Hashcat Cheatsheet

Hashcat is a well-known password cracking tool featuring GPU support for cracking a large variety of hashes. The success of a cracking attempt largely depends on the quality of the wordlists and the complexity of the passwords being targeted.

Basic Syntax

hashcat -a <attack_mode> -m <hash_type> <hashes> [wordlist, rule, mask, ...]

Attack Modes (-a)

Common Hash Types (-m)

Full list: hashcat --help or hashcat.net/wiki/doku.php?id=example_hashes

Identifying Hash Types

Use hashid to quickly identify the hash type and get the hashcat mode:

hashid -m '$1$FNr44XZC$wQxY6HHLrgrGX0e1195k.1'

Analyzing '$1$FNr44XZC$wQxY6HHLrgrGX0e1195k.1'
[+] MD5 Crypt [Hashcat Mode: 500]
[+] Cisco-IOS(MD5) [Hashcat Mode: 500]
[+] FreeBSD MD5 [Hashcat Mode: 500]

Mask Attack Character Sets

Custom charsets: -1, -2, -3, -4 → Reference with ?1, ?2, ?3, ?4

Quick Reference Commands

Dictionary Attack

hashcat -a 0 -m 0 hash.txt /usr/share/wordlists/rockyou.txt

Dictionary Attack with Rules

hashcat -a 0 -m 0 hash.txt /usr/share/wordlists/rockyou.txt -r /usr/share/hashcat/rules/best64.rule

Mask Attack (8 char: 6 lowercase + 2 digits)

hashcat -a 3 -m 0 hash.txt ?l?l?l?l?l?l?d?d

Mask Attack with Custom Charset

hashcat -a 3 -m 0 hash.txt -1 ?l?u ?1?1?1?1?d?d?d?d

Hybrid Attack (wordlist + mask)

hashcat -a 6 -m 0 hash.txt /usr/share/wordlists/rockyou.txt ?d?d?d

Show Cracked Hashes

hashcat -m 0 hash.txt --show

Identify Hash Type

hashid -m '<hash_string>'

Common Rule Files

Location: /usr/share/hashcat/rules/

Useful Options

Cracking Protected Files & Archives

Common Hash Modes for Files

Crack BitLocker Drive

# Extract hash with bitlocker2john (from JtR)
bitlocker2john -i Backup.vhd > backup.hashes
grep "bitlocker\$0" backup.hashes > backup.hash

# Crack with hashcat
hashcat -a 0 -m 22100 backup.hash /usr/share/wordlists/rockyou.txt

The script outputs four hashes: the first two are for the BitLocker password, the latter two for the recovery key. Focus on the password hash ($bitlocker$0$...).

Crack ZIP File (PKZIP)

# Extract hash with zip2john (from JtR)
zip2john protected.zip > zip.hash

# Crack with hashcat (mode depends on ZIP type)
hashcat -a 0 -m 17200 zip.hash /usr/share/wordlists/rockyou.txt

Crack MS Office Document

# Extract hash with office2john (from JtR)
office2john.py document.docx > office.hash

# Crack with hashcat (mode depends on Office version)
hashcat -a 0 -m 9600 office.hash /usr/share/wordlists/rockyou.txt

Crack PDF

# Extract hash with pdf2john (from JtR)
pdf2john.py document.pdf > pdf.hash

# Crack with hashcat
hashcat -a 0 -m 10500 pdf.hash /usr/share/wordlists/rockyou.txt

Crack KeePass Database

# Extract hash with keepass2john (from JtR)
keepass2john database.kdbx > keepass.hash

# Crack with hashcat
hashcat -a 0 -m 13400 keepass.hash /usr/share/wordlists/rockyou.txt

Hunting for Encrypted Files

Find common encrypted file types

for ext in $(echo ".xls .xls* .xltx .od* .doc .doc* .pdf .pot .pot* .pp*"); do
  echo -e "\nFile extension: " $ext
  find / -name *$ext 2>/dev/null | grep -v "lib\|fonts\|share\|core"
done

Find SSH private keys

grep -rnE '^\-{5}BEGIN [A-Z0-9]+ PRIVATE KEY\-{5}$' /* 2>/dev/null

Check if SSH key is encrypted

ssh-keygen -yf ~/.ssh/id_rsa
# If encrypted, prompts for passphrase

Note: SSH keys are typically cracked with John the Ripper using ssh2john.py, as hashcat doesn’t have a direct mode for SSH private keys.

Crack OpenSSL Encrypted GZIP

Identify the file type:

file GZIP.gzip
# GZIP.gzip: openssl enc'd data with salted password

Brute-force with a loop (errors expected, file extracts on success):

for i in $(cat rockyou.txt); do
  openssl enc -aes-256-cbc -d -in GZIP.gzip -k $i 2>/dev/null | tar xz
done