Manual Hash Generation

Recreate a hash from a plaintext password on Kali — verify cracks, test web app logins, or build /etc/passwd entries.

Ctrl+F: echo -n · md5sum · sha256sum · NTLM · openssl passwd · UTF-16LE

Critical: Use echo -n so no trailing newline is hashed (newline changes the digest).

# Wrong — includes newline
echo "password123" | md5sum
 
# Correct
echo -n "password123" | md5sum
# 482c811da5d5b4bc6d497ffa98491e38  -

Crack recovered hashes → Hashcat · John

---

📌 MD5

When: Legacy web apps, PHP md5(), CTF flags, simple app password storage.

echo -n "password123" | md5sum
echo -n "password123" | openssl dgst -md5

Hashcat: -m 0 · John: --format=raw-md5

---

📌 SHA-1 / SHA-256 / SHA-512

When: Modern web apps, API tokens, file integrity checks.

echo -n "password123" | sha1sum
echo -n "password123" | sha256sum
echo -n "password123" | sha512sum
 
echo -n "password123" | openssl dgst -sha1
echo -n "password123" | openssl dgst -sha256
echo -n "password123" | openssl dgst -sha512

Algorithm	Hashcat -m
SHA-1	100
SHA-256	1400
SHA-512	1700

---

📌 Linux crypt — /etc/passwd / /etc/shadow

When: Writable /etc/passwd privesc, building a user line for Linux.

# MD5 crypt ($1$) — common on older boxes
openssl passwd -1 password123
echo -n 'password123' | openssl passwd -1 -stdin
 
# SHA-512 crypt ($6$) — modern Linux shadow
openssl passwd -6 password123
echo -n 'password123' | openssl passwd -6 -stdin
 
# Example /etc/passwd line (if writable)
# newroot:$6$HASHHERE:0:0::/root:/bin/bash

See OpenSSL > 📌 3) passwd — Password Hash Generation (Privesc) · openssl passwd

Hashcat: -m 500 (md5crypt) · -m 1800 (sha512crypt)

---

📌 NTLM (Windows / AD)

When: Verify NTLM before Pass-the-Hash; compare to secretsdump / hashcat -m 1000 output.

NTLM = MD4 of password encoded as UTF-16LE.

echo -n 'Password123' | iconv -t UTF-16LE | openssl dgst -md4
# or parse: ... | awk '{print $2}'

Python one-liner:

python3 -c "import hashlib; p='Password123'.encode('utf-16le'); print(hashlib.new('md4', p).hexdigest())"

Hashcat: -m 1000 (NTLM) · John: --format=NT

---

📌 NetNTLMv2 (not from plaintext alone)

When: Responder capture — cannot recreate from password without the server challenge. Crack with Hashcat -m 5600.

---

📌 Kerberos — TGS / AS-REP (not manual)

When: From Kerberoast / AS-REP roast tools — use output directly:

nxc ldap DC01.domain.local -u users.txt -p '' --asreproast asreproast.txt
impacket-GetNPUsers domain.local/ -usersfile users.txt -no-pass -format hashcat

Hashcat: -m 13100 (TGS-REP) · -m 18200 (AS-REP)

See Kerberoast · CrackMapExec - nxc > 📌 10) nxc ldap

---

📌 MySQL / MariaDB

When: Testing SQLi or stored password formats.

mysql -u root -p -e "SELECT MD5('password123');"
mysql -u root -p -e "SELECT SHA1('password123');"
mysql -u root -p -e "SELECT PASSWORD('password123');"   # older MySQL — deprecated

---

📌 bcrypt / htpasswd

When: Web apps using bcrypt ($2y$, $2a$).

htpasswd -nbBC 10 user password123
# output: user:$2y$10$...

Hashcat: -m 3200 (bcrypt)

---

📌 Quick reference table

Type	Command	Hashcat -m
MD5	echo -n 'pass' | md5sum	0
SHA-256	echo -n 'pass' | sha256sum	1400
NTLM	echo -n 'pass' | iconv -t UTF-16LE | openssl dgst -md4	1000
md5crypt $1$	openssl passwd -1 pass	500
sha512crypt $6$	openssl passwd -6 pass	1800
bcrypt	htpasswd -nbBC 10 user pass	3200

---

Related Notes

• Hashcat
• John
• OpenSSL
• Kerberoast
• CrackMapExec - nxc
• Reference