Cracking WordPress hashes

We will only need to copy and paste the hash to crack it using hashcat. We can pass the hash directly to hashcat at the command line, encased with single quotes. But first, let’s look up the hashcat mode we need to run for this type of hash. Remember, we can run hashcat –help and examine the output for this, as shown in Figure 8.3:

Figure 8.3 –The “hashcat –help” option, piped to grep to search for “phpass”

With the help of grep, we see that mode 400 is required here. So, we will launch hashcat with attack mode 0 (-a 0) for a wordlist, mode 400 (-m 400) for phpass cracking, our hash, and the wordlist. You can add rules if you need them to increase the likelihood of a successful crack. Without the rules, our command will be hashcat -a 0 -m 400 'hashvaluehere' rockyou.txt, as shown in Figure 8.4:

Figure 8.4 – hashcat mode 400 being...