Hashcat

Hashcat

GPU-accelerated offline hash cracker — the standard tool for password recovery in offensive ops.

Quick Start

# Wordlist attack on NTLM hashes
hashcat -a 0 -m 1000 hashes.txt rockyou.txt

# Rule-based wordlist attack
hashcat -a 0 -m 1000 hashes.txt rockyou.txt -r /usr/share/hashcat/rules/best64.rule

# Mask brute-force (8-char, uppercase + digits)
hashcat -a 3 -m 1000 hashes.txt ?u?u?u?u?d?d?d?d

Attack Modes

Common Hash Types (-m)

TrueCrypt Header Campaigns

For a standard non-system file container, preserve all four 512-byte header candidates before cracking:

vol=volume.tc
size=$(stat -c %s "$vol")
dd if="$vol" of=header-primary-normal.bin iflag=skip_bytes,count_bytes skip=0 count=512 status=none
dd if="$vol" of=header-primary-hidden.bin iflag=skip_bytes,count_bytes skip=65536 count=512 status=none
dd if="$vol" of=header-backup-normal.bin iflag=skip_bytes,count_bytes skip=$((size-131072)) count=512 status=none
dd if="$vol" of=header-backup-hidden.bin iflag=skip_bytes,count_bytes skip=$((size-65536)) count=512 status=none
sha256sum header-*.bin

TrueCrypt legacy mode matrix:

• Do not stop at modes ending in 1; XTS 1024/1536 cascade configurations require the ...2/...3 modes.
• Test primary and backup headers independently. A stale or damaged primary header does not invalidate its backup.
• Record source offset, mode, candidate set, and potfile per run; a random-looking header or extractor output is not proof of format.
• VeraCrypt mode families and input formats differ by PRF, legacy/boot mode, and PIM. Confirm them with hashcat -hh | grep -i veracrypt and use the extractor's $veracrypt$... record instead of assuming a raw TrueCrypt header contract.
• Start with exact evidence-derived candidates across the complete applicable mode/header matrix before widening rules or masks.
• Validate any recovered candidate through a read-only mount and filesystem listing; potfile output alone is not a decryption oracle.

Mask Characters

Core Flags

Common Workflows

# NTLM with rockyou + best64 rules
hashcat -a 0 -m 1000 ntlm.txt rockyou.txt -r best64.rule -O

# Net-NTLMv2 (Responder capture)
hashcat -a 0 -m 5600 netntlm.txt rockyou.txt -r best64.rule

# Kerberoasting TGS
hashcat -a 0 -m 13100 kerberoast.txt rockyou.txt -r one-rule-to-rule-them-all.rule

# AS-REP roasting
hashcat -a 0 -m 18200 asrep.txt rockyou.txt

# Mask brute-force: 8-char, any printable
hashcat -a 3 -m 1000 hashes.txt -1 ?a ?1?1?1?1?1?1?1?1 --increment --increment-min 6

# Combine wordlist + mask (hybrid)
hashcat -a 6 -m 1000 hashes.txt rockyou.txt ?d?d?d

# Show cracked passwords
hashcat -m 1000 hashes.txt --show

Session Management

# Named session (survives interruption)
hashcat -a 0 -m 1000 hashes.txt rockyou.txt --session mysession

# Resume session
hashcat --session mysession --restore

PRINCE Attack (-a 9)

# Requires princeprocessor (pp64.bin)
pp64.bin wordlist.txt | hashcat -a 0 -m 1000 hashes.txt
# Or native (hashcat 6.2+)
hashcat -a 9 -m 1000 hashes.txt wordlist.txt

Combinator Attack (-a 1)

# Concatenate every word from list1 with every word from list2
hashcat -a 1 -m 1000 hashes.txt words1.txt words2.txt

# Add rules to left/right side
hashcat -a 1 -m 1000 hashes.txt words1.txt words2.txt -j '$-' -k 'l'

Resources