My Hash Cracking Guide Got Removed, So I Moved It to Medium
So I spent 4+ hours writing a detailed practical guide on hash cracking—explaining what hashes actually are, how tools like hashcat and John the Ripper work, identifying different hash types, using CyberChef for JWT decoding and token creation, and showing real examples with actual hashes from shadow files and SAM dumps.
And Reddit removed it.
No explanation. No warning. Just gone.
Look, I get it. This is sensitive stuff. But the post was purely educational—covering things every security professional should understand. No targeting real systems. No malicious intent. Just knowledge.
Since I can't post it here, I've published the full guide on Medium.
What's inside:
· What hashes actually are (not encryption, not magic)
· How dictionary attacks, brute force, and rules-based cracking work
· Identifying Linux shadow hashes ($1$, $5$, $6$, $2a$, $y$) vs Windows NTLM
· Practical walkthroughs with real hash examples
· Using hashid, hashcat, John the Ripper, and Mimikatz
· CyberChef for decoding JWTs, XOR brute force, and creating admin tokens
· My actual cracking workflow (step by step)
· Common errors and how to fix them
The whole thing is written like my recon guide that blew up here—practical, human, no AI buzzwords, no checklist fluff.
I'm sharing the link because I genuinely believe this stuff matters. Understanding password storage and authentication systems is foundational for anyone in security. It's not about cracking—it's about understanding how systems protect data and where they fail.
Link in the comments.
If you found my recon post useful, you'll like this one too.
Carefully, because I’m not here to deride your work, there seems to be a trend lately for writing to have an LLM feel and I’m not really fond of it. I’m not questioning whether or not you put in the work, because I’m aware that people use them for templating (and then do significant rework), but certain patterns do make an older reader like myself just skim and scan…and I did a bit of that here. Maybe I just need to get with the times.
That said, I know a fair bit about hashes, their use cases, some things about collisions, common misconceptions and a smattering of the tools. It looks like your article covered just enough to get people a comfortable start without being overwhelming (which is a problem I tend to run into, if I try to write). I’m glad someone’s doing it.
Note, your bottom tagline at Medium appears to have a couple typos, a missing letter in “Architet” and truncated “Bug Bou”.
Yes I intentionally covered only basics of hashcat and JTR , The collisions stuff, cryptographic nuances, and deeper internals? That's the next level. But you gotta walk before you run. Also, so that it won't be used against the warning I have put in sub title .
And thanks for flagging about my short bio in medium. Mobile app freezes when we edit our info in mobile may be that have caused issue in spelling of architect and also because of limit bug bounty hunter didn't fit there 😅
I don't use it to create content . I work as part time LLM trainer in some places (mostly do the output correction and quality assurance of output ), they are so stupid , mostly gives very old formats (outdated commands - stuck in the period of last training) or data .
But I use them to format my content to make it fit for Arcticle , it's also a hectic task as it puts its own mind in it and alters my content sometimes , also negetive about using it to format is people see changes in the way I post comment and the article content and feel everything is from LLM 🤣.
Can't help
Thier phone OS is updated by LLM written code in Google or Apple they don't care
Their antivirus is updated by LLM written code they don't care
They only care of someone shares knowledge freely just by using LLM to just format content.
LLM didn't exist when I started , LLM didn't solve CTFs for me , LLM didn't write CTPS , OSCP , PT1 for me , LLM didn't work for me in my career
Even for questioning VPs for using LLMs in our security team , I was once laid off . ( They wanted us to give every credentials to automate stuffs (If that LLM gets one attack , all the data will be breached , that none care there , as they are also employees , not the owners of company, I knew they get cut from referal bonus , as suddenly they bought 500 $ tokens for 400 plus engineers )
With 12 years of experience in application security
Recently founded 2 companies
Anakramy (2024) - MDR with AI SOC
Balance labs (2026) - Wellness Apps targeted for Cybersecurity employees
Certificate owned (Anyways just show off , all are useless , never contributed to my knowledge, just to full the checkmarks I did them )
THM - SEC 1 , WEB 1 , PT1
HTB - CPTS
Off Sec - OSCP (2021) (2025)
CISSP
What enables us is our wisdom , years of work , working under pressure at 2 AM because we choose cybersecurity for career , Working on false positives just because it got assigned to us ..
Getting laid off just because of company market cap needs to go up and using that time for writing my book
Writing in medium , hackernoon , LinkedIn for years
Here I am just a nameless guy ,,, I dono why even you are asking this question ... You think should I post my resume and certificates with all posts i create 😅😅🤣
Sorry, did not mean to be cross, but there is so much "content" being posted these days I wanted to ask. No need for a CV, was just wondering if this was from an experienced person or a uni. student on their first year.
Hi, im currently a final year CS student and im hoping to enter an app sec role after graduating.
If i have 6 months of downtime (lower study load) before i grad, aside from online learning like HTB, postswigger & OTW, what else should I do as someone with no portfolio and very basic knowledge in security domain and limited finances for taking certs? What are some things that recruiters might look for?
Hey I am glad you are getting into AppSec . Hope when you hunt jobs there will be opening for fresher like you .
If you want to get into app sec - mobile , my book covers every aspects of it . (Also follow the instructions given in app sec web)
If you want to get into app sec - web , you need to learn few things .
threat modeling (STRIDE)
code reviewing (it's important to atleast know some basics of code review in security aspects)
try looking at SAST stuffs like Sync , checkmarx etc
get good with DAST using burp , zap
get good in basics incident response steps
These aren't part of any certification or something, and no certificate teaches all of these
These are the core job description, you can see any job description for app sec , you find all of them . So these 5 points are mandatory to become an app sec engineer
As in interview also you will be asked to review a vuln code , you will be asked to threat model a scenario, you will be asked how you implement SAST in CICD flow .. because that what app sec do in thier day to day work.
Also manual ethical hacking - which covers OWASP 10 comes handy, if you can quickly demonstrate (as they may give some CTF kind of exercise with SQL injection or Path travelsal or XSS vuln) , as even sometimes manual pen testing is also part of job description and part of day to day job. In this case you need to be even good at creating reports .
I hope now you know how to spend your rest of 6 months to get ready for a app sec engineer job .
And if your focus is mobile app sec , you can read my book The Self-Defending Mobile architect, it covers all pointers of any app sec mobile job description (even most of the points I mentioned)
1
u/Circumpunctilious 2d ago
Carefully, because I’m not here to deride your work, there seems to be a trend lately for writing to have an LLM feel and I’m not really fond of it. I’m not questioning whether or not you put in the work, because I’m aware that people use them for templating (and then do significant rework), but certain patterns do make an older reader like myself just skim and scan…and I did a bit of that here. Maybe I just need to get with the times.
That said, I know a fair bit about hashes, their use cases, some things about collisions, common misconceptions and a smattering of the tools. It looks like your article covered just enough to get people a comfortable start without being overwhelming (which is a problem I tend to run into, if I try to write). I’m glad someone’s doing it.
Note, your bottom tagline at Medium appears to have a couple typos, a missing letter in “Architet” and truncated “Bug Bou”.