HashCat

HashCat is a GPU-accelerated password recovery tool that supports hundreds of hash types. It uses a numeric hash mode to identify the algorithm, a wordlist or mask for the candidate generation, and rule engines to mutate guesses. It is widely used in penetration testing to crack dumped hashes such as NTLM, NetNTLMv2, Kerberos tickets, and Unix password hashes.

Reference for hash modes & example hashes: hashcat example_hashes wiki

---

Cheatsheet

# == Basic Usage ==
hashcat -m <mode> -a <attack> hashfile.txt wordlist.txt # standard syntax
hashcat -m 0 hash.txt rockyou.txt # crack MD5 with wordlist
hashcat -m 1000 ntlm.txt rockyou.txt # crack NTLM hashes
hashcat -m 5600 netntlmv2.txt rockyou.txt # crack NetNTLMv2
hashcat --show hash.txt # show cracked results from potfile
hashcat --potfile-path custom.pot hash.txt # use custom potfile

# == Attack Modes (-a) ==
-a 0 # straight / wordlist
-a 1 # combination (wordlist1 + wordlist2)
-a 3 # brute-force / mask
-a 6 # hybrid wordlist + mask
-a 7 # hybrid mask + wordlist

# == Common Hash Modes (-m) ==
-m 0 # MD5
-m 100 # SHA1
-m 1400 # SHA256
-m 1800 # sha512crypt (Unix)
-m 500 # md5crypt
-m 7400 # sha256crypt (Unix)
-m 1000 # NTLM
-m 3000 # LM
-m 5600 # NetNTLMv2
-m 5500 # NetNTLMv1
-m 400 # phpass / WordPress
-m 3200 # bcrypt
-m 22000 # WPA-PBKDF2-PMKID+EAPOL
-m 13100 # Kerberos 5 TGS-REP
-m 18200 # Kerberos 5 AS-REP
-m 7500 # Kerberos 5 AS-REQ Pre-Auth
-m 13400 # KeePass
-m 11600 # 7-Zip
hashcat -m 0 --example-hashes # test mode against example hashes

# == Wordlist Attack ==
hashcat -m 1000 ntlm.txt /usr/share/wordlists/rockyou.txt
hashcat -m 1000 ntlm.txt wordlist.txt --rules # apply rule engine
hashcat -m 1000 ntlm.txt wordlist.txt --rules-file rules.rule # custom rules
hashcat -m 1000 ntlm.txt -r /usr/share/hashcat/rules/best64.rule # bundled rules

# == Mask Attack ==
hashcat -m 1000 ntlm.txt -a 3 '?u?l?l?l?l?l?d?d' # e.g. Capital + 5 lower + 2 digits
hashcat -m 1000 ntlm.txt -a 3 '?d?d?d?d?d?d' # 6-digit PIN
hashcat -m 1000 ntlm.txt -a 3 --increment '?d?d?d?d?d?d' # increment length
hashcat -m 1000 ntlm.txt -a 3 -1 ?l?d '?1?1?1?1?1' # custom charset ?1 = a-z + digits

# == Mask Placeholders ==
?l # lowercase a-z
?u # uppercase A-Z
?d # digits 0-9
?s # special chars !"#$%&'()*+,-./:;<=>?@[\]^_`{|}~
?a # ?l?u?d?s (all printable)
?b # 0x00-0xff (binary)

# == Hybrid Attacks ==
hashcat -m 1000 ntlm.txt -a 6 wordlist.txt '?d?d?d' # password + 3 digits
hashcat -m 1000 ntlm.txt -a 7 '?u?l?l?l' wordlist.txt # mask + wordlist

# == Combination Attack ==
hashcat -m 0 hashes.txt list1.txt list2.txt # user+company combos

# == Rules ==
hashcat -m 1000 ntlm.txt wordlist.txt --rules # default best64 rules
hashcat -m 1000 ntlm.txt wordlist.txt -r rules/best64.rule
hashcat -m 1000 ntlm.txt wordlist.txt -j '$1' # append "1" to every word
hashcat -m 1000 ntlm.txt wordlist.txt -k '^1' # prepend "1"
hashcat -m 1000 ntlm.txt wordlist.txt -r rules/rockyou30000.rule # heavy rules

# == Performance & Device Control ==
hashcat -m 1000 ntlm.txt rockyou.txt --show # display cracked
hashcat -m 1000 ntlm.txt rockyou.txt --status # periodic status screen
hashcat -m 1000 ntlm.txt rockyou.txt -w 3 # workload profile (1 low, 3 default, 4 high)
hashcat -m 1000 ntlm.txt rockyou.txt --force # ignore warnings (CPU/old drivers)
hashcat -m 1000 ntlm.txt rockyou.txt -D 1 -T 1 # use device 1, tuning profile 1
hashcat -m 1000 ntlm.txt rockyou.txt -O # optimized kernel (short passwords only)
hashcat -m 1000 ntlm.txt rockyou.txt --opencl-info # list OpenCL devices

# == Useful Output & Parsing ==
hashcat --show --outfile-format 2 hash.txt # print only plaintext
hashcat -m 1000 ntlm.txt rockyou.txt --outfile cracked.txt # save results
hashcat -m 1000 ntlm.txt rockyou.txt --potfile-disable # ignore potfile
hashcat --identify hash.txt # identify hash type (autodetect)
hashcat -m 1000 --show hash.txt | cut -d: -f2- # extract plaintexts (strip hash:)

# == Common Hashcat Workflows ==
# NTLM dump (from SAM/secretsdump) -> rockyou
hashcat -m 1000 ntlm.hash rockyou.txt

# NetNTLMv2 from responder/crackmapexec -> rockyou
hashcat -m 5600 netntlmv2.hash rockyou.txt

# Kerberoast (TGS-REP) -> rockyou
hashcat -m 13100 kerberoast.txt rockyou.txt

# AS-REP roast (AS-REP) -> rockyou
hashcat -m 18200 asrep.txt rockyou.txt

# WPA handshake: convert .cap/.pcap to hashcat format first
hcxpcapngtool capture.cap -o handshake.hc22000
hashcat -m 22000 handshake.hc22000 wordlist.txt

# Unix passwd/shadow hashes: unshadow first
unshadow passwd shadow > unshadowed.txt
hashcat -m 1800 unshadowed.txt rockyou.txt

# zip/7z encrypted archives
zip2john archive.zip > zip.hash 2>/dev/null  # or use 7z2john
hashcat -m 17220 zip.hash rockyou.txt
hashcat -m 11600 7z.hash rockyou.txt