Hashcat

Hashcat

Purpose

Use this skill for approved offline hash auditing when the engagement needs a repeatable, format-aware cracking workflow.

Phase Fit

• Primary: Validation and Controlled Impact Demonstration
• Secondary: Vulnerability Analysis, Retest and Closure

Use When

• Need to assess password strength from an authorized offline hash set.
• Need a specific hash mode or performance characteristic.
• Need to retest password resilience after remediation.

Avoid When

• The hash set is not explicitly approved for offline analysis.
• The engagement scope does not allow password cracking workflows.

Inputs

• Authorized hash file and hash mode
• Approved wordlist, rule set, or mask strategy
• Evidence handling constraints for recovered material

Procedure

1. Confirm authorization for offline analysis and the correct hash mode.
2. Start with the least expansive candidate source that fits the policy hypothesis.
3. Record only the minimum outcome needed for the report.
4. Protect recovered material as sensitive evidence.
5. Preserve the exact mode and candidate source for retest.

Command Syntax

Replace sample paths with approved hash files and approved candidate sources.

# Dictionary attack on NTLM hashes
hashcat -m 1000 -a 0 contoso-ntlm.txt /usr/share/wordlists/rockyou.txt -o cracked.txt

# Rule-based attack
hashcat -m 1000 -a 0 contoso-ntlm.txt /usr/share/wordlists/rockyou.txt -r /usr/share/hashcat/rules/best64.rule

# Kerberoast TGS hash cracking
hashcat -m 13100 -a 0 contoso-tgs.txt /usr/share/wordlists/rockyou.txt -o cracked-tgs.txt

# AS-REP hash cracking
hashcat -m 18200 -a 0 contoso-asrep.txt /usr/share/wordlists/rockyou.txt -o cracked-asrep.txt

# NetNTLMv2 hash cracking
hashcat -m 5600 -a 0 contoso-netntlmv2.txt /usr/share/wordlists/rockyou.txt -o cracked-net.txt

# Brute-force mask (8-char mixed)
hashcat -m 1000 -a 3 contoso-ntlm.txt '?a?a?a?a?a?a?a?a'

# Show cracked results
hashcat -m 1000 contoso-ntlm.txt --show

Evidence to Capture

• Whether the approved hash set yielded weak passwords
• Hash mode and candidate source used
• Policy-relevant outcomes without unnecessary credential disclosure

Safety Boundaries

• Use only on authorized offline material.
• Do not use recovered credentials outside the explicit rules of engagement.