Series
How hash extraction works
15 posts in this series. Read them in order or jump to any one.
- How file-to-hash extraction works
A technical primer on why password-protected files are crackable, what the *2john format does, and how Hash Extractor pulls it off in WebAssembly.
- How PDF password hashes are extracted
A precise look at how the $pdf$ hash is built from an encrypted PDF's /Encrypt dictionary, and how to crack it with hashcat or John the Ripper.
- How KeePass hashes are extracted
A technical walkthrough of how Hash Extractor parses KDB and KDBX 3.x files to produce a crackable $keepass$ hash for hashcat and John the Ripper.
- How SSH and PEM key hashes are extracted
A technical walk-through of how Hash Extractor pulls crackable hashes from encrypted SSH and PEM private keys — entirely in the browser.
- How ZIP password hashes are extracted
A deep look at how Hash Extractor pulls crackable hashes from encrypted ZIPs — WinZip AES and legacy ZipCrypto — entirely in the browser.
- How 7-Zip password hashes are extracted
Why 7z is the trickiest archive to crack: LZMA-compressed headers, AES coder property encoding, and the full $7z$ hash format explained.
- How GPG private key hashes are extracted
A technical walkthrough of how Hash Extractor parses OpenPGP secret key packets to produce a crackable $gpg$ hash for hashcat and John the Ripper.
- How PKCS#12 / PFX hashes are extracted
How Hash Extractor walks the DER PFX structure to pull out the $pfxng$ MAC hash for cracking with John the Ripper's pfx format.
- How MS Office hashes are extracted
How Hash Extractor reads a password-protected .docx, .xlsx, or .pptx and builds the $office$ hash for hashcat or John the Ripper — entirely in the browser.
- How Apple DMG hashes are extracted
A technical walkthrough of how Hash Extractor parses encrypted Apple disk images to produce a crackable $dmg$ hash for John the Ripper.
- How macOS keychain hashes are extracted
A technical walkthrough of how Hash Extractor parses Apple macOS keychain files to produce a crackable $keychain$ hash for hashcat and John the Ripper.
- How iTunes backup hashes are extracted
A technical walkthrough of how Hash Extractor parses a Manifest.plist BackupKeyBag to produce a crackable $itunes_backup$ hash for hashcat and John the Ripper.
- How Android backup hashes are extracted
Inside the adb backup text header: how PBKDF2 salts, round counts, and a master-key blob become a crackable $ab$ hash.
- How Ansible Vault hashes are extracted
A technical walkthrough of how Hash Extractor parses Ansible Vault files to produce a crackable $ansible$ hash for hashcat and John the Ripper.
- How Ethereum wallet hashes are extracted
A technical walkthrough of how Hash Extractor parses Ethereum keystore v3 JSON files to produce a crackable $ethereum$ hash for hashcat and John the Ripper.