CtrlK
Pentest Notes / Exploitation / Password Cracking
Hashcat
Basic Syntax
hashcat -m [hash mode] -a 0 [hash_file] /usr/share/wordlists/rockyou.txt
-m: use hashid -m to get hashcat hash mode
-a: Attack mode - 0=dictionary (default)
Options
Hashcat
| Option | Description |
|---|---|
| -m [type] | Hash mode |
| -a [mode] | Attack mode. 0: dictionary, 3: mask |
| -r [rule_file] | Rules file |
| --show | Show cracked hashes |
| -o [output_file] | Save output |
Rule based attack
hashcat -m [hash type] -a 0 [hash file] /usr/share/wordlists/rockyou.txt -r /usr/share/hashcat/rules/best66.rule
Placeholders
| Placeholder | Character Set |
|---|---|
| ?l | Lowercase letters (a-z) |
| ?u | Uppercase letters (A-Z) |
| ?d | Digits (0-9) |
| ?s | Special characters |
| ?a | All printable ASCII |
Eg: Summer2026! would be ?u?l?l?l?l?l?d?d?d?d?s
Mask attack
hashcat -m 0 -a 3 [hash file] '?l?l?l?l?l?l?l?l'