> For the complete documentation index, see [llms.txt](https://riteshs4hu.gitbook.io/infosec-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://riteshs4hu.gitbook.io/infosec-notes/internal-and-external-network-sec/password-cracking/hash-cracking/hashcat.md).

# Hashcat

**Hashcat** is a powerful password cracking tool that supports various cracking techniques.

### **Install Hashcat**

If you haven’t installed **Hashcat**, install it with:

* **Kali Linux/Debian:**

  ```bash
  sudo apt install hashcat
  ```
* **Windows:** Download from [Hashcat.net](https://hashcat.net/hashcat/)

Check if Hashcat is working:

```bash
hashcat --help
```

### **Hashcat Attack Modes and Built-in Charsets**

#### **Attack Modes**

Hashcat supports different **attack modes**, each designed for specific cracking techniques:

| **Mode** | **Attack Type**              | **Description**                                |
| -------- | ---------------------------- | ---------------------------------------------- |
| **0**    | **Straight**                 | Uses a **wordlist** (dictionary attack)        |
| **1**    | **Combination**              | Merges two **wordlists** to create new words   |
| **3**    | **Brute-force**              | Tries every possible character combination     |
| **6**    | **Hybrid (Wordlist + Mask)** | Appends a mask (`?d?d`) to each word in a list |
| **7**    | **Hybrid (Mask + Wordlist)** | Prepends a mask (`?d?d`) before each word      |
| **9**    | **Association**              | Cracks hashes using **related data**           |

***

#### **Built-in Charsets**

Hashcat provides predefined character sets that can be used in **brute-force and mask attacks**:

| **Symbol** | **Charset**        | **Characters Included**                |
| ---------- | ------------------ | -------------------------------------- |
| **?l**     | Lowercase letters  | `abcdefghijklmnopqrstuvwxyz`           |
| **?u**     | Uppercase letters  | `ABCDEFGHIJKLMNOPQRSTUVWXYZ`           |
| **?d**     | Digits (Numbers)   | `0123456789`                           |
| **?h**     | Lowercase hex      | `0123456789abcdef`                     |
| **?H**     | Uppercase hex      | `0123456789ABCDEF`                     |
| **?s**     | Special characters | `!"#$%&'()*+,-./:;<=>?@[\]^_`{         |
| **?a**     | All characters     | `?l?u?d?s` (letters, numbers, special) |
| **?b**     | All byte values    | `0x00` to `0xff`                       |

***

### **Common Hashcat Switches**

| **Switch**  | **Description**                                                          |
| ----------- | ------------------------------------------------------------------------ |
| `-a`        | Define the **attack mode** (`0` for wordlist, `3` for brute-force, etc.) |
| `-m`        | Specify the **hash mode** (e.g., `0` for MD5, `100` for SHA1)            |
| `-o`        | Output file for cracked hashes                                           |
| `--show`    | Display already cracked passwords                                        |
| `--force`   | Bypass warnings (use with caution)                                       |
| `-w 3`      | Set workload tuning (`1`=slow, `3`=balanced, `4`=fastest)                |
| `--session` | Save and resume attacks later                                            |

***

### **Identify Hash Type (MD5)**

MD5 hashes are **128-bit** and look like this:

```
5f4dcc3b5aa765d61d8327deb882cf99  # hash of "password"
```

To confirm the hash type:

```bash
hashid 5f4dcc3b5aa765d61d8327deb882cf99
```

or

```bash
hashcat --help | grep MD5
```

MD5 is represented by **`-m 0`** in Hashcat.

***

## **Hashcat Attack Modes**

Hashcat supports multiple attack modes. Here’s how to crack MD5 hashes using different methods:

### **Brute Force Attack (`-a 3`)**

* Tries every possible combination of characters until the correct password is found.
* **Example**: Crack an MD5 hash with exactly 6 lowercase letters.

#### **Steps**:

1. Create a file `hash.txt` and put your MD5 hash inside:

   ```bash
   echo "5f4dcc3b5aa765d61d8327deb882cf99" > hash.txt
   ```
2. Run Hashcat with brute force:

   ```bash
   hashcat -m 0 -a 3 hash.txt ?l?l?l?l?l?l
   ```

   * `?l` → Lowercase letters
   * `?u` → Uppercase letters
   * `?d` → Digits
   * `?s` → Special characters

#### **Example Masks:**

| Pattern        | Example  |
| -------------- | -------- |
| `?l?l?l?l?l?l` | `abcdef` |
| `?u?l?l?l?d?d` | `Abcd12` |
| `?d?d?d?d?d?d` | `123456` |

🚀 **Optimized brute-force attack**\
Use incremental mode (`-i`) to test shorter passwords first:

```bash
hashcat -m 0 -a 3 -i hash.txt ?l?l?l?l?l?l
```

***

### **Dictionary (Wordlist) Attack (`-a 0`)**

* Uses a list of common passwords (`rockyou.txt`).

#### **Steps**:

1. Get the RockYou wordlist (Kali users already have it):

   ```bash
   cp /usr/share/wordlists/rockyou.txt.gz .
   gzip -d rockyou.txt.gz
   ```
2. Run Hashcat:

   ```bash
   hashcat -m 0 -a 0 hash.txt rockyou.txt
   ```

💡 If you have a custom wordlist, replace `rockyou.txt` with your file.

***

### **Combination Attack (`-a 1`)**

* Merges two wordlists together.

#### **Steps**:

1. Create two wordlists:

   ```bash
   echo -e "password\nadmin\nroot" > wordlist1.txt
   echo -e "123\n@2024\n!" > wordlist2.txt
   ```
2. Run Hashcat:

   ```bash
   hashcat -m 0 -a 1 hash.txt wordlist1.txt wordlist2.txt
   ```

   * This will generate combinations like:

     ```
     password123
     admin@2024
     root!
     ```

***

### **Rule-Based Attack (`-a 0` + `--rules`)**

* Applies transformations to a wordlist (e.g., adding numbers, capitalizing letters).

#### **Steps**:

1. Use predefined rule files like `rockyou-30000.rule`:

   ```bash
   hashcat -m 0 -a 0 hash.txt rockyou.txt --rules=rockyou-30000.rule
   ```
2. To create your own rule:

   ```bash
   echo "Az" > custom.rule  # Capitalize first letter
   hashcat -m 0 -a 0 hash.txt rockyou.txt --rules=custom.rule
   ```

***

### **Hybrid Attack (`-a 6` and `-a 7`)**

* **`-a 6`**: Wordlist + Mask
* **`-a 7`**: Mask + Wordlist

#### **Example (`-a 6`)**:

* **Wordlist + Numbers (`?d?d`)**:

  ```bash
  hashcat -m 0 -a 6 hash.txt rockyou.txt ?d?d
  ```

  * Tries `password12`, `admin99`, etc.

#### **Example (`-a 7`)**:

* **Digits + Wordlist (`?d?dwordlist`)**:

  ```bash
  hashcat -m 0 -a 7 hash.txt ?d?d rockyou.txt
  ```

  * Tries `12password`, `99admin`, etc.

***

### **Running Hashcat with GPU**

* To use GPU acceleration (faster cracking):

  ```bash
  hashcat -m 0 -a 0 hash.txt rockyou.txt --force
  ```
* To check available GPUs:

  ```bash
  hashcat -I
  ```

***

### **Checking Cracked Passwords**

* If Hashcat successfully cracks a hash, check the result:

  ```bash
  hashcat -m 0 hash.txt --show
  ```

  Output format:

  ```
  5f4dcc3b5aa765d61d8327deb882cf99:password
  ```

***

### **Stopping & Resuming Hashcat**

* **Stop Hashcat**: Press `CTRL + C`
* **Resume a previous session**:

  ```bash
  hashcat --session=mySession --restore
  ```

***

### **Benchmarking Hashcat**

To check how fast Hashcat can process hashes:

```bash
hashcat -b -m 0
```