Password Cracking with Hashcat

Hashcat is the world's fastest password cracker, leveraging CPU and GPU power to crack password hashes at extreme speeds. It supports 300+ hash types and offers advanced attack modes including masks, combinator, and hybrid attacks. This lesson covers hashcat installation, usage, attack strategies, and optimization techniques.

What You'll Learn

What is hashcat
Installation and setup
Hash types and modes
Attack modes (dictionary, brute-force, mask, combinator, hybrid)
Rule-based attacks
GPU acceleration
Benchmarking and optimization
Practical cracking scenarios
Creating efficient masks

What is Hashcat?

Overview

Hashcat is a powerful password recovery tool that:

Uses GPU acceleration (100x faster than CPU)
Supports 300+ hash algorithms
Offers 5 attack modes
Runs on Windows, Linux, macOS
Open-source and actively maintained
Highly optimized for performance

Key Features:

Multi-GPU support
Distributed cracking
Session resume
Temperature monitoring
Rules engine
Markov chains

Installation

Kali Linux

# Check if installed
hashcat --version

# Install if needed
sudo apt update
sudo apt install hashcat

# Install OpenCL (for GPU)
sudo apt install ocl-icd-libopencl1 nvidia-opencl-icd

Ubuntu/Debian

sudo apt update
sudo apt install hashcat

Windows

1. Download from: https://hashcat.net/hashcat/
2. Extract to C:\hashcat
3. Add to PATH (optional)
4. Install GPU drivers (NVIDIA/AMD)

Verify GPU Support

# List available devices
hashcat -I

# Output shows:
# OpenCL Info:
# Platform ID #1
#   Vendor..: NVIDIA Corporation
#   Name....: NVIDIA CUDA
#   Device #1
#     Name: GeForce RTX 3080

Hash Modes

Common Hash Types

# List all hash modes
hashcat --help | grep -i "Hash modes"

# Common modes:
0     = MD5
100   = SHA1
1400  = SHA2-256
1700  = SHA2-512
1000  = NTLM
3000  = LM
2500  = WPA/WPA2
5600  = NetNTLMv2
13100 = Kerberos 5 TGS-REP
3200  = bcrypt
1800  = sha512crypt
400   = phpass (WordPress)

Identify Hash Type

# Using hash-identifier
hash-identifier

# Using hashid
hashid '5f4dcc3b5aa765d61d8327deb882cf99'
# Output: [+] MD5

# Try with hashcat
hashcat --identify hash.txt

Attack Modes

0: Dictionary Attack

Uses wordlist to crack hashes:

# Basic dictionary attack
hashcat -m 0 -a 0 hashes.txt /usr/share/wordlists/rockyou.txt

# Options:
# -m 0    (MD5 hash type)
# -a 0    (dictionary attack mode)

# With progress
hashcat -m 0 -a 0 hashes.txt rockyou.txt --status

3: Brute-Force Attack

Tries all combinations:

# Brute force 4-character passwords
hashcat -m 0 -a 3 hashes.txt ?a?a?a?a

# Charsets:
# ?l = lowercase     (abcdefghijklmnopqrstuvwxyz)
# ?u = uppercase     (ABCDEFGHIJKLMNOPQRSTUVWXYZ)
# ?d = digits        (0123456789)
# ?s = special       ( !"#$%&'()*+,-./:;<=>?@[\]^_`{|}~)
# ?a = all printable (?l?u?d?s)

# Examples:
hashcat -m 0 -a 3 hashes.txt ?d?d?d?d           # 4 digits
hashcat -m 0 -a 3 hashes.txt ?l?l?l?l?l         # 5 lowercase
hashcat -m 0 -a 3 hashes.txt ?u?l?l?l?l?d?d     # Password12

1: Combinator Attack

Combines two wordlists:

# Combine words from two lists
hashcat -m 0 -a 1 hashes.txt wordlist1.txt wordlist2.txt

# Example:
# wordlist1.txt: pass, admin, user
# wordlist2.txt: word, 123, !
# Tries: password, pass123, pass!, adminword, admin123, etc.

6: Hybrid Wordlist + Mask

Appends mask to wordlist:

# Append 2 digits to wordlist
hashcat -m 0 -a 6 hashes.txt wordlist.txt ?d?d

# Examples:
# password + ?d?d = password00, password01, ..., password99
# admin + ?d?d?d = admin000, admin001, ..., admin999

7: Hybrid Mask + Wordlist

Prepends mask to wordlist:

# Prepend 2 digits to wordlist
hashcat -m 0 -a 7 hashes.txt ?d?d wordlist.txt

# Examples:
# ?d?d + password = 00password, 01password, ..., 99password

Mask Attack (Advanced)

Creating Effective Masks

Based on password patterns:

# Common patterns:
Password1    = ?u?l?l?l?l?l?l?l?d
Password12   = ?u?l?l?l?l?l?l?l?d?d
Pass@123     = ?u?l?l?l?s?d?d?d
Summer2023   = ?u?l?l?l?l?l?d?d?d?d

# Attack with mask
hashcat -m 0 -a 3 hashes.txt ?u?l?l?l?l?l?l?l?d?d

Custom Charsets

# Define custom charset
hashcat -m 0 -a 3 hashes.txt -1 ?l?d ?1?1?1?1?1?1

# -1 defines charset1 = lowercase + digits
# ?1 uses that charset

# Multiple custom charsets
hashcat -m 0 -a 3 hashes.txt -1 ?l?u -2 ?d?s ?1?1?1?1?2?2

# -1 = letters (lower/upper)
# -2 = digits + special
# Pattern: 4 letters + 2 digits/special

Increment Mode

# Try lengths from 1 to 8
hashcat -m 0 -a 3 hashes.txt ?a?a?a?a?a?a?a?a --increment --increment-min 1 --increment-max 8

# Start at length 6
hashcat -m 0 -a 3 hashes.txt ?a?a?a?a?a?a?a?a --increment --increment-min 6

Rule-Based Attacks

Built-in Rules

# Apply rules to wordlist
hashcat -m 0 -a 0 hashes.txt wordlist.txt -r /usr/share/hashcat/rules/best64.rule

# Common rulesets:
/usr/share/hashcat/rules/best64.rule        # Best 64 rules
/usr/share/hashcat/rules/rockyou-30000.rule  # RockYou top 30k
/usr/share/hashcat/rules/dive.rule          # Deep mutations
/usr/share/hashcat/rules/leetspeak.rule     # L33t sp34k
/usr/share/hashcat/rules/InsidePro-PasswordsPro.rule

Rule Examples

Original: password

Rules transform to:
password1, password123, password!
Password, PASSWORD, PaSsWoRd
drowssap (reversed)
p@ssword, p4ssw0rd, pa$$word
password2023, password2024
Password1!, Password123!

Custom Rules

Create custom rule file:

# Create myrules.rule
cat > myrules.rule << EOF
:         # Do nothing (original word)
c         # Capitalize first letter
C         # Lowercase first, uppercase rest
u         # Uppercase all
l         # Lowercase all
$1        # Append '1'
$2 $0 $2 $3  # Append '2023'
$!        # Append '!'
^1        # Prepend '1'
$1 $2 $3  # Append '123'
r         # Reverse
EOF

# Use custom rules
hashcat -m 0 -a 0 hashes.txt wordlist.txt -r myrules.rule

Practical Examples

Example 1: Crack MD5 Hashes

# Create hash file
echo '5f4dcc3b5aa765d61d8327deb882cf99' > md5.txt

# Crack with rockyou
hashcat -m 0 -a 0 md5.txt /usr/share/wordlists/rockyou.txt

# With rules
hashcat -m 0 -a 0 md5.txt rockyou.txt -r /usr/share/hashcat/rules/best64.rule

# Show cracked
hashcat -m 0 md5.txt --show
# Output: 5f4dcc3b5aa765d61d8327deb882cf99:password

Example 2: Crack NTLM Hashes

# NTLM hash
echo '8846F7EAEE8FB117AD06BDD830B7586C' > ntlm.txt

# Crack (NTLM is fast to crack)
hashcat -m 1000 -a 0 ntlm.txt rockyou.txt

# With rules
hashcat -m 1000 -a 0 ntlm.txt rockyou.txt -r best64.rule

# Show result
hashcat -m 1000 ntlm.txt --show

Example 3: Crack SHA-256 Hashes

# SHA-256 hash
echo '5e884898da28047151d0e56f8dc6292773603d0d6aabbdd62a11ef721d1542d8' > sha256.txt

# Dictionary attack
hashcat -m 1400 -a 0 sha256.txt rockyou.txt

# Mask attack (8 chars, all printable)
hashcat -m 1400 -a 3 sha256.txt ?a?a?a?a?a?a?a?a

# Show cracked
hashcat -m 1400 sha256.txt --show
# Output: 5e884898da28047151d0e56f8dc6292773603d0d6aabbdd62a11ef721d1542d8:password

Example 4: Crack bcrypt Hashes

# bcrypt (slow hash - designed to be slow!)
echo '$2a$10$N9qo8uLOickgx2ZMRZoMyeIjZAgcfl7p92ldGxad68LJZdL17lhWy' > bcrypt.txt

# Use GPU for better speed
hashcat -m 3200 -a 0 bcrypt.txt rockyou.txt -O

# bcrypt is SLOW - expect long times

Example 5: Crack WPA/WPA2 Handshake

# Capture handshake with airodump-ng
# Convert .cap to hashcat format
hcxpcaptool -z wpa.hc22000 capture.cap

# Or use cap2hccapx (older format)
cap2hccapx capture.cap wpa.hccapx

# Crack WPA2 (mode 22000 for new format)
hashcat -m 22000 -a 0 wpa.hc22000 rockyou.txt

# With mask for 8-digit PIN
hashcat -m 22000 -a 3 wpa.hc22000 ?d?d?d?d?d?d?d?d

Practical Pentesting Scenarios

Scenario 1: Web App Password Dump

# Obtained from SQL injection:
# username | password_hash
# admin    | 5f4dcc3b5aa765d61d8327deb882cf99
# alice    | e10adc3949ba59abbe56e057f20f883e

# Save hashes
cat > hashes.txt << EOF
5f4dcc3b5aa765d61d8327deb882cf99
e10adc3949ba59abbe56e057f20f883e
EOF

# Identify hash type (MD5)
hashid hashes.txt

# Quick dictionary attack
hashcat -m 0 -a 0 hashes.txt rockyou.txt

# Dictionary + rules
hashcat -m 0 -a 0 hashes.txt rockyou.txt -r best64.rule

# Mask attack (if needed)
hashcat -m 0 -a 3 hashes.txt ?a?a?a?a?a?a?a?a

# Show results
hashcat -m 0 hashes.txt --show

Scenario 2: Windows NTLM Hashes

# Dumped from SAM database
cat > ntlm_hashes.txt << EOF
Administrator:8846F7EAEE8FB117AD06BDD830B7586C
Guest:31D6CFE0D16AE931B73C59D7E0C089C0
User1:209C6174DA490CAEB422F3FA5A7AE634
EOF

# Extract just hashes
cut -d: -f2 ntlm_hashes.txt > hashes_only.txt

# Fast dictionary attack (NTLM is fast)
hashcat -m 1000 -a 0 hashes_only.txt rockyou.txt

# Optimize for speed
hashcat -m 1000 -a 0 hashes_only.txt rockyou.txt -O

# With rules
hashcat -m 1000 -a 0 hashes_only.txt rockyou.txt -r best64.rule

# Show cracked
hashcat -m 1000 hashes_only.txt --show

Scenario 3: WiFi WPA2 Cracking

# Step 1: Capture handshake
# (Use airodump-ng + aireplay-ng)

# Step 2: Convert to hashcat format
hcxpcaptool -z wifi.hc22000 handshake.cap

# Step 3: Quick dictionary
hashcat -m 22000 -a 0 wifi.hc22000 rockyou.txt

# Step 4: Try common WiFi patterns
# Format: CompanyName + Year
hashcat -m 22000 -a 6 wifi.hc22000 companies.txt ?d?d?d?d

# Step 5: 8-digit mask (common for WPA)
hashcat -m 22000 -a 3 wifi.hc22000 ?d?d?d?d?d?d?d?d

# Step 6: Show password
hashcat -m 22000 wifi.hc22000 --show

Session Management

Save and Restore

# Hashcat autosaves progress
hashcat -m 0 -a 0 hashes.txt rockyou.txt

# Stop with 'q' or Ctrl+C

# Resume session
hashcat -m 0 -a 0 hashes.txt rockyou.txt --restore

# Skip to next position (if stuck)
hashcat -m 0 -a 0 hashes.txt rockyou.txt --skip 1000000 --limit 2000000

Performance Optimization

Benchmarking

# Test system performance
hashcat -b

# Benchmark specific hash
hashcat -b -m 1000    # NTLM

# Output shows:
# Speed.#1.........: 50000.0 MH/s

Optimization Flags

# Optimized kernel (-O)
hashcat -m 1000 -a 0 hashes.txt rockyou.txt -O
# Faster but limits password length to 31

# Workload profile (-w)
hashcat -m 1000 -a 0 hashes.txt rockyou.txt -w 3
# 1 = Low (desktop usable)
# 2 = Default
# 3 = High (dedicated cracking)
# 4 = Nightmare (max power)

GPU Utilization

# Use specific GPU
hashcat -m 1000 -a 0 hashes.txt rockyou.txt -d 1

# Use multiple GPUs
hashcat -m 1000 -a 0 hashes.txt rockyou.txt -d 1,2,3

# Monitor temperature
hashcat -m 1000 -a 0 hashes.txt rockyou.txt --status --status-timer=10

Hash Extraction Tools

From Different Sources

# Office documents
office2john document.docx | cut -d: -f2 > hash.txt

# PDF files
pdf2john document.pdf | cut -d: -f2 > hash.txt

# ZIP files
zip2john archive.zip | cut -d: -f2 > hash.txt

# RAR files
rar2john archive.rar | cut -d: -f2 > hash.txt

# Then crack with hashcat
hashcat -m [mode] hash.txt rockyou.txt

Tips and Tricks

1. Start Fast, Then Slow

# Progression strategy:
hashcat -m 0 -a 0 hashes.txt fasttrack.txt           # Fast
hashcat -m 0 -a 0 hashes.txt rockyou.txt             # Medium
hashcat -m 0 -a 0 hashes.txt rockyou.txt -r best64.rule  # Slower
hashcat -m 0 -a 3 hashes.txt ?a?a?a?a?a?a?a?a        # Slowest

2. Use Potfile

# Hashcat saves cracked hashes in potfile
# Location: ~/.hashcat/hashcat.potfile

# View potfile
cat ~/.hashcat/hashcat.potfile

# Use potfile to crack other hashes
hashcat -m 0 new_hashes.txt --show

3. Distributed Cracking

# Split work across multiple machines
# Machine 1:
hashcat -m 0 -a 0 hashes.txt rockyou.txt -s 0 -l 50000000

# Machine 2:
hashcat -m 0 -a 0 hashes.txt rockyou.txt -s 50000000 -l 50000000

# -s = skip
# -l = limit

Quick Reference

Basic Usage:
hashcat -m [mode] -a [attack] hash.txt wordlist.txt

Attack Modes:
-a 0    Dictionary
-a 1    Combinator
-a 3    Brute-force/Mask
-a 6    Hybrid Wordlist + Mask
-a 7    Hybrid Mask + Wordlist

Common Hash Modes:
-m 0      MD5
-m 100    SHA1
-m 1000   NTLM
-m 1400   SHA2-256
-m 1700   SHA2-512
-m 3200   bcrypt
-m 22000  WPA/WPA2

Charsets:
?l  lowercase
?u  uppercase
?d  digits
?s  special
?a  all

Optimization:
-O           Optimized kernel
-w 3         Workload high
--status     Show progress
--show       Display cracked

Session:
--restore    Resume
--session    Name session

Resources

Wordlists

rockyou.txt: Standard (~14M passwords)
SecLists: https://github.com/danielmiessler/SecLists
CrackStation: Huge wordlists
Have I Been Pwned: Pwned Passwords list

Password Security:

Password Storage Security Research - How passwords should be stored securely and why weak hashing makes cracking possible

Rule Files

/usr/share/hashcat/rules/
- best64.rule
- rockyou-30000.rule
- dive.rule
- InsidePro-PasswordsPro.rule

Documentation

# Hashcat help
hashcat --help

# List hash modes
hashcat --example-hashes

# List OpenCL devices
hashcat -I

Next Steps

Master mask attacks for targeted cracking
Optimize GPU settings for maximum performance
Create custom rulesets for specific targets
Practice on CTF challenges
Study password statistics for efficient masks

Hashcat is the gold standard for password cracking. Master it for both offensive testing and password auditing!

"Hashcat: Because GPUs weren't designed just for gaming."