Hash identification, mutation rules, and scenario-driven cracking
Intermediate crypto engagement: haiti/hashcat/john workflow for exotic digests, John rule mangling and custom wordlists (Mentalist, CeWL, TTPassGen), then nine scenario hashes recovered from Password Advisor context.
Identified uncommon digests, built mutation rules and topic wordlists, then cracked nine engagement hashes using scenario hints from the Password Advisor portal.
haiti typed digests; a custom THM01 border rule recovered moonlight56 from SHA1.
Mentalist/CeWL/TTPassGen built lists; Password Advisor scenarios unlocked all nine challenge hashes.
Engagement summary
Identified uncommon digests, built mutation rules and topic wordlists, then cracked nine engagement hashes using scenario hints from the Password Advisor portal.
CRACK THE HASH LEVEL 2 was an offline credential-recovery engagement. haiti classified samples (RIPEMD-320; Keccak-256 → hashcat 17800 / john raw-keccak-256). John rules (border append of two digits) cracked a SHA1 to moonlight56. Mentalist mutations on a dogs wordlist recovered mOlo$$u$; TTPassGen PIN×alpha combinations cracked 1551-li. Against the live Password Advisor site, nine hashes mapped to advice-driven secrets (names+years, leetspeak, reversed phrases, phone formats, padded words, $6$ sha512crypt kakashi1).
Business impact
Predictable password patterns and weak KDFs fall to rule-based and topic wordlists. Prefer Argon2/bcrypt with unique salts, enforce length/complexity that resists common mutations, and monitor for bulk hash dumps leaving the estate.
Hash ID and John mutation rules
haiti typed digests; a custom THM01 border rule recovered moonlight56 from SHA1.
OPERATOR · HAITI / JOHN
savvy@lab:~$ haiti 741ebf5166b9ece4cca88a3868c44871e8370707cf19af3ceaa4a6fba006f224ae03f39153492853
RIPEMD-320
savvy@lab:~$ haiti 1aec7a56aa08b25b596057e1ccbcb6d768b770eaa0f355ccbd56aee5040e02ee
Keccak-256 hashcat:17800 john:raw-keccak-256
savvy@lab:~$ john hash.txt --format=raw-sha1 --wordlist=/usr/share/seclists/Passwords/Common-Credentials/10k-most-common.txt --rules=THM01
moonlight56
JOHN RULE
john-local.conf
[List.Rules:THM01]
$[0-9]$[0-9]Custom wordlists and scenario cracks
Mentalist/CeWL/TTPassGen built lists; Password Advisor scenarios unlocked all nine challenge hashes.
OPERATOR · CRACK
savvy@lab:~$ hashcat -m 0 ed91365105bba79fdab20c376d83d752 dogs_mutated.txt
mOlo$$u$
savvy@lab:~$ hashcat -m 0 e5b47b7e8df2597077e703c76ee86aee combination.txt
1551-li
savvy@lab:~$ john --format=sha512crypt advice9.hash -w=rockyou.txt
kakashi1
Remediation
Ban password reuse of names/phones/quotes. Deploy breached-password blocking. Store only modern slow hashes; rotate any account whose hash left the vault.