Hashcat

Overview

Hashcat is the world’s fastest password cracker, leveraging GPU acceleration to crack hashes at billions of guesses per second. It supports over 300 hash types and multiple attack modes.

Common Attack Modes

-a 0: Dictionary attack

hashcat -m <mode> hash.txt /usr/share/wordlists/rockyou.txt

# -a 0 with rules (most effective for common passwords)
hashcat -m <mode> hash.txt rockyou.txt -r /usr/share/hashcat/rules/best64.rule
hashcat -m <mode> hash.txt rockyou.txt -r rules/dive.rule

-a 3: Mask attack (brute-force with pattern)

hashcat -m <mode> hash.txt -a 3 ?u?l?l?l?l?d?d?d  # Upper+lower+digits, 8 chars

-a 6: Hybrid (wordlist + mask)

hashcat -m <mode> hash.txt rockyou.txt -a 6 ?d?d?d?d

Common Hash Modes

Tips

• Use --potfile-path engagement.pot to keep separate potfiles per engagement
• hashcat --show -m <mode> hash.txt — show already-cracked hashes
• For Kerberoasting: rockyou.txt + dive.rule covers the most ground

hashcat [options] hash|hashfile|hccapxfile [dictionary|mask|directory]

ATTACK MODES:
  -a 0  Dictionary
  -a 1  Combination
  -a 3  Brute-force / Mask
  -a 6  Hybrid Wordlist + Mask
  -a 7  Hybrid Mask + Wordlist
  -a 9  Association

HASH TYPES (selection):
  0     MD5
  100   SHA1
  1000  NTLM
  1400  SHA256
  1800  sha512crypt (Linux $6$)
  3200  bcrypt
  5600  NetNTLMv2
  13100 Kerberos TGS-REP (etype 23)
  18200 Kerberos AS-REP (etype 23)
  22000 WPA-PBKDF2-PMKID+EAPOL

MASK CHARS:
  ?l  lowercase (a-z)
  ?u  uppercase (A-Z)
  ?d  digits (0-9)
  ?s  special (!@#...)
  ?a  all printable
  ?h  0-9,a-f (hex lower)

COMMON OPTIONS:
  -m <mode>       Hash type
  -a <mode>       Attack mode
  -o <file>       Output file
  -r <file>       Rules file
  --show          Show cracked hashes
  --username      Input contains username:hash
  --status        Enable status timer
  --runtime=<sec> Abort after N seconds

Vue d’ensemble

Hashcat est le craqueur de mots de passe le plus rapide au monde, exploitant l’accélération GPU pour craquer des hachages à des milliards de tentatives par seconde. Il supporte plus de 300 types de hachages et plusieurs modes d’attaque.

Modes d’attaque courants

# -a 0: Attaque par dictionnaire
hashcat -m <mode> hash.txt /usr/share/wordlists/rockyou.txt

# -a 0 avec règles (plus efficace pour les mots de passe courants)
hashcat -m <mode> hash.txt rockyou.txt -r /usr/share/hashcat/rules/best64.rule
hashcat -m <mode> hash.txt rockyou.txt -r rules/dive.rule

# -a 3: Attaque par masque (brute-force avec motif)
hashcat -m <mode> hash.txt -a 3 ?u?l?l?l?l?d?d?d  # Majuscule+minuscules+chiffres, 8 cars

# -a 6: Hybride (liste de mots + masque)
hashcat -m <mode> hash.txt rockyou.txt -a 6 ?d?d?d?d

Modes de hachage courants

Conseils

• Utiliser --potfile-path engagement.pot pour des fichiers potfile séparés par mission
• hashcat --show -m <mode> hash.txt : afficher les hachages déjà craqués
• Pour le Kerberoasting : rockyou.txt + dive.rule offre la meilleure couverture

hashcat [options] hash|hashfile|hccapxfile [dictionary|mask|directory]

ATTACK MODES:
  -a 0  Dictionary
  -a 1  Combination
  -a 3  Brute-force / Mask
  -a 6  Hybrid Wordlist + Mask
  -a 7  Hybrid Mask + Wordlist
  -a 9  Association

HASH TYPES (selection):
  0     MD5
  100   SHA1
  1000  NTLM
  1400  SHA256
  1800  sha512crypt (Linux $6$)
  3200  bcrypt
  5600  NetNTLMv2
  13100 Kerberos TGS-REP (etype 23)
  18200 Kerberos AS-REP (etype 23)
  22000 WPA-PBKDF2-PMKID+EAPOL

MASK CHARS:
  ?l  lowercase (a-z)
  ?u  uppercase (A-Z)
  ?d  digits (0-9)
  ?s  special (!@#...)
  ?a  all printable
  ?h  0-9,a-f (hex lower)

COMMON OPTIONS:
  -m <mode>       Hash type
  -a <mode>       Attack mode
  -o <file>       Output file
  -r <file>       Rules file
  --show          Show cracked hashes
  --username      Input contains username:hash
  --status        Enable status timer
  --runtime=<sec> Abort after N seconds