============================================================ HASHCAT HOWTO ============================================================ - [ Resources ] - * hashcat Wiki: https://hashcat.net/wiki/doku.php?id=hashcat - [ Usage ] - hashcat [options]... hash|hashfile|hcapxfile [dictionary|mask|directory]... - [ Basic Examples ] - Attack-Mode | Hash | -a | -m | Example command ==================+======+================================================================== Wordlist | $P$ | hashcat -a 0 -m 400 example.hash wordlist.dict Wordlist + Rules | MD5 | hashcat -a 0 -m 0 -r example1.rule -r example2.rule example0.hash wordlist.dict Wordlist | MD | hashcat -a 0 -m 0 --remove -o output.txt example.hash wordlist.dict Brute-Force | MD5 | hashcat -a 3 -m 0 example0.hash ?u?l?l?l?l?d Brute-Force var | MD5 | hashcat -a 3 -m 0 -1 ?u -2 -?l?u?d -3 ?d example.hash ?1?2?2?2?2?2?2?3 Brute-Force inc | MD5 | hashcat -a 3 -m 0 --increment example.hash ?l?l?l?l?l?l?l Brute-Force ses | MD5 | hashcat -a 3 -m 0 --session=session_name example.hash mask_file.hcmask Combinator | MD5 | hashcat -a 1 -m 0 --rule-left='^-' --rule-right='$!' example.hash wordlist.dict wordlist.dict Hybrid - Wrd/Msk | MD5 | hashcat -a 6 wordlist.dict ?d?d?d?d Hybrid - Msk/Wrd | MD5 | hashcat -a 7 ?d?d?d?d wordlist.dict Debug rules | | hashcat --stdout -r capitalize.rule -r swap.rule wordlist.dict Restore Session | | hashcat --session session_name --restore - [ Attack Modes ] - # | Mode ( -a ) ===+====== 0 | Straight 1 | Combination 3 | Brute-force 6 | Hybrid Wordlist + Mask 7 | Hybrid Mask + Wordlist - [ Basic options ] - Options Short / Long | Type | Description | Example ===============================+======+======================================================+======================= -m, --hash-type | Num | Hash-type, see references below | -m 1000 -a, --attack-mode | Num | Attack-mode, see references below | -a 3 -V, --version | | Print version | -h, --help | | Print help | --quiet | | Suppress output | --hex-charset | | Assume charset is given in hex | --hex-salt | | Assume salt is given in hex | --hex-wordlist | | Assume words in wordlist are given in hex | --force | | Ignore warnings | --status | | Enable automatic update of the status screen | --status-timer | Num | Sets seconds between status screen updates to X | --status-timer=1 --machine-readable | | Display the status view in a machine-readable format | --keep-guessing | | Keep guessing the hash after it has been cracked | --loopback | | Add new plains to induct directory | --weak-hash-threshold | Num | Threshold X when to stop checking for weak hashes | --weak=0 --markov-hcstat | File | Specify hcstat file to use | --markov-hc=my.hcstat --markov-disable | | Disables markov-chains, emulates classic brute-force | --markov-classic | | Enables classic markov-chains, no per-position | -t, --markov-threshold | Num | Threshold X when to stop accepting new markov-chains | -t 50 --runtime | Num | Abort session after X seconds of runtime | --runtime=10 --session | Str | Define specific session name | --session=mysession --restore | | Restore session from --session | --restore-disable | | Do not write restore file | --restore-file-path | File | Specific path to restore file | --restore-file-path=my.restore -o, --outfile | File | Define outfile for recovered hash | -o outfile.txt --outfile-format | Num | Define outfile-format X for recovered hash | --outfile-format=7 --outfile-autohex-disable | | Disable the use of $HEX[] in output plains | --outfile-check-timer | Num | Sets seconds between outfile checks to X | --outfile-check=30 -p, --separator | Char | Separator char for hashlists and outfile | -p : --stdout | | Do not crack a hash, instead print candidates only | --show | | Compare hashlist with potfile; show cracked hashes | --left | | Compare hashlist with potfile; show uncracked hashes | --username | | Enable ignoring of usernames in hashfile | --remove | | Enable removal of hashes once they are cracked | --remove-timer | Num | Update input hash file each X seconds | --remove-timer=30 --potfile-disable | | Do not write potfile | --potfile-path | Dir | Specific path to potfile | --potfile-path=my.pot --encoding-from | Code | Force internal wordlist encoding from X | --encoding-from=iso-8859-15 --encoding-to | Code | Force internal wordlist encoding to X | --encoding-to=utf-32le --debug-mode | Num | Defines the debug mode (hybrid only by using rules) | --debug-mode=4 --debug-file | File | Output file for debugging rules | --debug-file=good.log --induction-dir | Dir | Specify the induction directory to use for loopback | --induction=inducts --outfile-check-dir | Dir | Specify the outfile directory to monitor for plains | --outfile-check-dir=x --logfile-disable | | Disable the logfile | --hccapx-message-pair | Num | Load only message pairs from hccapx matching X | --hccapx-message-pair=2 --nonce-error-corrections | Num | The BF size range to replace AP's nonce last bytes | --nonce-error-corrections=16 --truecrypt-keyfiles | File | Keyfiles to use, separated with commas | --truecrypt-key=x.png --veracrypt-keyfiles | File | Keyfiles to use, separated with commas | --veracrypt-key=x.txt --veracrypt-pim | Num | VeraCrypt personal iterations multiplier | --veracrypt-pim=1000 -b, --benchmark | | Run benchmark | --speed-only | | Return expected speed of the attack, then quit | --progress-only | | Return ideal progress step size and time to process | -c, --segment-size | Num | Sets size in MB to cache from the wordfile to X | -c 32 --bitmap-min | Num | Sets minimum bits allowed for bitmaps to X | --bitmap-min=24 --bitmap-max | Num | Sets maximum bits allowed for bitmaps to X | --bitmap-max=24 --cpu-affinity | Str | Locks to CPU devices, separated with commas | --cpu-affinity=1,2,3 -I, --opencl-info | | Show info about detected OpenCL platforms/devices | -I --opencl-platforms | Str | OpenCL platforms to use, separated with commas | --opencl-platforms=2 -d, --opencl-devices | Str | OpenCL devices to use, separated with commas | -d 1 -D, --opencl-device-types | Str | OpenCL device-types to use, separated with commas | -D 1 --opencl-vector-width | Num | Manually override OpenCL vector-width to X | --opencl-vector=4 -w, --workload-profile | Num | Enable a specific workload profile, see pool below | -w 3 -n, --kernel-accel | Num | Manual workload tuning, set outerloop step size to X | -n 64 -u, --kernel-loops | Num | Manual workload tuning, set innerloop step size to X | -u 256 --nvidia-spin-damp | Num | Workaround NVIDIAs CPU burning loop bug, in percent | --nvidia-spin-damp=50 --gpu-temp-disable | | Disable temperature and fanspeed reads and triggers | --gpu-temp-abort | Num | Abort if GPU temperature reaches X degrees Celsius | --gpu-temp-abort=100 --gpu-temp-retain | Num | Try to retain GPU temperature at X degrees Celsius | --gpu-temp-retain=95 --powertune-enable | | Enable power tuning. Restores settings when finished | --scrypt-tmto | Num | Manually override TMTO value for scrypt to X | --scrypt-tmto=3 -s, --skip | Num | Skip X words from the start | -s 1000000 -l, --limit | Num | Limit X words from the start + skipped words | -l 1000000 --keyspace | | Show keyspace base:mod values and quit | -j, --rule-left | Rule | Single rule applied to each word from left wordlist | -j 'c' -k, --rule-right | Rule | Single rule applied to each word from right wordlist | -k '^-' -r, --rules-file | File | Multiple rules applied to each word from wordlists | -r rules/best64.rule -g, --generate-rules | Num | Generate X random rules | -g 10000 --generate-rules-func-min | Num | Force min X functions per rule | --generate-rules-func-max | Num | Force max X functions per rule | --generate-rules-seed | Num | Force RNG seed set to X | -1, --custom-charset1 | CS | User-defined charset ?1 | -1 ?l?d?u -2, --custom-charset2 | CS | User-defined charset ?2 | -2 ?l?d?s -3, --custom-charset3 | CS | User-defined charset ?3 | -4, --custom-charset4 | CS | User-defined charset ?4 | -i, --increment | | Enable mask increment mode | --increment-min | Num | Start mask incrementing at X | --increment-min=4 --increment-max | Num | Stop mask incrementing at X | --increment-max=8 - [ Hash modes ] - # | Name | Category ======+==================================================+====================================== 0 | MD5 | Raw Hash 100 | SHA1 | Raw Hash 1400 | SHA-256 | Raw Hash 1700 | SHA-512 | Raw Hash 5000 | SHA-3 (Keccak) | Raw Hash 400 | phpass | Generic KDF 8900 | scrypt | Generic KDF 5600 | NetNTLMv2 | Network Protocols 11200 | MySQL CRAM (SHA1) | Network Protocols 12 | PostgreSQL | Database Server 131 | MSSQL (2000) | Database Server 132 | MSSQL (2005) | Database Server 1731 | MSSQL (2012, 2014) | Database Server 200 | MySQL323 | Database Server 300 | MySQL4.1/MySQL5 | Database Server 11500 | CRC32 | Checksums 1500 | descrypt, DES (Unix), Traditional DES | Operating Systems 500 | md5crypt, MD5 (Unix), Cisco-IOS $1$ (MD5) | Operating Systems 3200 | bcrypt $2*$, Blowfish (Unix) | Operating Systems 1800 | sha512crypt $6$, SHA512 (Unix) | Operating Systems 3000 | LM | Operating Systems 1000 | NTLM | Operating Systems 6600 | 1Password, agilekeychain | Password Managers 8200 | 1Password, cloudkeychain | Password Managers 11300 | Bitcoin/Litecoin wallet.dat | Password Managers 13400 | KeePass 1 (AES/Twofish) and KeePass 2 (AES) | Password Managers 15600 | Ethereum Wallet, PBKDF2-HMAC-SHA256 | Password Managers 15700 | Ethereum Wallet, SCRYPT | Password Managers - [ Outfile Formats ] - # | Format ===+======== 1 | hash[:salt] 2 | plain 3 | hash[:salt]:plain 4 | hex_plain 5 | hash[:salt]:hex_plain 6 | plain:hex_plain 7 | hash[:salt]:plain:hex_plain 8 | crackpos 9 | hash[:salt]:crack_pos 10 | plain:crack_pos 11 | hash[:salt]:plain:crack_pos 12 | hex_plain:crack_pos 13 | hash[:salt]:hex_plain:crack_pos 14 | plain:hex_plain:crack_pos 15 | hash[:salt]:plain:hex_plain:crack_pos - [ Built-in Charsets ] - ? | Buit-in charset masks ===+========= l | abcdefghijklmnopqrstuvwxyz u | ABCDEFGHIJKLMNOPQRSTUVWXYZ d | 0123456789 h | 0123456789abcdef H | 0123456789ABCDEF s | !"#$%&'()*+,-./:;<=>?@[\]^_`{|}~ a | ?l?u?d?s b | 0x00 - 0xff - [ OpenCL Device Types ] - # | Device Type ===+============= 1 | CPU 2 | GPU 3 | FPGA, DSP, Co-Processor - [ Workload Profiles ] - # | Performance | Runtime | Power Consumption | Desktop Impact ===+=============+=========+===================+================= 1 | Low | 2 ms | Low | Minimal 2 | Default | 12 ms | Economic | Noticeable 3 | High | 96 ms | High | Unresponsive 4 | Nightmare | 480 ms | Insane | Headless - [ Rule Compatible Functions ] - Name | Rule | Description | Example Rule | In Word | Output Word | =============+========+===========================================+===============+===========+===========================+ Nothing | : | Do nothing | : | p@ssW0rd | p@ssW0rd | Lowercase | l | Lowercase all letters | l | p@ssW0rd | p@ssw0rd | Uppercase | u | Uppercase all letters | u | p@ssW0rd | P@SSW0RD | Capitalize | c | Cap the 1st letter and lower the rest | c | p@ssW0rd | P@ssw0rd | Inv Capital | C | Lower 1st found char, uppercase the rest | C | p@ssW0rd | p@SSW0RD | Toggle Case | t | Toggle the case of all characters in word | t | p@ssW0rd | P@SSw0RD | Toggle @ | TN | Toggle the case of char at position N | T3 | p@ssW0rd | p@sSW0rd | Reverse | r | Reverse the entire word | r | p@ssW0rd | dr0Wss@p | Duplicate | d | Duplicate entire word | d | p@ssW0rd | p@ssW0rdp@ssW0rd | Reflect | f | Duplicate word reversed | f | p@ssW0rd | p@ssW0rddr0Wss@p | Rotate Left | { | Rotates the word left | { | p@ssW0rd | @ssW0rdp | Rotate Right | } | Rotates the word right | } | p@ssW0rd | dp@ssW0r | Append Char | $X | Append character X to end | $1 | p@ssW0rd | p@ssW0rd1 | Prepend Char | ^X | Prepend character X to front | ^1 | p@ssW0rd | 1p@ssW0rd | Truncate left| [ | Deletes first character | [ | p@ssW0rd | @ssW0rd | Trunct right | ] | Deletes last character | ] | p@ssW0rd | p@assW0r | Replace | sXY | Replace all instances of X with Y | ss$ | p@ssW0rd | p@$$W0rd | Purge | @X | Purge all instances of X | @s | p@ssW0rd | p@W0rd | - [ Rule Specific Functions ] - Name | Rule | Description | Example Rule | In Word | Output Word | =============+========+===========================================+===============+==============+========================+ Swap front | k | Swaps first two characters | k | p@ssW0rd | @pssW0rd | Swap back | K | Swaps last two characters | K | p@ssW0rd | p@ssW0dr | Swap @ N | *NM | Swaps char at pos N with char at pos M | *34 | p@ssW0rd | p@sWs0rd | Btwise s/left| LN | Bitwise shift left character @ N | L2 | p@ssW0rd | p@æsW0rd | Btwise s/rght| RN | Bitwise shift right character @ N | R2 | p@ssW0rd | p@9sW0rd | Ascii incr | +N | Increment character @ N by 1 ascii value | +2 | p@ssW0rd | p@tsW0rd | Ascii decr | -N | Decrement character @ N by 1 ascii value | -1 | p@ssW0rd | p?ssW0rd | Replace N+1 | .N | Replaces char @N with value at @N + 1 | .1 | p@ssW0rd | psssW0rd | Replace N-1 | ,N | Replaces char @N with value at @N - 1 | ,1 | p@ssW0rd | ppssW0rd | Dup blck frnt| yN | Duplicates first N characters | y2 | p@ssW0rd | p@p@ssW0rd | Dup blck back| YN | Duplicates last N characters | Y2 | p@ssW0rd | p@ssW0rdrd | Title | E | Capitalize every word | E | p@ssW0rd w0rld| P@ssw0rd W0rld | Title w/sep | eX | Capitalize first word and after separator | e- | p@ssW0rd-w0rld| P@ssw0rd-W0rld | - [ Hashcat Mask Files ] - - [ Usage ] - [?1,][?2,][?3,][?4,]mask where the placeholders are as follows: [?1] the 1st custom charset (-1) will be set to this value, optional [?2] the 2nd custom charset (-2) will be set to this value, optional [?3] the 3rd custom charset (-3) will be set to this value, optional [?4] the 4th custom charset (-4) will be set to this value, optional [mask] the mask which should (but does not need) to use the custom-charset defined by [?1], [?2], [?3] or [?4] and can use any additional predefined charset (?d, ?l, ?u, ?s, ?a, ?b) and can contain fixed chars too (example value: pass?1?d?d?2?l?l) - [ Examples ] - example1.hcmask ?d?l,test?1?1?1 abcdef,0123,ABC,789,?3?3?3?1?1?1?1?2?2?4?4?4?4 company?d?d?d?d?d ?u?l,?s?d,?1?a?a?a?a?2 ?u?l?l?l?d?d?d?d?d?d example2.hcmask ?u?l?l?l?l?l?l?d ?u?l?l?l?l?l?d?d?d?d ?u?l?l?l?l?l?l?l?d?d ?u?l?l?l?l?l?l?l?d?d ?u?l?l?l?l?l?l?d?d?d ?u?l?l?l?d?d?d?d?s ?u?l?l?l?l?ld?d?s ?s?u?l?l?l?d?d?d?d