word1-word2!
```

### Hybrid Attacks (-a 6 / -a 7)

```bash
# Wordlist + Mask (-a 6)
# Ajouter 4 digits apres chaque mot
hashcat -a 6 -m 1000 hashes.txt wordlist.txt ?d?d?d?d

# Ajouter caractere special + 2 digits
hashcat -a 6 -m 1000 hashes.txt wordlist.txt ?s?d?d

# Mask + Wordlist (-a 7)
# Prefixer avec 2 digits
hashcat -a 7 -m 1000 hashes.txt ?d?d wordlist.txt
```

### Options Avancees

```bash
# Reprendre session
hashcat --restore

# Session nommee
hashcat -a 0 -m 1000 hashes.txt wordlist.txt --session=mycrack
hashcat --session=mycrack --restore

# Potfile (deja crackes)
hashcat --potfile-path=custom.pot ...

# Force (ignorer warnings)
hashcat --force ...

# Show cracked
hashcat -m 1000 hashes.txt --show

# Left (non crackes)
hashcat -m 1000 hashes.txt --left

# Username dans hash file
hashcat -a 0 -m 1000 hashes.txt wordlist.txt --username
```

---

## JOHN THE RIPPER

### Commandes de Base

```bash
# Crack avec wordlist
john --wordlist=/usr/share/wordlists/rockyou.txt hashes.txt

# Autodetect format
john hashes.txt

# Specifier format
john --format=NT hashes.txt
john --format=Raw-MD5 hashes.txt
john --format=sha512crypt hashes.txt

# Lister formats
john --list=formats

# Voir resultats
john --show hashes.txt

# Rules
john --wordlist=rockyou.txt --rules hashes.txt

# Incremental (brute-force)
john --incremental hashes.txt

# Single crack mode (username based)
john --single hashes.txt
```

### Unshadow (Linux)

```bash
# Combiner passwd et shadow
unshadow /etc/passwd /etc/shadow > hashes.txt

# Cracker
john hashes.txt
```

### John2Hashcat

```bash
# Convertir format John vers Hashcat
# Utiliser les outils *2john.py

# ZIP
zip2john file.zip > hash.txt

# RAR
rar2john file.rar > hash.txt

# PDF
pdf2john file.pdf > hash.txt

# SSH key
ssh2john id_rsa > hash.txt

# Office
office2john file.docx > hash.txt

# KeePass
keepass2john database.kdbx > hash.txt
```

---

## WORDLISTS & GENERATION

### Wordlists Standard

```bash
# RockYou (14M passwords)
/usr/share/wordlists/rockyou.txt.gz
gunzip /usr/share/wordlists/rockyou.txt.gz

# SecLists
/usr/share/seclists/Passwords/

# Crackstation (1.5B passwords - download)
https://crackstation.net/crackstation-wordlist-password-cracking-dictionary.htm
```

### CUPP (Custom User Passwords)

```bash
# Profiler une personne
cupp -i
# Repondre aux questions (nom, dates, pets, etc.)
# Genere wordlist personnalisee

# Mode interactif
python3 cupp.py -i
```

### CeWL (Custom Wordlist)

```bash
# Extraire mots d'un site web
cewl https://target.com -w wordlist.txt

# Options
cewl https://target.com -d 2 -m 5 -w wordlist.txt
# -d 2 : depth 2
# -m 5 : minimum 5 caracteres
```

### Crunch (Wordlist Generator)

```bash
# Generer wordlist
crunch <min> <max> <charset> -o wordlist.txt

# 8 caracteres lowercase
crunch 8 8 abcdefghijklmnopqrstuvwxyz -o wordlist.txt

# Pattern
crunch 8 8 -t @@@@%%%% -o wordlist.txt
# @ = lowercase
# , = uppercase
# % = digits
# ^ = special

# Exemple: Password + 4 digits
crunch 12 12 -t Password%%%% -o wordlist.txt
```

### Merger et Dedupe

```bash
# Fusionner wordlists
cat *.txt > merged.txt

# Supprimer doublons
sort merged.txt | uniq > unique.txt

# One-liner
cat *.txt | sort -u > final_wordlist.txt
```

---

## ONLINE ATTACKS

### Hydra

```bash
# SSH
hydra -l admin -P wordlist.txt ssh://192.168.1.100

# FTP
hydra -l admin -P wordlist.txt ftp://192.168.1.100

# HTTP POST Form
hydra -l admin -P wordlist.txt 192.168.1.100 http-post-form "/login:user=^USER^&pass=^PASS^:Invalid"

# HTTP Basic Auth
hydra -l admin -P wordlist.txt 192.168.1.100 http-get /admin

# SMB
hydra -l admin -P wordlist.txt smb://192.168.1.100

# MySQL
hydra -l root -P wordlist.txt mysql://192.168.1.100

# Options utiles
-t 4     # Threads (defaut 16)
-V       # Verbose
-f       # Stop au premier succes
-s PORT  # Port custom
```

### Medusa

```bash
# SSH
medusa -h 192.168.1.100 -u admin -P wordlist.txt -M ssh

# FTP
medusa -h 192.168.1.100 -u admin -P wordlist.txt -M ftp

# MySQL
medusa -h 192.168.1.100 -u root -P wordlist.txt -M mysql
```

### Ncrack

```bash
# SSH
ncrack -p ssh -U users.txt -P wordlist.txt 192.168.1.100

# RDP
ncrack -p rdp -U users.txt -P wordlist.txt 192.168.1.100
```

---

## CRACKING WORKFLOW

### Methodologie Recommandee

```markdown
## Ordre d'attaque (du plus rapide au plus lent)

1. **Profiling** (si cible connue)
   - cupp.py pour generer wordlist personnalisee
   - cewl sur site web de la cible
   - Dictionary attack + Best64 rule

2. **Dictionary basique**
   - rockyou.txt + Best64 rule
   - Time: ~minutes

3. **Brute-force court**
   - ?a?a?a?a?a?a?a?a (8 chars max)
   - Time: ~heures

4. **Dictionary avance**
   - Large wordlist + Best64 rule
   - Time: ~heures

5. **Mask files**
   - rockyou-1-60.hcmask
   - Time: ~heures

6. **Hybrid attacks**
   - Wordlist + ?s?d?d
   - ?d?d + wordlist
   - Time: ~heures

7. **Dictionary + rules lourdes**
   - Large wordlist + Generated2/Dive rule
   - Time: ~jours

8. **Combinator**
   - rockyou + rockyou
   - Time: ~jours

9. **Mask avance**
   - rockyou-7-2592000.hcmask
   - Time: ~semaines
```

### Exemple Complet NTLM

```bash
# 1. Identifier le hash
hashid -m "209c6174da490caeb422f3fa5a7ae634"
# Output: NTLM -> -m 1000

# 2. Quick wins
hashcat -a 0 -m 1000 hash.txt /usr/share/wordlists/rockyou.txt -r /usr/share/hashcat/rules/best64.rule

# 3. Si echec: mask basique
hashcat -a 3 -m 1000 hash.txt ?a?a?a?a?a?a?a?a --increment

# 4. Si echec: hybrid
hashcat -a 6 -m 1000 hash.txt /usr/share/wordlists/rockyou.txt ?d?d?d?d

# 5. Verifier resultat
hashcat -m 1000 hash.txt --show
```

---

## RAINBOW TABLES

### Concept

```markdown
## Trade-off Time vs Space

- **Brute-force**: CPU time, pas de stockage
- **Rainbow Tables**: Pre-calcule, stockage massif

## Limitations
- Specifique a un algorithme
- Ne fonctionne pas avec salt
- Fichiers enormes (TB)
```

### RainbowCrack

```bash
# Telecharger tables
# http://project-rainbowcrack.com/table.htm

# Utiliser
rcrack . -h HASH_VALUE
rcrack /path/to/tables -h HASH_VALUE

# Ou online
# https://crackstation.net/
# https://hashes.com/en/decrypt/hash
```

---

## COMMANDES MODULE

| Commande | Description |
|----------|-------------|
| `*hash-identify` | Identifier type de hash |
| `*crack-hashcat` | Crack avec Hashcat |
| `*crack-john` | Crack avec John |
| `*wordlist-gen` | Generer wordlist |
| `*online-brute` | Attaque online (Hydra) |

---

## OUTILS

| Outil | Usage |
|-------|-------|
| **Hashcat** | GPU hash cracking |
| **John** | CPU hash cracking |
| **Hydra** | Online brute-force |
| **Medusa** | Online brute-force |
| **CeWL** | Wordlist from website |
| **CUPP** | Custom wordlist |
| **Crunch** | Wordlist generator |
| **hash-identifier** | Hash type detection |

---

## REFERENCES

- **bb-kali-linux-pentest-full.json** - Ch.13 (Cryptography & Hash Cracking)
- **hard-hatter-hacking.json** - Ch.15 (Criptografia)
- Hashcat Wiki: https://hashcat.net/wiki/
- SecLists: https://github.com/danielmiessler/SecLists
