Tools

Recovers the internal keys of legacy ZipCrypto encryption via a known-plaintext attack — give it a few known bytes from any file in the archive and it derives the keys to decrypt the rest.

bkcrack -C secret.zip -c cipher.bin -p plain.bin

Queries Have I Been Pwned's Pwned Passwords range API with only a 5-character SHA-1 prefix, so the full password/hash never leaves your machine, and greps the response for the suffix.

hash=$(printf %s 'password123' | sha1sum | tr 'a-z' 'A-Z' | cut -c1-40)
curl -s "https://api.pwnedpasswords.com/range/${hash:0:5}" | grep -i "${hash:5}"

A misconfigured permission on /etc/shadow hands over every password hash on the box in a single command.

ls -la /etc/shadow
cat /etc/shadow 2>/dev/null

Free online lookup of a hash against a precomputed table of billions of cracked passwords — worth trying before spinning up hashcat for an unsalted common hash.

reg save copies live registry hives to disk so they can be pulled offline and fed to a secrets-dumping tool, no third-party dumper required to obtain them.

reg save HKLM\SAM C:\Windows\Temp\sam.save
reg save HKLM\SYSTEM C:\Windows\Temp\system.save

Brute-force and dictionary password cracker for ZipCrypto-protected archives — the go-to before reaching for bkcrack's known-plaintext approach.

fcrackzip -u -D -p rockyou.txt secret.zip

Generates a SHA-256 hash list of an entire directory tree in one pass — feed the output into a threat-intel lookup or diff it against a known-good baseline.

find . -type f -exec sha256sum {} \; > hashes.txt

Older interactive Python tool for guessing a hash's algorithm from its format — largely superseded by hashID/Name-That-Hash but still shipped on many distros.

python hash-identifier.py

The world's fastest password-recovery tool — GPU-accelerated cracking across hundreds of hash modes, from a straight dictionary attack to rule-based and mask attacks.

hashcat -m 1000 -a 0 hashes.txt rockyou.txt

Marc Stevens' toolkit for generating MD5 and SHA-1 chosen-prefix collisions — the codebase behind the SHAttered attack, used in CTF challenges that ask you to produce two files with the same weak hash.

Identifies possible hash types from a string and reports the matching Hashcat mode number(s) — a lighter, older tool than Name-That-Hash but still widely referenced.

hashid <hash>

Performs the hash length extension attack against MD5/SHA1/SHA256/SHA512-based MACs, forging a valid hash for attacker-appended data without knowing the secret key.

hashpump -s <hash> -d <data> -k <keylen> -a <append>

Converts hcxdumptool/airodump-ng captures into hashcat/John-crackable formats (22000, PMKID) — the modern replacement for the old cap2hccapx pipeline.

hcxpcapngtool -o hashes.22000 capture.pcapng

A long-standing password cracker supporting hundreds of hash and cipher types, with the community "jumbo" fork adding formats and features far beyond the base distribution.

john --wordlist=rockyou.txt hashes.txt

Identifies the likely algorithm(s) behind a hash string and can hand off straight into Hashcat/John — a modern, actively maintained replacement for hashID/hash-identifier.

nth -t <hash>

Fuzzy (context-triggered piecewise) hashing tool for measuring similarity between files rather than exact equality — used to cluster near-identical malware samples or CTF file variants.

ssdeep -r samples/

Trend Micro's locality-sensitive fuzzy hash, an alternative to ssdeep with better resistance to certain evasion tricks, used for file/malware similarity matching.