---

hashcat is an advanced password recovery tool featuring GPU acceleration and support for over 300 hash types. It's the fastest and most advanced password cracking tool available.

---

Basic Syntax

• hashcat -m <hash_type> <hash_file> <wordlist> - Basic attack

• hashcat -m 0 hash.txt wordlist.txt - MD5 attack

• hashcat -m 1000 hash.txt wordlist.txt - NTLM attack

• hashcat -m 22000 hash.hc22000 wordlist.txt - WPA/WPA2 attack

---

Common Hash Types

• -m 0 - MD5

• -m 100 - SHA1

• -m 1000 - NTLM

• -m 1800 - sha512crypt $6$ (Linux)

• -m 22000 - WPA/WPA2 PMKID+EAPOL (hc22000 format)

• -m 16800 - WPA/WPA2 PMKID

• -m 2500 - WPA/WPA2 handshake

• -m 500 - md5crypt $1$ (Linux)

• -m 3200 - bcrypt $2$

• -m 17210 - sha256crypt $5$ (Linux)

• -m 1410 - sha256($salt.$pass)

• -m 13100 - Kerberos 5 TGS-REP

---

Attack Modes

• -a 0 - Dictionary attack (default)

• -a 1 - Combinator attack

• -a 3 - Brute-force/Mask attack

• -a 6 - Hybrid wordlist + mask

• -a 7 - Hybrid mask + wordlist

---

Brute-Force Masks

• -a 3 ?l?l?l?l?l?l?l?l - 8 lowercase letters

• -a 3 ?u?u?u?u - 4 uppercase letters

• -a 3 ?d?d?d?d - 4 digits

• -a 3 ?l?l?d?d - 2 letters + 2 digits

• -a 3 ?a?a?a?a - 4 characters (any)

• -a 3 password?d?d?d - "password" + 3 digits

Mask Characters

• ?l - Lowercase letters (a-z)

• ?u - Uppercase letters (A-Z)

• ?d - Digits (0-9)

• ?s - Special characters (!@#$%^&*...)

• ?a - All characters (?l?u?d?s)

• ?b - Binary (0x00-0xff)

• ?h - Lowercase hex (0-9a-f)

• ?H - Uppercase hex (0-9A-F)

---

Performance Options

• -w <1-4> - Workload profile (1=low, 2=default, 3=high, 4=insane)

• -O - Optimized kernels (may reduce supported password lengths)

• --force - Ignore warnings

• --hwmon-temp-abort=<temp> - Abort if GPU temp exceeds (Celsius)

• --hwmon-disable - Disable hardware monitoring

---

Output Options

• -o <file> - Output file for recovered hashes

• --outfile-format=<num> - Output format (1=hash:pass, 2=hex, 3=hash[:salt]:pass)

• --show - Show cracked hashes

• --left - Show uncracked hashes

• --username - Show username (for formats with username)

• --remove - Remove cracked hashes from hash file

• --potfile-path=<file> - Path to potfile

• --outfile-autohex-disable - Disable hex encoding in output

---

Session Options

• --session=<name> - Session name

• --restore - Restore session

• --status - Enable status update screen

• --status-timer=<sec> - Status update interval (default 10)

• --stdout - Output to stdout (no status screen)

• --quiet - Suppress output

---

Rules and Masks

• -r <file> - Rules file

• -g <num> - Generate num random rules

• --rules-file=<file> - Rules file

---

Common Examples

MD5 Dictionary Attack

hashcat -m 0 hash.txt wordlist.txt

WPA/WPA2 Attack

hashcat -m 22000 hash.hc22000 wordlist.txt

NTLM Attack

hashcat -m 1000 ntlm_hash.txt wordlist.txt

Brute Force 8 Lowercase

hashcat -m 0 hash.txt -a 3 ?l?l?l?l?l?l?l?l

Brute Force 4-8 Digits

hashcat -m 0 hash.txt -a 3 -i --increment-min=4 --increment-max=8 ?d?d?d?d

Combinator Attack

hashcat -m 0 hash.txt -a 1 wordlist1.txt wordlist2.txt

With Rules

hashcat -m 0 hash.txt wordlist.txt -r rules/best64.rule

Show Cracked Hashes

hashcat -m 0 hash.txt --show

Resume Session

hashcat --restore --session my_session

High Performance

hashcat -m 0 hash.txt wordlist.txt -w 4 -O

Save Results

hashcat -m 0 hash.txt wordlist.txt -o cracked.txt

---

Tips

• Use -w 4 for maximum performance (may affect system usability)

• Use -O for optimized kernels (faster but limited password length)

• Use --show to display already cracked hashes

• Save session with --session to resume later

• Use -a 3 with masks for targeted brute force

• Combine dictionary with rules (-r) for better results

• Monitor GPU temperature to prevent damage

• Use -m 22000 for modern WPA/WPA2 captures (hc22000 format)

• Always test on authorized systems only

• Check hashcat examples on website for specific hash types

• Use --remove to clean up successfully cracked hashes

• Start with small wordlists before large brute force attacks

---