How to extract NTLM Hashes from Wireshark Captures for cracking with Hashcat

This videos shows how to filter a network traffic capture (pcap) to identify Net-NTLMv2 hashes and afterwards extract the relevant information to construct the correct format for cracking with Hashcat.

[@maloseevanschaba7343]

Perfect straight to the point,

[@embracethered]

Thanks for watching!

[@user-ty3iy8bk2l]

Thanks for showing the packet capture! Awesome! Subbed

[@embracethered]

Thanks for the comment! Happy to hear the content is useful. 🙂

[@yhytuncer]

Fun times ! You just got another subscriber my
Friend

[@embracethered]

Thanks for the note, appreciate it!

[@vapeboss8161]

Thank you! You are good

[@embracethered]

Thanks for watching!

[@rivhaaken9763]

Underrated! All im sayin.

[@embracethered]

Thanks for watching and commenting. Much appreciated! 🙂

[@plaverty9]

I just tried this, but the only difference is I was capturing this information over HTTP instead of SMB. Does that make a difference? I ask because I was trying to generate a proof of concept where I controlled the username and password going in, but it wouldn't crack. I tried four different times and it didn't work. Is something different when these are captured over HTTP instead of an SMB connection?

[@embracethered]

Good question. First thought is that it should just work the same, but I haven't tried. Relaying def works, that I have done many times in past.

[@plaverty9]

Thanks. I had a colleague try it too, and got the same result as I did. This is for a pentest proof of concept, so I’m not in position to relay unfortunately.

[@sundowner12449]

👌👌

[@embracethered]

Thanks!

[@SecretCoder-gb9iq]

Sir plz tell me how to extract password from handshake file via wireshark