hashcat -a <attack_mode> -m <hash_type> <hashes> [wordlist, rule, mask, ...]
| Option | Description |
|---|
-a | Attack mode |
-m | Hash type ID |
-r | Rules file |
-o | Output file for cracked hashes |
--show | Show previously cracked hashes |
--force | Ignore warnings |
| Mode | Name | Description |
|---|
0 | Straight/Dictionary | Wordlist-based attack |
1 | Combination | Combines words from two wordlists |
3 | Brute-force/Mask | Uses masks to define keyspace |
6 | Hybrid Wordlist + Mask | Appends mask to wordlist entries |
7 | Hybrid Mask + Wordlist | Prepends mask to wordlist entries |
| ID | Hash Type |
|---|
0 | MD5 |
100 | SHA1 |
500 | MD5 Crypt / Cisco-IOS / FreeBSD MD5 |
900 | MD4 |
1000 | NTLM |
1300 | SHA2-224 |
1400 | SHA2-256 |
1700 | SHA2-512 |
1800 | SHA-512 Crypt (Unix) |
3000 | LM |
3200 | bcrypt |
5600 | NetNTLMv2 |
13100 | Kerberos 5 TGS-REP |
18200 | Kerberos 5 AS-REP |
22000 | WPA-PBKDF2-PMKID+EAPOL |
Full list: hashcat --help or hashcat.net/wiki/doku.php?id=example_hashes
| Symbol | Charset |
|---|
?l | abcdefghijklmnopqrstuvwxyz |
?u | ABCDEFGHIJKLMNOPQRSTUVWXYZ |
?d | 0123456789 |
?h | 0123456789abcdef |
?H | 0123456789ABCDEF |
?s | Special characters (space, punctuation) |
?a | ?l?u?d?s (all printable) |
?b | 0x00 - 0xff (all bytes) |
Custom charsets: -1, -2, -3, -4 → Reference with ?1, ?2, ?3, ?4
hashcat -a 0 -m 0 hash.txt /usr/share/wordlists/rockyou.txt
hashcat -a 0 -m 0 hash.txt /usr/share/wordlists/rockyou.txt -r /usr/share/hashcat/rules/best64.rule
hashcat -a 3 -m 0 hash.txt ?l?l?l?l?l?l?d?d
hashcat -a 3 -m 0 hash.txt -1 ?l?u ?1?1?1?1?d?d?d?d
hashcat -a 6 -m 0 hash.txt /usr/share/wordlists/rockyou.txt ?d?d?d
hashcat -m 0 hash.txt --show
hashid -m '<hash_string>'
| Rule File | Description |
|---|
best64.rule | 64 standard password modifications |
rockyou-30000.rule | Large ruleset based on rockyou patterns |
dive.rule | Comprehensive rule set |
d3ad0ne.rule | Popular community ruleset |
leetspeak.rule | Leet speak substitutions |
toggles1-5.rule | Case toggling rules |
Location: /usr/share/hashcat/rules/
| Option | Description |
|---|
--status | Enable automatic status updates |
--status-timer=N | Set status update interval (seconds) |
-w 3 | Workload profile (1=low, 2=default, 3=high, 4=nightmare) |
--increment | Enable mask increment mode |
--increment-min=N | Start mask length |
--increment-max=N | End mask length |
-O | Enable optimized kernels (faster, but limits password length) |
--username | Ignore username in hash file |
--potfile-disable | Don’t write to potfile |
| ID | Type |
|---|
9400-9600 | MS Office 2007-2013 |
10400-10700 | PDF |
13600 | WinZip |
17200-17225 | PKZIP |
22100 | BitLocker |
13400 | KeePass |
6211-6243 | TrueCrypt |
13711-13723 | VeraCrypt |
# Extract hash with bitlocker2john (from JtR)
bitlocker2john -i Backup.vhd > backup.hashes
grep "bitlocker\$0" backup.hashes > backup.hash
# Crack with hashcat
hashcat -a 0 -m 22100 backup.hash /usr/share/wordlists/rockyou.txt
# Extract hash with zip2john (from JtR)
zip2john protected.zip > zip.hash
# Crack with hashcat (mode depends on ZIP type)
hashcat -a 0 -m 17200 zip.hash /usr/share/wordlists/rockyou.txt
# Extract hash with office2john (from JtR)
office2john.py document.docx > office.hash
# Crack with hashcat (mode depends on Office version)
hashcat -a 0 -m 9600 office.hash /usr/share/wordlists/rockyou.txt
# Extract hash with pdf2john (from JtR)
pdf2john.py document.pdf > pdf.hash
# Crack with hashcat
hashcat -a 0 -m 10500 pdf.hash /usr/share/wordlists/rockyou.txt
# Extract hash with keepass2john (from JtR)
keepass2john database.kdbx > keepass.hash
# Crack with hashcat
hashcat -a 0 -m 13400 keepass.hash /usr/share/wordlists/rockyou.txt