Hashcat — Password Cracking Reference
External: Internal All The Things — Hash Cracking
What is Hashcat?
Hashcat is an advanced CPU/GPU password recovery tool. It takes hashed values (dumped from a target) and recovers the original plaintext by testing candidates from wordlists, brute-force masks, or rule mutations. Supports 300+ hash algorithms.
OSCP workflow: Dump hashes with Impacket (
secretsdump), CrackMapExec - nxc (--sam/--ntds), or Meterpreter (hashdump) → crack offline with hashcat → use recovered plaintext for further access.
Recreate / verify a hash manually → Manual Hash Generation · step checks → Verify
Install (Kali)
sudo apt update && sudo apt install -y hashcatVerify: hashcat --version · rules: /usr/share/hashcat/rules/
Full install index → Installation - Kali Setup
Syntax
hashcat [options] <hash|hashfile> [wordlist|mask]Format examples:
https://gist.github.com/CalfCrusher/6b87a738d0fe7b88e04f4a36eb6d722d
📌 1) All Common Flags
Core Options
| Flag | Description |
|---|---|
-m <N> | Hash type (see table below) |
-a <N> | Attack mode (0=dict, 1=combo, 3=brute/mask, 6=hybrid, 7=hybrid reverse) |
-o <file> | Output file for cracked hashes |
--outfile-format <N> | Output format: 1=hash, 2=plain, 3=hash:plain (default), 4=hex-plain |
--show | Show already-cracked hashes from potfile |
--left | Show hashes NOT yet cracked |
--username | Strip username prefix from hash file (user:hash format) |
--potfile-disable | Don’t use/update the potfile |
--potfile-path <file> | Use a custom potfile path |
--session <name> | Name the session (for pause/resume) |
--restore | Resume a saved session |
--status | Show status during cracking |
--status-timer <N> | Update status every N seconds |
--quiet | Suppress output except for results |
Performance
| Flag | Description |
|---|---|
-d <ID> | Use specific device(s) (GPU/CPU) |
-D <types> | Device type: 1=CPU, 2=GPU, 3=FPGA |
--force | Ignore warnings (use in VMs when GPU unavailable) |
-w <N> | Workload profile: 1=low, 2=default, 3=high, 4=nightmare |
--opencl-device-types <types> | Force OpenCL device types |
-n <N> | Number of threads (CPU mode) |
--gpu-loops <N> | Number of loops per GPU kernel |
Wordlist / Rules
| Flag | Description |
|---|---|
-r <file> | Apply a rule file |
-g <N> | Generate N random rules on-the-fly |
--rules-file <file> | Alias for -r |
-j <rule> | Single rule for left word (combo mode) |
-k <rule> | Single rule for right word (combo mode) |
Mask / Brute-Force
| Flag | Description |
|---|---|
--increment | Enable mask length increment (try all lengths up to mask) |
--increment-min <N> | Start increment at this length |
--increment-max <N> | Stop increment at this length |
--custom-charset1 <cs> | Define ?1 custom charset |
--custom-charset2 <cs> | Define ?2 custom charset |
--custom-charset3 <cs> | Define ?3 custom charset |
--custom-charset4 <cs> | Define ?4 custom charset |
📌 2) Hash Types (-m) — Common
-m | Hash Type | Example Hash |
|---|---|---|
0 | MD5 | 5f4dcc3b5aa765d61d8327deb882cf99 |
100 | SHA1 | 5baa61e4c9b93f3f0682250b6cf8331b7ee68fd8 |
1400 | SHA256 | 5e884898da28047151d0e56f... |
1700 | SHA512 | b109f3bbbc244eb82441917... |
900 | MD4 | 8a9d093f14f8701df17732b2... |
1000 | NTLM | 31d6cfe0d16ae931b73c59d7e0c089c0 |
3000 | LM | e52cac67419a9a224a3b108f3fa6cb6d |
5500 | NetNTLMv1 | username::domain:... |
5600 | NetNTLMv2 | username::domain:... |
13100 | Kerberos TGS-REP (Kerberoast) | $krb5tgs$23$*... |
18200 | Kerberos AS-REP (AS-REP Roast) | $krb5asrep$23$... |
13000 | KeePass | $keepass$... |
500 | md5crypt (Linux $1$) | $1$salt$hash |
1800 | sha512crypt (Linux $6$) | $6$salt$hash |
3200 | bcrypt | $2a$10$... |
400 | phpBB3 / WordPress | $P$... |
1600 | Apache MD5 | $apr1$... |
7400 | sha256crypt (Linux $5$) | $5$salt$hash |
1500 | DES (crypt) | FRsH3HoSKJ0E2 |
2100 | DCC2 / MSCACHE2 | $DCC2$10240#user#hash |
7300 | IPMI2 RAKP HMAC-SHA1 | |
22000 | WPA-PBKDF2-PMKID+EAPOL | |
2500 | WPA/WPA2 (old format) | |
11600 | 7-Zip | $7z$... |
13600 | WinZip | $zip2$... |
10 | md5(salt) | |
20 | md5(pass) | |
30 | md5(utf16le(salt) |
# Identify unknown hash type
hashcat --identify hash.txt
# hashid — shows likely types + Hashcat mode numbers
hashid -m '77ba9273d4bcfa9387ae8652377f4C189e5a47ee'Example hashid output:
Analyzing '77ba9273d4bcfa9387ae8652377f4C189e5a47ee'
[+] SHA-1 [Hashcat Mode: 100]
[+] Double SHA-1 [Hashcat Mode: 4500]
[+] RIPEMD-160 [Hashcat Mode: 6000]
[+] Haval-160
[+] Tiger-160
[+] HAS-160
[+] LinkedIn [Hashcat Mode: 190]
[+] Skein-256(160)
[+] Skein-512(160)
Install: sudo apt install hashid · then crack with the mode from output:
hashid -m 'HASH_HERE'
hashcat -m 100 hash.txt /usr/share/wordlists/rockyou.txt # SHA-1 exampleAlso: hash-identifier · haiti · name-that-hash
Search hashcat help for the right -m mode
# Grep built-in help for a keyword (shows surrounding context)
hashcat --help | grep -i -A2 -B2 pbkdf2
# List all example hashes and search by app/framework name
hashcat --example-hashes | grep -i werkzeug
# Name................: Python Werkzeug MD5 (HMAC-MD5 (key = $salt))
# Name................: Python Werkzeug SHA256 (HMAC-SHA256 (key = $salt))
# Once you have the mode number from output above:
hashcat -m MODE hash.txt /usr/share/wordlists/rockyou.txtUseful grep targets: pbkdf2, werkzeug, django, bcrypt, sha512crypt, krb5, ntlm.
📌 3) Attack Modes (-a)
| Mode | Name | Description |
|---|---|---|
0 | Dictionary | Try every word in a wordlist |
1 | Combination | Combine words from two wordlists |
3 | Brute-Force / Mask | Try all combinations matching a mask |
6 | Hybrid Wordlist + Mask | Wordlist words with mask appended |
7 | Hybrid Mask + Wordlist | Mask prepended to wordlist words |
9 | Association | Use username/target info as base |
📌 4) Mode 0 — Dictionary Attack
# Basic wordlist attack
hashcat -m 1000 hashes.txt /usr/share/wordlists/rockyou.txt
# With rules (the most effective combo)
hashcat -m 1000 hashes.txt /usr/share/wordlists/rockyou.txt -r /usr/share/hashcat/rules/best64.rule
# Stack multiple rule files
hashcat -m 1000 hashes.txt /usr/share/wordlists/rockyou.txt \
-r /usr/share/hashcat/rules/best64.rule \
-r /usr/share/hashcat/rules/toggles1.rule
# Show results when done
hashcat -m 1000 hashes.txt --show📌 5) Mode 3 — Brute-Force / Mask Attack
Mask charset characters
| Charset | Characters |
|---|---|
?l | abcdefghijklmnopqrstuvwxyz |
?u | ABCDEFGHIJKLMNOPQRSTUVWXYZ |
?d | 0123456789 |
?s | !"#$%&'()*+,-./:;<=>?@[\]^_ ` `{ |
?a | All printable ASCII (?l?u?d?s) |
?b | All bytes (0x00–0xFF) |
?1–?4 | Custom charsets defined with --custom-charset |
# 8-character all-lowercase
hashcat -m 1000 hashes.txt -a 3 ?l?l?l?l?l?l?l?l
# 8-character alphanumeric
hashcat -m 1000 hashes.txt -a 3 ?a?a?a?a?a?a?a?a
# Common password pattern: Capital + 6 lowercase + digit + symbol
hashcat -m 1000 hashes.txt -a 3 ?u?l?l?l?l?l?l?d?s
# 4–8 digit PIN (increment)
hashcat -m 1000 hashes.txt -a 3 --increment --increment-min 4 --increment-max 8 ?d?d?d?d?d?d?d?d
# Custom charset — uppercase + digits only
hashcat -m 1000 hashes.txt -a 3 --custom-charset1 "?u?d" ?1?1?1?1?1?1?1?1📌 6) Mode 6 & 7 — Hybrid Attacks
# Mode 6: word + mask (e.g. password123, password!)
hashcat -m 1000 hashes.txt -a 6 /usr/share/wordlists/rockyou.txt ?d?d?d
# Mode 7: mask + word (e.g. 123password)
hashcat -m 1000 hashes.txt -a 7 ?d?d?d /usr/share/wordlists/rockyou.txt📌 7) Rules
Rules mutate wordlist candidates — the single biggest force multiplier in cracking.
# Best64 — most commonly used
hashcat -m 1000 hashes.txt rockyou.txt -r /usr/share/hashcat/rules/best64.rule
# OneRuleToRuleThemAll (community rule — very effective)
hashcat -m 1000 hashes.txt rockyou.txt -r OneRuleToRuleThemAll.rule
# Dive — large and thorough
hashcat -m 1000 hashes.txt rockyou.txt -r /usr/share/hashcat/rules/dive.rule
# Rockyou-30000 rules
hashcat -m 1000 hashes.txt rockyou.txt -r /usr/share/hashcat/rules/rockyou-30000.ruleUseful rules in /usr/share/hashcat/rules/
| Rule File | Description |
|---|---|
best64.rule | 64 most effective mutations |
dive.rule | Large, thorough ruleset |
rockyou-30000.rule | Derived from RockYou analysis |
toggles1.rule | Toggles case of first character |
toggles5.rule | Toggles first 5 characters |
leetspeak.rule | Substitutes letters for numbers (a→4, e→3, etc.) |
T0XlC.rule | Mixed complex mutations |
d3ad0ne.rule | Community favourite |
combinator.rule | Word combination mutations |
Write your own rule (inline with -j)
# Append "123" to every word
hashcat -m 1000 hashes.txt rockyou.txt -j '$1$2$3'
# Capitalise first letter + append "!"
hashcat -m 1000 hashes.txt rockyou.txt -j 'c $!'📌 8) Common Hash-Specific Examples
NTLM (Windows — from secretsdump/hashdump)
hashcat -m 1000 ntlm_hashes.txt /usr/share/wordlists/rockyou.txt -r /usr/share/hashcat/rules/best64.ruleNetNTLMv2 (from Responder capture)
hashcat -m 5600 netntlmv2.txt /usr/share/wordlists/rockyou.txtKerberoasting (TGS-REP)
hashcat -m 13100 kerberoast.txt /usr/share/wordlists/rockyou.txt -r /usr/share/hashcat/rules/best64.ruleAS-REP Roasting
hashcat -m 18200 asrep.txt /usr/share/wordlists/rockyou.txt -r /usr/share/hashcat/rules/best64.ruleLinux /etc/shadow — sha512crypt
hashcat -m 1800 shadow_hashes.txt /usr/share/wordlists/rockyou.txtLinux /etc/shadow — md5crypt
hashcat -m 500 shadow_hashes.txt /usr/share/wordlists/rockyou.txtWordPress / phpBB3
hashcat -m 400 wordpress_hashes.txt /usr/share/wordlists/rockyou.txtMD5 (web app hashes)
hashcat -m 0 md5_hashes.txt /usr/share/wordlists/rockyou.txt -r /usr/share/hashcat/rules/best64.rule📌 9) Preparing Hash Files
# secretsdump output — strip to NT hashes only
grep -v '\$' secretsdump.txt | cut -d: -f4 > ntlm_hashes.txt
# /etc/shadow — extract hash field only
cut -d: -f2 /etc/shadow | grep '^\$' > shadow_hashes.txt
# Remove duplicates
sort -u hashes.txt -o hashes.txt
# hashcat --username flag (keeps user:hash format, strips user for cracking)
hashcat -m 1000 hashes.txt wordlist.txt --username
# Show results with username
hashcat -m 1000 hashes.txt --show --username📌 10) Session Management
# Name a session (can pause/resume)
hashcat -m 1000 hashes.txt rockyou.txt --session mysession
# Pause: Ctrl+C during cracking saves state automatically
# Resume a session
hashcat --session mysession --restore
# Check status while running
# Press 's' during a run for status
# Press 'p' to pause, 'r' to resume, 'q' to quit + save📌 11) Optimizing for Speed
# Use GPU (default on systems with GPU)
hashcat -m 1000 hashes.txt rockyou.txt
# Force CPU (VM without GPU passthrough)
hashcat -m 1000 hashes.txt rockyou.txt -D 1 --force
# High workload (uses more GPU resources)
hashcat -m 1000 hashes.txt rockyou.txt -w 3
# Benchmark a specific hash type
hashcat -b -m 1000
# Benchmark all hash types
hashcat -b📌 Recommended Wordlists
| Wordlist | Path | Notes |
|---|---|---|
| RockYou | /usr/share/wordlists/rockyou.txt | Standard starting point |
| SecLists passwords | /usr/share/wordlists/SecLists/Passwords/ | Large variety |
| Probable wordlists | github.com/berzerk0/Probable-Wordlists | Frequency-sorted |
| CrackStation | crackstation.net/crackstation-wordlist-password-cracking-dictionary.htm | 1.5 billion entries |
| Kaonashi | github.com/kaonashi-passwords/Kaonashi | Real-world leak-based |
📌 Potfile — ignore or reset previous cracks
Hashcat stores cracked hashes in a potfile (~/.local/share/hashcat/hashcat.potfile). On re-runs, matches are skipped and --show reads from the potfile.
Ignore previous cracks (keep potfile on disk)
# Re-crack Kerberoast without using/updating potfile
hashcat -m 13100 -a 0 hash.txt /usr/share/wordlists/rockyou.txt --potfile-disableRemove all previous cracks
rm ~/.local/share/hashcat/hashcat.potfileThen run hashcat normally — or use --potfile-disable for a one-off session without touching the potfile.
hashcat -m 13100 kerb.txt /usr/share/wordlists/rockyou.txt
hashcat -m 13100 kerb.txt --show📌 Quick OSCP Cheat Sheet (Copy/Paste)
# NTLM — from secretsdump/hashdump
hashcat -m 1000 ntlm.txt /usr/share/wordlists/rockyou.txt -r /usr/share/hashcat/rules/best64.rule
# NetNTLMv2 — from Responder
hashcat -m 5600 netntlmv2.txt /usr/share/wordlists/rockyou.txt
# Kerberoasting (TGS-REP)
hashcat -m 13100 kerb.txt /usr/share/wordlists/rockyou.txt -r /usr/share/hashcat/rules/best64.rule
# AS-REP Roasting
hashcat -m 18200 asrep.txt /usr/share/wordlists/rockyou.txt
# Linux shadow — sha512crypt
hashcat -m 1800 shadow.txt /usr/share/wordlists/rockyou.txt
# MD5 — web app
hashcat -m 0 md5.txt /usr/share/wordlists/rockyou.txt -r /usr/share/hashcat/rules/best64.rule
# Show cracked results
hashcat -m 1000 ntlm.txt --show
# Find hash mode (unknown hash)
hashcat --help | grep -i -A2 -B2 pbkdf2
hashcat --example-hashes | grep -i werkzeug
# Force CPU (VM / no GPU)
hashcat -m 1000 hashes.txt rockyou.txt --force -D 1
# Ignore potfile (re-crack fresh)
hashcat -m 13100 -a 0 hash.txt /usr/share/wordlists/rockyou.txt --potfile-disable
rm ~/.local/share/hashcat/hashcat.potfile # wipe all previous cracks