← retour aux outils back to tools

# Hashcat

Craqueur de mots de passe accéléré par GPU. Supporte des centaines de types de hachages avec des attaques par règles et par masque. GPU-accelerated password cracker. Supports hundreds of hash types with rule-based and mask attacks.

↗ https://hashcat.net

## Overview

Hashcat is the world’s fastest password cracker, leveraging GPU acceleration to crack hashes at billions of guesses per second. It supports over 300 hash types and multiple attack modes.

## Common Attack Modes

-a 0: Dictionary attack

    hashcat -m <mode> hash.txt /usr/share/wordlists/rockyou.txt

    # -a 0 with rules (most effective for common passwords)
    hashcat -m <mode> hash.txt rockyou.txt -r /usr/share/hashcat/rules/best64.rule
    hashcat -m <mode> hash.txt rockyou.txt -r rules/dive.rule

-a 3: Mask attack (brute-force with pattern)

    hashcat -m <mode> hash.txt -a 3 ?u?l?l?l?l?d?d?d  # Upper+lower+digits, 8 chars

-a 6: Hybrid (wordlist + mask)

    hashcat -m <mode> hash.txt rockyou.txt -a 6 ?d?d?d?d

## Common Hash Modes

Hash Type | Mode | Example
--- | --- | ---
NTLM | 1000 | `aad3b435b51404eeaad3b435b51404ee`
NTLMv2 | 5600 | `user::DOMAIN:...`
Kerberos TGS (23) | 13100 | `$krb5tgs$23$*...`
Kerberos AS-REP | 18200 | `$krb5asrep$23$...`
bcrypt | 3200 | `$2a$10$...`
MD5 | 0 | `5d41402abc4b2a76b9719d911017c592`
SHA1 | 100 | `aaf4c61ddcc5e8a2dabede0f3b482cd9aea9434d`
SHA256 | 1400 |
WPA2 | 22000 | (from .hccapx / .hc22000)

## Tips

- Use `--potfile-path engagement.pot` to keep separate potfiles per engagement
- `hashcat --show -m <mode> hash.txt` — show already-cracked hashes
- For Kerberoasting: `rockyou.txt` + `dive.rule` covers the most ground

Help / Man page

    hashcat [options] hash|hashfile|hccapxfile [dictionary|mask|directory]

    ATTACK MODES:
      -a 0  Dictionary
      -a 1  Combination
      -a 3  Brute-force / Mask
      -a 6  Hybrid Wordlist + Mask
      -a 7  Hybrid Mask + Wordlist
      -a 9  Association

    HASH TYPES (selection):
      0     MD5
      100   SHA1
      1000  NTLM
      1400  SHA256
      1800  sha512crypt (Linux $6$)
      3200  bcrypt
      5600  NetNTLMv2
      13100 Kerberos TGS-REP (etype 23)
      18200 Kerberos AS-REP (etype 23)
      22000 WPA-PBKDF2-PMKID+EAPOL

    MASK CHARS:
      ?l  lowercase (a-z)
      ?u  uppercase (A-Z)
      ?d  digits (0-9)
      ?s  special (!@#...)
      ?a  all printable
      ?h  0-9,a-f (hex lower)

    COMMON OPTIONS:
      -m <mode>       Hash type
      -a <mode>       Attack mode
      -o <file>       Output file
      -r <file>       Rules file
      --show          Show cracked hashes
      --username      Input contains username:hash
      --status        Enable status timer
      --runtime=<sec> Abort after N seconds

## Vue d’ensemble

Hashcat est le craqueur de mots de passe le plus rapide au monde, exploitant l’accélération GPU pour craquer des hachages à des milliards de tentatives par seconde. Il supporte plus de 300 types de hachages et plusieurs modes d’attaque.

## Modes d’attaque courants

    # -a 0: Attaque par dictionnaire
    hashcat -m <mode> hash.txt /usr/share/wordlists/rockyou.txt

    # -a 0 avec règles (plus efficace pour les mots de passe courants)
    hashcat -m <mode> hash.txt rockyou.txt -r /usr/share/hashcat/rules/best64.rule
    hashcat -m <mode> hash.txt rockyou.txt -r rules/dive.rule

    # -a 3: Attaque par masque (brute-force avec motif)
    hashcat -m <mode> hash.txt -a 3 ?u?l?l?l?l?d?d?d  # Majuscule+minuscules+chiffres, 8 cars

    # -a 6: Hybride (liste de mots + masque)
    hashcat -m <mode> hash.txt rockyou.txt -a 6 ?d?d?d?d

## Modes de hachage courants

Type de hachage | Mode | Exemple
--- | --- | ---
NTLM | 1000 | `aad3b435b51404eeaad3b435b51404ee`
NTLMv2 | 5600 | `user::DOMAIN:...`
Kerberos TGS (23) | 13100 | `$krb5tgs$23$*...`
Kerberos AS-REP | 18200 | `$krb5asrep$23$...`
bcrypt | 3200 | `$2a$10$...`
MD5 | 0 | `5d41402abc4b2a76b9719d911017c592`
SHA1 | 100 | `aaf4c61ddcc5e8a2dabede0f3b482cd9aea9434d`
SHA256 | 1400 |
WPA2 | 22000 | (depuis .hccapx / .hc22000)

## Conseils

- Utiliser `--potfile-path engagement.pot` pour des fichiers potfile séparés par mission
- `hashcat --show -m <mode> hash.txt` : afficher les hachages déjà craqués
- Pour le Kerberoasting : `rockyou.txt` + `dive.rule` offre la meilleure couverture

Aide / Page de manuel

    hashcat [options] hash|hashfile|hccapxfile [dictionary|mask|directory]

    ATTACK MODES:
      -a 0  Dictionary
      -a 1  Combination
      -a 3  Brute-force / Mask
      -a 6  Hybrid Wordlist + Mask
      -a 7  Hybrid Mask + Wordlist
      -a 9  Association

    HASH TYPES (selection):
      0     MD5
      100   SHA1
      1000  NTLM
      1400  SHA256
      1800  sha512crypt (Linux $6$)
      3200  bcrypt
      5600  NetNTLMv2
      13100 Kerberos TGS-REP (etype 23)
      18200 Kerberos AS-REP (etype 23)
      22000 WPA-PBKDF2-PMKID+EAPOL

    MASK CHARS:
      ?l  lowercase (a-z)
      ?u  uppercase (A-Z)
      ?d  digits (0-9)
      ?s  special (!@#...)
      ?a  all printable
      ?h  0-9,a-f (hex lower)

    COMMON OPTIONS:
      -m <mode>       Hash type
      -a <mode>       Attack mode
      -o <file>       Output file
      -r <file>       Rules file
      --show          Show cracked hashes
      --username      Input contains username:hash
      --status        Enable status timer
      --runtime=<sec> Abort after N seconds