Hashcat

What is Hashcat?

Hashcat is the world's leading password recovery tool, capable of cracking hundreds of hash types using CPU or GPU acceleration. It supports multiple attack modes including dictionary, brute-force, combinator, and rule-based attacks. Security professionals use it during authorized assessments to test password strength and recover credentials from captured hashes.

Installation

# Update packages
sudo apt update

# Install (pre-installed on Kali, otherwise:)
sudo apt install hashcat -y

# Verify installation
hashcat --version

Basic Usage

# Basic syntax
hashcat -m [hash-type] -a [attack-mode] [hashfile] [wordlist/mask]

# Dictionary attack on MD5 hash (-m 0)
hashcat -m 0 -a 0 hashes.txt /usr/share/wordlists/rockyou.txt

# Dictionary attack on NTLM hash (-m 1000)
hashcat -m 1000 -a 0 hashes.txt /usr/share/wordlists/rockyou.txt

# Brute-force attack with mask (8-char alphanumeric)
hashcat -m 0 -a 3 hashes.txt ?a?a?a?a?a?a?a?a

# Dictionary attack with rules (best64)
hashcat -m 0 -a 0 hashes.txt rockyou.txt -r /usr/share/hashcat/rules/best64.rule

# Show cracked results
hashcat -m 0 hashes.txt --show

Common Hash Types (-m flag)

• 0 — MD5
• 100 — SHA-1
• 1000 — NTLM (Windows passwords)
• 1800 — sha512crypt (Linux /etc/shadow)
• 2500 — WPA/WPA2 handshake (Wi-Fi)
• 3200 — bcrypt (web apps)
• 13100 — Kerberoast / TGS-REP (Active Directory)

Attack Modes (-a flag)

• 0 — Dictionary attack (wordlist)
• 1 — Combinator attack (two wordlists combined)
• 3 — Brute-force / mask attack
• 6 — Hybrid wordlist + mask
• 7 — Hybrid mask + wordlist

Common Use Cases

• Authorized penetration testing engagements
• CTF (Capture The Flag) competitions
• Internal security audits
• Bug bounty program research

Further Reading

Practice on legal targets like TryHackMe, HackTheBox, or hackzia.site labs. Always read the official documentation before using in a live engagement.