Skip to content
← Back to projects
Password Cracking: Hashing, Salting & Stretching — cover image
Personal project

Password Cracking: Hashing, Salting & Stretching

From cryptographic theory to a measured demonstration, on an isolated lab

Context

This project complements the honeypot lab with the 'compromised password' angle: how a password is actually stored, why it cannot be 'decrypted', and how industry-standard tools (John the Ripper, Hashcat) automate testing thousands of candidates per second.

Everything ran on the lab's attacker machine (Kali Linux), with no network or external target — only hashes generated locally for the demonstration.

Objectives

  • Understand and demonstrate the properties of a cryptographic hash function (determinism, avalanche effect, irreversibility).
  • Concretely compare cracking speed between a fast algorithm (MD5) and a deliberately slow one (bcrypt).
  • Implement the four main attack families: dictionary, dictionary + mutation rules, mask, pure brute force.
  • Run a realistic multi-user case study (shadow-file style) with passwords of varying strength.

Methodology

  1. 1
    Generating test hashes
    I generated unsalted MD5 / SHA1 / SHA256 hashes, then a salted SHA-512 one via mkpasswd, personally verifying the avalanche effect and the role of the salt.
  2. 2
    Cracking with John the Ripper
    I ran a dictionary attack (rockyou.txt, 14.3 million entries) against test MD5 hashes.
  3. 3
    Cracking with Hashcat
    I ran an MD5 vs bcrypt benchmark, then dictionary, rule-based (best64) and mask/brute-force attacks with keyspace calculations.
  4. 4
    GPU-less environment troubleshooting
    I resolved a chain of OpenCL failures on a VM with no dedicated GPU: a missing software driver, a misplaced environment variable, and insufficient RAM.
  5. 5
    Multi-user case study
    I ran three accounts of increasing strength (a dictionary word, a complexified word, a five-word passphrase) against the same combined attack.

Measured results

MD5 vs bcrypt (benchmark)
3,087,100 H/s vs 119 H/s
bcrypt slowdown factor
about 25,900x
Weak password (dictionary)
cracked
5-word passphrase
not cracked (dictionary + rules exhausted)

Technical troubleshooting

Hashcat requires a working OpenCL backend even for CPU-only use, which was absent by default on this GPU-less VM. Resolving it took me several steps: the expected package (pocl-opencl-icd) did not exist in Kali's repositories, so I installed the mesa-opencl-icd alternative (llvmpipe software rendering) instead.

The OpenCL platform then stayed invisible to Hashcat (0 devices exposed) until I explicitly enabled it via the RUSTICL_ENABLE environment variable. My first attempt at making this persistent failed because I'd placed it in ~/.bashrc, while Kali's default shell is Zsh, which doesn't read that file.

Once I got the device detected, the benchmark still failed with a memory allocation error, which I resolved by raising the VM's allocated RAM from ~2 GB to 8 GB in VMware settings.

Stack and tools

  • Kali Linux on VMware Workstation Pro 17
  • John the Ripper (dictionary attack, MD5 and SHA-512crypt formats)
  • Hashcat (dictionary, best64 rules, mask, brute force, GPU/CPU benchmark)
  • mkpasswd / OpenSSL (test hash generation)
  • Mesa OpenCL (llvmpipe software rendering, GPU-less environment)

Screenshots

Password Cracking: Hashing, Salting & Stretching — screenshot 1 of 5