Read as
Last updated: April 29, 2026
Why this module. Cracked hashes power lateral movement. Knowing how to crack quickly turns a low-impact LSASS dump into a Domain Admin compromise.
Why this module. Cracked hashes power lateral movement. Knowing how to crack quickly turns a low-impact LSASS dump into a Domain Admin compromise.
Identify the hash
hashid 'aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0'
# Output: NTLMHashcat modes (the ones you need)
| Mode | Hash |
|---|---|
| 0 | MD5 |
| 100 | SHA1 |
| 1000 | NTLM |
| 5500 | NetNTLMv1 |
| 5600 | NetNTLMv2 |
| 1800 | sha512crypt (Linux) |
| 13100 | Kerberos 5 TGS-REP (Kerberoast) |
| 18200 | Kerberos 5 AS-REP (AS-REP Roast) |
| 22000 | WPA-PBKDF2-PMKID+EAPOL |
Standard attack chain
# 1. Dictionary
hashcat -m 1000 hashes.txt rockyou.txt
# 2. Dictionary + rules (best ROI)
hashcat -m 1000 hashes.txt rockyou.txt -r OneRuleToRuleThemAll.rule
# 3. Hybrid (word + mask)
hashcat -m 1000 hashes.txt rockyou.txt -a 6 ?d?d?d?d
# 4. Mask (brute force)
hashcat -m 1000 hashes.txt -a 3 ?u?l?l?l?l?l?l?d?dGPU economics (2026)
- RTX 4090: ~250 GH/s on NTLM. 8-char Lower+upper+digit cracked in 2-4 hours.
- Cloud GPU rental: ₹100-300/hr.
- Hashcat distributed mode for multi-GPU rigs.
Defender
- Min 14-char passwords + complexity
- Banned-password list (Azure AD Password Protection)
- Detect cracking attempts (offline; not directly observable on the network)
🧠
Check your understanding
Module Quiz · 6 questions
Pass with 80%+ to mark this module complete. Unlimited retries. Each question shows an explanation.
Want this for your team?
Custom team training + practitioner advisory
Beyond the free academy — we run private workshops, vCISO advisory, and red-team exercises tailored to your stack. For Indian SMBs scaling past their first hire.
Book team training call
Replies in 4 working hrs · India-only · Senior consultants