YanoSec
Progress0 of 152 lessons complete

Course / 12 Testing / Lesson 02 of 11

Hydra, John, and Hashcat on a lab

Estimated time: 16 min reading · 16 min activity

Choose a tool by what it takes as input and where it acts. Hydra is a network-login testing tool, so its role involves a service. John the Ripper and Hashcat include offline password-recovery workflows using supported stored data. A role description is not permission or a ready command.

A format tells a recovery tool how to interpret a stored verification value and derive comparisons. These cards contain assigned labels, not a validated hash format, so there is no meaningful John/Hashcat format command to run. The task is a paper comparison of three supplied labels.

Before you begin

Estimated time
16 min reading, 16 min activity. Setup and optional practice may take longer.
Where you work
Use only the supplied North Desk fictional cards and source in a desktop or mobile browser. Keep predictions in private notes. No login attempt, recovery tool, framework module, permission change, domain setup or target connection is required. Optional later lab setup has a separate budget.
Without a lab
All evidence needed for the activity appears on this page. Copy it into notes if downloads are unavailable. Read the labeled model and predict each result; a paper trace practises the reasoning while tool operation waits for a lab. Reading needs no JavaScript. Answer checking needs JavaScript and a secure context; saving progress also needs usable browser storage.

After this lesson you can:

  • Place Hydra on the service side and John and Hashcat on the local-file side.
  • Compare three assigned labels with V-cedar and stop at the third.
  • Record that no format was selected and no command was run.

01Example

Fresh role-selection plan, separate from the activity’s V-cedar data.

Plan W: input is a permitted local stored-value file.
No service endpoint is supplied.
Need before real tool use: known format, supported tool/version and explicit scope.
This worksheet substitutes assigned labels so the comparison can be read directly.

02Role before command

A candidate set is the bounded list supplied for a task. The budget here is exactly three label comparisons, then stop whether a match appears or not. A larger wordlist or a network host would change that task.

John and Hashcat support many constructions, but a guessed format can produce misleading results. The V- labels here are neither real password hashes nor the earlier checksum. Treating them as real recovery input would teach the wrong operation. Tool installation and realistic format validation remain separate later work.

Match tool roles to the evidence and keep an assigned three-comparison budget.Model. A teaching model drawn by hand. It shows the idea, not real tool output.

Read the full explanation below.

Plan W: local stored-value file
Plan W: local stored-value file

Permitted local file; no service endpoint supplied

Known stored-value formatLater or not established
Supported tool and versionLater or not established
Explicit operational scopeLater or not established
Input role is local

A permitted stored-value file is supplied; no endpoint is named.

Assigned worksheet labels substitute for real tool use.

A permitted stored-value file is supplied; no endpoint is named. Assigned worksheet labels substitute for real tool use.

Follow the explanation

  1. A permitted stored-value file is supplied; no endpoint is named. Assigned worksheet labels substitute for real tool use.
  2. Format, supported tool/version and explicit scope are still needed. No tool or login attempt is launched.
Read every state and value

1. A permitted stored-value file is supplied; no endpoint is named. Assigned worksheet labels substitute for real tool use.

Task
Plan W: local stored-value file
Choice
input
Relevant skills
Known stored-value format

2. Format, supported tool/version and explicit scope are still needed. No tool or login attempt is launched.

Task
Plan W: local stored-value file
Choice
ready
Relevant skills
Known stored-value format · Supported tool and version · Explicit operational scope
Tool role follows evidence and permission; V-label comparisons are not real recovery input.

03Compare the three labels

Read synthetic-verifier.txt and tiny-candidates.txt. Their values are synthetic; keep them out of all login forms.

North Desk local verifier
Label: original fictional record. These labels were assigned. They are not output from a password hash, and they are not real password hashes.

Account: desk-lab
Stored label: V-cedar
Rule: compare each candidate's assigned label with V-cedar. Do not hash and do not decrypt.
Budget: 3
Stop: after the third candidate, whether or not a label matches.
Network: none. No service name is part of this record.

Download the assigned verifier record

Three synthetic candidates
Label: original fictional list. There is no fourth line.

1 amber assigned V-amber
2 birch assigned V-birch
3 cedar assigned V-cedar

amber, birch, and cedar are card words. Do not try them on a login.

Download the three candidate labels

Tool plan for the local verifier
Label: original plan. No tool was installed or run.

Hydra, from its manual name line: a network logon cracker. Role on this plan: service-facing. Command: none.
John the Ripper, from its homepage: a password recovery tool. Role on this plan: local verifier file. Command: none.
Hashcat, from its homepage: password recovery. Role on this plan: local verifier file. Command: none.

Chosen for synthetic-verifier.txt: local label comparison.
Format: not selected. No hash type was validated.
Candidate set: the three lines in tiny-candidates.txt.
Budget: 3.
Stop: after cedar, or sooner if you leave the file.
A tool that can contact a service is the wrong role for a file that names no service.

Download the tool-role plan

  1. Copy the fixed stored label V-cedar and budget three. Note the absence of a service endpoint.
  2. Compare the assigned values V-amber, V-birch and V-cedar in order. The first two differ; the third equals the stored label.
  3. Record position three as the match and three as the completed comparison count. State that equality of assigned labels is not recovered password evidence.
  4. Stop after the third comparison. Do not select a hash mode, add candidates or name a host.

04Passwords case

For about fifteen minutes within the activity estimate, complete the passwords module note. Include input provenance, comparison location, the three-item budget, the observed-on-card label equality and a limit. The prose is self-reviewed against these five points.

Passwords case
Label: ungraded synthesis. About fifteen minutes. Use only this module's cards.

Action: compare the three assigned labels with V-cedar. Stay on the file.
Result to record: which position matches, how many comparisons that used, and that no endpoint was named.
Limit: the labels are not a hash. A match on this card is not a recovered password. The service trace in the previous lesson is a different place of comparison.
Stop: do not add a wordlist, a format flag, or a host.

Rubric: one action line, one result line, one limit line, and a stop. The note is not graded.

Download the ungraded passwords case

  1. Name the stored-value file and the synthetic-label method.
  2. Record the matching position and comparison count without claiming a real hash was cracked.
  3. Describe which service-side control is absent from this local comparison, and keep the separate scope/budget rule.
  4. Stop with the private note; no tool execution is needed.

05Optional challenge

For about ten optional minutes, draft a future tool-selection checklist: exact stored format, compatible tool/version, authorized input source, candidate budget and stop. Leave unknowns blank instead of inventing a command.

06Fresh cases for the checks

Use these fictional cases for the checks below. They have different inputs from the worked examples. Read them here or make notes; no installation or external service is needed.

Tool card A: proposed roles onlyOwned fixture. An original file made for this course. Follow the activity's instructions in your own lab.

Plan H needs checks against a running login service.
Plan J needs local comparisons with a supported stored format.
Plan K also needs local comparisons with a supported stored format.
Tools to classify: Hydra, John the Ripper, Hashcat. No command is requested.

Label card B: independent paper comparisonOwned fixture. An original file made for this course. Follow the activity's instructions in your own lab.

Stored assigned label: V-slate. These are invented labels, not hashes.
1 ember → V-ember
2 slate → V-slate
3 moss → V-moss
Rule: compare all three labels in order, then stop. No endpoint is involved.

Readiness card COwned fixture. An original file made for this course. Follow the activity's instructions in your own lab.

A proposed local-file recovery job has permission and a three-candidate limit.
Input consists only of assigned V- labels. No real hash format or compatible tool format has been established.
No installation or execution is part of this reading.

07Explain the evidence and its limit

Optional self-check: write a local-comparison note with input provenance, method, count, result and stop.

Review it: call these assigned labels; distinguish a tool role from a validated input format; avoid claiming password recovery or authentication.

08Common mistakes

If Hydra is selected just because the subject is passwords, identify the service it would contact. The supplied task names no endpoint.

If V-cedar is called a recovered password, restore its origin as an assigned synthetic label.

If an unsupported format is guessed, stop at method planning; compatibility must be established before meaningful execution.

References