============================================================
HASHCAT HOWTO
============================================================
- [ Resources ] -
* hashcat Wiki: https://hashcat.net/wiki/doku.php?id=hashcat
- [ Usage ] -
hashcat [options]... hash|hashfile|hcapxfile [dictionary|mask|directory]...
- [ Basic Examples ] -
Attack-Mode | Hash |
-a | -m | Example command
==================+======+==================================================================
Wordlist | $P$ | hashcat -a 0 -m 400 example.hash wordlist.dict
Wordlist + Rules | MD5 | hashcat -a 0 -m 0 -r example1.rule -r example2.rule example0.hash wordlist.dict
Wordlist | MD | hashcat -a 0 -m 0 --remove -o output.txt example.hash wordlist.dict
Brute-Force | MD5 | hashcat -a 3 -m 0 example0.hash ?u?l?l?l?l?d
Brute-Force var | MD5 | hashcat -a 3 -m 0 -1 ?u -2 -?l?u?d -3 ?d example.hash ?1?2?2?2?2?2?2?3
Brute-Force inc | MD5 | hashcat -a 3 -m 0 --increment example.hash ?l?l?l?l?l?l?l
Brute-Force ses | MD5 | hashcat -a 3 -m 0 --session=session_name example.hash mask_file.hcmask
Combinator | MD5 | hashcat -a 1 -m 0 --rule-left='^-' --rule-right='$!' example.hash wordlist.dict wordlist.dict
Hybrid - Wrd/Msk | MD5 | hashcat -a 6 wordlist.dict ?d?d?d?d
Hybrid - Msk/Wrd | MD5 | hashcat -a 7 ?d?d?d?d wordlist.dict
Debug rules | | hashcat --stdout -r capitalize.rule -r swap.rule wordlist.dict
Restore Session | | hashcat --session session_name --restore
- [ Attack Modes ] -
# | Mode ( -a )
===+======
0 | Straight
1 | Combination
3 | Brute-force
6 | Hybrid Wordlist + Mask
7 | Hybrid Mask + Wordlist
- [ Basic options ] -
Options Short / Long | Type | Description | Example
===============================+======+======================================================+=======================
-m, --hash-type | Num | Hash-type, see references below | -m 1000
-a, --attack-mode | Num | Attack-mode, see references below | -a 3
-V, --version | | Print version |
-h, --help | | Print help |
--quiet | | Suppress output |
--hex-charset | | Assume charset is given in hex |
--hex-salt | | Assume salt is given in hex |
--hex-wordlist | | Assume words in wordlist are given in hex |
--force | | Ignore warnings |
--status | | Enable automatic update of the status screen |
--status-timer | Num | Sets seconds between status screen updates to X | --status-timer=1
--machine-readable | | Display the status view in a machine-readable format |
--keep-guessing | | Keep guessing the hash after it has been cracked |
--loopback | | Add new plains to induct directory |
--weak-hash-threshold | Num | Threshold X when to stop checking for weak hashes | --weak=0
--markov-hcstat | File | Specify hcstat file to use | --markov-hc=my.hcstat
--markov-disable | | Disables markov-chains, emulates classic brute-force |
--markov-classic | | Enables classic markov-chains, no per-position |
-t, --markov-threshold | Num | Threshold X when to stop accepting new markov-chains | -t 50
--runtime | Num | Abort session after X seconds of runtime | --runtime=10
--session | Str | Define specific session name | --session=mysession
--restore | | Restore session from --session |
--restore-disable | | Do not write restore file |
--restore-file-path | File | Specific path to restore file | --restore-file-path=my.restore
-o, --outfile | File | Define outfile for recovered hash | -o outfile.txt
--outfile-format | Num | Define outfile-format X for recovered hash | --outfile-format=7
--outfile-autohex-disable | | Disable the use of $HEX[] in output plains |
--outfile-check-timer | Num | Sets seconds between outfile checks to X | --outfile-check=30
-p, --separator | Char | Separator char for hashlists and outfile | -p :
--stdout | | Do not crack a hash, instead print candidates only |
--show | | Compare hashlist with potfile; show cracked hashes |
--left | | Compare hashlist with potfile; show uncracked hashes |
--username | | Enable ignoring of usernames in hashfile |
--remove | | Enable removal of hashes once they are cracked |
--remove-timer | Num | Update input hash file each X seconds | --remove-timer=30
--potfile-disable | | Do not write potfile |
--potfile-path | Dir | Specific path to potfile | --potfile-path=my.pot
--encoding-from | Code | Force internal wordlist encoding from X | --encoding-from=iso-8859-15
--encoding-to | Code | Force internal wordlist encoding to X | --encoding-to=utf-32le
--debug-mode | Num | Defines the debug mode (hybrid only by using rules) | --debug-mode=4
--debug-file | File | Output file for debugging rules | --debug-file=good.log
--induction-dir | Dir | Specify the induction directory to use for loopback | --induction=inducts
--outfile-check-dir | Dir | Specify the outfile directory to monitor for plains | --outfile-check-dir=x
--logfile-disable | | Disable the logfile |
--hccapx-message-pair | Num | Load only message pairs from hccapx matching X | --hccapx-message-pair=2
--nonce-error-corrections | Num | The BF size range to replace AP's nonce last bytes | --nonce-error-corrections=16
--truecrypt-keyfiles | File | Keyfiles to use, separated with commas | --truecrypt-key=x.png
--veracrypt-keyfiles | File | Keyfiles to use, separated with commas | --veracrypt-key=x.txt
--veracrypt-pim | Num | VeraCrypt personal iterations multiplier | --veracrypt-pim=1000
-b, --benchmark | | Run benchmark |
--speed-only | | Return expected speed of the attack, then quit |
--progress-only | | Return ideal progress step size and time to process |
-c, --segment-size | Num | Sets size in MB to cache from the wordfile to X | -c 32
--bitmap-min | Num | Sets minimum bits allowed for bitmaps to X | --bitmap-min=24
--bitmap-max | Num | Sets maximum bits allowed for bitmaps to X | --bitmap-max=24
--cpu-affinity | Str | Locks to CPU devices, separated with commas | --cpu-affinity=1,2,3
-I, --opencl-info | | Show info about detected OpenCL platforms/devices | -I
--opencl-platforms | Str | OpenCL platforms to use, separated with commas | --opencl-platforms=2
-d, --opencl-devices | Str | OpenCL devices to use, separated with commas | -d 1
-D, --opencl-device-types | Str | OpenCL device-types to use, separated with commas | -D 1
--opencl-vector-width | Num | Manually override OpenCL vector-width to X | --opencl-vector=4
-w, --workload-profile | Num | Enable a specific workload profile, see pool below | -w 3
-n, --kernel-accel | Num | Manual workload tuning, set outerloop step size to X | -n 64
-u, --kernel-loops | Num | Manual workload tuning, set innerloop step size to X | -u 256
--nvidia-spin-damp | Num | Workaround NVIDIAs CPU burning loop bug, in percent | --nvidia-spin-damp=50
--gpu-temp-disable | | Disable temperature and fanspeed reads and triggers |
--gpu-temp-abort | Num | Abort if GPU temperature reaches X degrees Celsius | --gpu-temp-abort=100
--gpu-temp-retain | Num | Try to retain GPU temperature at X degrees Celsius | --gpu-temp-retain=95
--powertune-enable | | Enable power tuning. Restores settings when finished |
--scrypt-tmto | Num | Manually override TMTO value for scrypt to X | --scrypt-tmto=3
-s, --skip | Num | Skip X words from the start | -s 1000000
-l, --limit | Num | Limit X words from the start + skipped words | -l 1000000
--keyspace | | Show keyspace base:mod values and quit |
-j, --rule-left | Rule | Single rule applied to each word from left wordlist | -j 'c'
-k, --rule-right | Rule | Single rule applied to each word from right wordlist | -k '^-'
-r, --rules-file | File | Multiple rules applied to each word from wordlists | -r rules/best64.rule
-g, --generate-rules | Num | Generate X random rules | -g 10000
--generate-rules-func-min | Num | Force min X functions per rule |
--generate-rules-func-max | Num | Force max X functions per rule |
--generate-rules-seed | Num | Force RNG seed set to X |
-1, --custom-charset1 | CS | User-defined charset ?1 | -1 ?l?d?u
-2, --custom-charset2 | CS | User-defined charset ?2 | -2 ?l?d?s
-3, --custom-charset3 | CS | User-defined charset ?3 |
-4, --custom-charset4 | CS | User-defined charset ?4 |
-i, --increment | | Enable mask increment mode |
--increment-min | Num | Start mask incrementing at X | --increment-min=4
--increment-max | Num | Stop mask incrementing at X | --increment-max=8
- [ Hash modes ] -
# | Name | Category
======+==================================================+======================================
0 | MD5 | Raw Hash
100 | SHA1 | Raw Hash
1400 | SHA-256 | Raw Hash
1700 | SHA-512 | Raw Hash
5000 | SHA-3 (Keccak) | Raw Hash
400 | phpass | Generic KDF
8900 | scrypt | Generic KDF
5600 | NetNTLMv2 | Network Protocols
11200 | MySQL CRAM (SHA1) | Network Protocols
12 | PostgreSQL | Database Server
131 | MSSQL (2000) | Database Server
132 | MSSQL (2005) | Database Server
1731 | MSSQL (2012, 2014) | Database Server
200 | MySQL323 | Database Server
300 | MySQL4.1/MySQL5 | Database Server
11500 | CRC32 | Checksums
1500 | descrypt, DES (Unix), Traditional DES | Operating Systems
500 | md5crypt, MD5 (Unix), Cisco-IOS $1$ (MD5) | Operating Systems
3200 | bcrypt $2*$, Blowfish (Unix) | Operating Systems
1800 | sha512crypt $6$, SHA512 (Unix) | Operating Systems
3000 | LM | Operating Systems
1000 | NTLM | Operating Systems
6600 | 1Password, agilekeychain | Password Managers
8200 | 1Password, cloudkeychain | Password Managers
11300 | Bitcoin/Litecoin wallet.dat | Password Managers
13400 | KeePass 1 (AES/Twofish) and KeePass 2 (AES) | Password Managers
15600 | Ethereum Wallet, PBKDF2-HMAC-SHA256 | Password Managers
15700 | Ethereum Wallet, SCRYPT | Password Managers
- [ Outfile Formats ] -
# | Format
===+========
1 | hash[:salt]
2 | plain
3 | hash[:salt]:plain
4 | hex_plain
5 | hash[:salt]:hex_plain
6 | plain:hex_plain
7 | hash[:salt]:plain:hex_plain
8 | crackpos
9 | hash[:salt]:crack_pos
10 | plain:crack_pos
11 | hash[:salt]:plain:crack_pos
12 | hex_plain:crack_pos
13 | hash[:salt]:hex_plain:crack_pos
14 | plain:hex_plain:crack_pos
15 | hash[:salt]:plain:hex_plain:crack_pos
- [ Built-in Charsets ] -
? | Buit-in charset masks
===+=========
l | abcdefghijklmnopqrstuvwxyz
u | ABCDEFGHIJKLMNOPQRSTUVWXYZ
d | 0123456789
h | 0123456789abcdef
H | 0123456789ABCDEF
s | !"#$%&'()*+,-./:;<=>?@[\]^_`{|}~
a | ?l?u?d?s
b | 0x00 - 0xff
- [ OpenCL Device Types ] -
# | Device Type
===+=============
1 | CPU
2 | GPU
3 | FPGA, DSP, Co-Processor
- [ Workload Profiles ] -
# | Performance | Runtime | Power Consumption | Desktop Impact
===+=============+=========+===================+=================
1 | Low | 2 ms | Low | Minimal
2 | Default | 12 ms | Economic | Noticeable
3 | High | 96 ms | High | Unresponsive
4 | Nightmare | 480 ms | Insane | Headless
- [ Rule Compatible Functions ] -
Name | Rule | Description | Example Rule | In Word | Output Word |
=============+========+===========================================+===============+===========+===========================+
Nothing | : | Do nothing | : | p@ssW0rd | p@ssW0rd |
Lowercase | l | Lowercase all letters | l | p@ssW0rd | p@ssw0rd |
Uppercase | u | Uppercase all letters | u | p@ssW0rd | P@SSW0RD |
Capitalize | c | Cap the 1st letter and lower the rest | c | p@ssW0rd | P@ssw0rd |
Inv Capital | C | Lower 1st found char, uppercase the rest | C | p@ssW0rd | p@SSW0RD |
Toggle Case | t | Toggle the case of all characters in word | t | p@ssW0rd | P@SSw0RD |
Toggle @ | TN | Toggle the case of char at position N | T3 | p@ssW0rd | p@sSW0rd |
Reverse | r | Reverse the entire word | r | p@ssW0rd | dr0Wss@p |
Duplicate | d | Duplicate entire word | d | p@ssW0rd | p@ssW0rdp@ssW0rd |
Reflect | f | Duplicate word reversed | f | p@ssW0rd | p@ssW0rddr0Wss@p |
Rotate Left | { | Rotates the word left | { | p@ssW0rd | @ssW0rdp |
Rotate Right | } | Rotates the word right | } | p@ssW0rd | dp@ssW0r |
Append Char | $X | Append character X to end | $1 | p@ssW0rd | p@ssW0rd1 |
Prepend Char | ^X | Prepend character X to front | ^1 | p@ssW0rd | 1p@ssW0rd |
Truncate left| [ | Deletes first character | [ | p@ssW0rd | @ssW0rd |
Trunct right | ] | Deletes last character | ] | p@ssW0rd | p@assW0r |
Replace | sXY | Replace all instances of X with Y | ss$ | p@ssW0rd | p@$$W0rd |
Purge | @X | Purge all instances of X | @s | p@ssW0rd | p@W0rd |
- [ Rule Specific Functions ] -
Name | Rule | Description | Example Rule | In Word | Output Word |
=============+========+===========================================+===============+==============+========================+
Swap front | k | Swaps first two characters | k | p@ssW0rd | @pssW0rd |
Swap back | K | Swaps last two characters | K | p@ssW0rd | p@ssW0dr |
Swap @ N | *NM | Swaps char at pos N with char at pos M | *34 | p@ssW0rd | p@sWs0rd |
Btwise s/left| LN | Bitwise shift left character @ N | L2 | p@ssW0rd | p@æsW0rd |
Btwise s/rght| RN | Bitwise shift right character @ N | R2 | p@ssW0rd | p@9sW0rd |
Ascii incr | +N | Increment character @ N by 1 ascii value | +2 | p@ssW0rd | p@tsW0rd |
Ascii decr | -N | Decrement character @ N by 1 ascii value | -1 | p@ssW0rd | p?ssW0rd |
Replace N+1 | .N | Replaces char @N with value at @N + 1 | .1 | p@ssW0rd | psssW0rd |
Replace N-1 | ,N | Replaces char @N with value at @N - 1 | ,1 | p@ssW0rd | ppssW0rd |
Dup blck frnt| yN | Duplicates first N characters | y2 | p@ssW0rd | p@p@ssW0rd |
Dup blck back| YN | Duplicates last N characters | Y2 | p@ssW0rd | p@ssW0rdrd |
Title | E | Capitalize every word | E | p@ssW0rd w0rld| P@ssw0rd W0rld |
Title w/sep | eX | Capitalize first word and after separator | e- | p@ssW0rd-w0rld| P@ssw0rd-W0rld |
- [ Hashcat Mask Files ] -
- [ Usage ] -
[?1,][?2,][?3,][?4,]mask
where the placeholders are as follows:
[?1] the 1st custom charset (-1) will be set to this value, optional
[?2] the 2nd custom charset (-2) will be set to this value, optional
[?3] the 3rd custom charset (-3) will be set to this value, optional
[?4] the 4th custom charset (-4) will be set to this value, optional
[mask] the mask which should (but does not need) to use the custom-charset defined by [?1], [?2], [?3] or [?4]
and can use any additional predefined charset (?d, ?l, ?u, ?s, ?a, ?b) and can contain fixed chars too
(example value: pass?1?d?d?2?l?l)
- [ Examples ] -
example1.hcmask
?d?l,test?1?1?1
abcdef,0123,ABC,789,?3?3?3?1?1?1?1?2?2?4?4?4?4
company?d?d?d?d?d
?u?l,?s?d,?1?a?a?a?a?2
?u?l?l?l?d?d?d?d?d?d
example2.hcmask
?u?l?l?l?l?l?l?d
?u?l?l?l?l?l?d?d?d?d
?u?l?l?l?l?l?l?l?d?d
?u?l?l?l?l?l?l?l?d?d
?u?l?l?l?l?l?l?d?d?d
?u?l?l?l?d?d?d?d?s
?u?l?l?l?l?ld?d?s
?s?u?l?l?l?d?d?d?d
Comments