Advertisement
Not a member of Pastebin yet?
Sign Up,
it unlocks many cool features!
- ============================================================
- HASHCAT HOWTO
- ============================================================
- - [ Resources ] -
- * hashcat Wiki: https://hashcat.net/wiki/doku.php?id=hashcat
- - [ Usage ] -
- hashcat [options]... hash|hashfile|hcapxfile [dictionary|mask|directory]...
- - [ Basic Examples ] -
- Attack-Mode | Hash |
- -a | -m | Example command
- ==================+======+==================================================================
- Wordlist | $P$ | hashcat -a 0 -m 400 example.hash wordlist.dict
- Wordlist + Rules | MD5 | hashcat -a 0 -m 0 -r example1.rule -r example2.rule example0.hash wordlist.dict
- Wordlist | MD | hashcat -a 0 -m 0 --remove -o output.txt example.hash wordlist.dict
- Brute-Force | MD5 | hashcat -a 3 -m 0 example0.hash ?u?l?l?l?l?d
- Brute-Force var | MD5 | hashcat -a 3 -m 0 -1 ?u -2 -?l?u?d -3 ?d example.hash ?1?2?2?2?2?2?2?3
- Brute-Force inc | MD5 | hashcat -a 3 -m 0 --increment example.hash ?l?l?l?l?l?l?l
- Brute-Force ses | MD5 | hashcat -a 3 -m 0 --session=session_name example.hash mask_file.hcmask
- Combinator | MD5 | hashcat -a 1 -m 0 --rule-left='^-' --rule-right='$!' example.hash wordlist.dict wordlist.dict
- Hybrid - Wrd/Msk | MD5 | hashcat -a 6 wordlist.dict ?d?d?d?d
- Hybrid - Msk/Wrd | MD5 | hashcat -a 7 ?d?d?d?d wordlist.dict
- Debug rules | | hashcat --stdout -r capitalize.rule -r swap.rule wordlist.dict
- Restore Session | | hashcat --session session_name --restore
- - [ Attack Modes ] -
- # | Mode ( -a )
- ===+======
- 0 | Straight
- 1 | Combination
- 3 | Brute-force
- 6 | Hybrid Wordlist + Mask
- 7 | Hybrid Mask + Wordlist
- - [ Basic options ] -
- Options Short / Long | Type | Description | Example
- ===============================+======+======================================================+=======================
- -m, --hash-type | Num | Hash-type, see references below | -m 1000
- -a, --attack-mode | Num | Attack-mode, see references below | -a 3
- -V, --version | | Print version |
- -h, --help | | Print help |
- --quiet | | Suppress output |
- --hex-charset | | Assume charset is given in hex |
- --hex-salt | | Assume salt is given in hex |
- --hex-wordlist | | Assume words in wordlist are given in hex |
- --force | | Ignore warnings |
- --status | | Enable automatic update of the status screen |
- --status-timer | Num | Sets seconds between status screen updates to X | --status-timer=1
- --machine-readable | | Display the status view in a machine-readable format |
- --keep-guessing | | Keep guessing the hash after it has been cracked |
- --loopback | | Add new plains to induct directory |
- --weak-hash-threshold | Num | Threshold X when to stop checking for weak hashes | --weak=0
- --markov-hcstat | File | Specify hcstat file to use | --markov-hc=my.hcstat
- --markov-disable | | Disables markov-chains, emulates classic brute-force |
- --markov-classic | | Enables classic markov-chains, no per-position |
- -t, --markov-threshold | Num | Threshold X when to stop accepting new markov-chains | -t 50
- --runtime | Num | Abort session after X seconds of runtime | --runtime=10
- --session | Str | Define specific session name | --session=mysession
- --restore | | Restore session from --session |
- --restore-disable | | Do not write restore file |
- --restore-file-path | File | Specific path to restore file | --restore-file-path=my.restore
- -o, --outfile | File | Define outfile for recovered hash | -o outfile.txt
- --outfile-format | Num | Define outfile-format X for recovered hash | --outfile-format=7
- --outfile-autohex-disable | | Disable the use of $HEX[] in output plains |
- --outfile-check-timer | Num | Sets seconds between outfile checks to X | --outfile-check=30
- -p, --separator | Char | Separator char for hashlists and outfile | -p :
- --stdout | | Do not crack a hash, instead print candidates only |
- --show | | Compare hashlist with potfile; show cracked hashes |
- --left | | Compare hashlist with potfile; show uncracked hashes |
- --username | | Enable ignoring of usernames in hashfile |
- --remove | | Enable removal of hashes once they are cracked |
- --remove-timer | Num | Update input hash file each X seconds | --remove-timer=30
- --potfile-disable | | Do not write potfile |
- --potfile-path | Dir | Specific path to potfile | --potfile-path=my.pot
- --encoding-from | Code | Force internal wordlist encoding from X | --encoding-from=iso-8859-15
- --encoding-to | Code | Force internal wordlist encoding to X | --encoding-to=utf-32le
- --debug-mode | Num | Defines the debug mode (hybrid only by using rules) | --debug-mode=4
- --debug-file | File | Output file for debugging rules | --debug-file=good.log
- --induction-dir | Dir | Specify the induction directory to use for loopback | --induction=inducts
- --outfile-check-dir | Dir | Specify the outfile directory to monitor for plains | --outfile-check-dir=x
- --logfile-disable | | Disable the logfile |
- --hccapx-message-pair | Num | Load only message pairs from hccapx matching X | --hccapx-message-pair=2
- --nonce-error-corrections | Num | The BF size range to replace AP's nonce last bytes | --nonce-error-corrections=16
- --truecrypt-keyfiles | File | Keyfiles to use, separated with commas | --truecrypt-key=x.png
- --veracrypt-keyfiles | File | Keyfiles to use, separated with commas | --veracrypt-key=x.txt
- --veracrypt-pim | Num | VeraCrypt personal iterations multiplier | --veracrypt-pim=1000
- -b, --benchmark | | Run benchmark |
- --speed-only | | Return expected speed of the attack, then quit |
- --progress-only | | Return ideal progress step size and time to process |
- -c, --segment-size | Num | Sets size in MB to cache from the wordfile to X | -c 32
- --bitmap-min | Num | Sets minimum bits allowed for bitmaps to X | --bitmap-min=24
- --bitmap-max | Num | Sets maximum bits allowed for bitmaps to X | --bitmap-max=24
- --cpu-affinity | Str | Locks to CPU devices, separated with commas | --cpu-affinity=1,2,3
- -I, --opencl-info | | Show info about detected OpenCL platforms/devices | -I
- --opencl-platforms | Str | OpenCL platforms to use, separated with commas | --opencl-platforms=2
- -d, --opencl-devices | Str | OpenCL devices to use, separated with commas | -d 1
- -D, --opencl-device-types | Str | OpenCL device-types to use, separated with commas | -D 1
- --opencl-vector-width | Num | Manually override OpenCL vector-width to X | --opencl-vector=4
- -w, --workload-profile | Num | Enable a specific workload profile, see pool below | -w 3
- -n, --kernel-accel | Num | Manual workload tuning, set outerloop step size to X | -n 64
- -u, --kernel-loops | Num | Manual workload tuning, set innerloop step size to X | -u 256
- --nvidia-spin-damp | Num | Workaround NVIDIAs CPU burning loop bug, in percent | --nvidia-spin-damp=50
- --gpu-temp-disable | | Disable temperature and fanspeed reads and triggers |
- --gpu-temp-abort | Num | Abort if GPU temperature reaches X degrees Celsius | --gpu-temp-abort=100
- --gpu-temp-retain | Num | Try to retain GPU temperature at X degrees Celsius | --gpu-temp-retain=95
- --powertune-enable | | Enable power tuning. Restores settings when finished |
- --scrypt-tmto | Num | Manually override TMTO value for scrypt to X | --scrypt-tmto=3
- -s, --skip | Num | Skip X words from the start | -s 1000000
- -l, --limit | Num | Limit X words from the start + skipped words | -l 1000000
- --keyspace | | Show keyspace base:mod values and quit |
- -j, --rule-left | Rule | Single rule applied to each word from left wordlist | -j 'c'
- -k, --rule-right | Rule | Single rule applied to each word from right wordlist | -k '^-'
- -r, --rules-file | File | Multiple rules applied to each word from wordlists | -r rules/best64.rule
- -g, --generate-rules | Num | Generate X random rules | -g 10000
- --generate-rules-func-min | Num | Force min X functions per rule |
- --generate-rules-func-max | Num | Force max X functions per rule |
- --generate-rules-seed | Num | Force RNG seed set to X |
- -1, --custom-charset1 | CS | User-defined charset ?1 | -1 ?l?d?u
- -2, --custom-charset2 | CS | User-defined charset ?2 | -2 ?l?d?s
- -3, --custom-charset3 | CS | User-defined charset ?3 |
- -4, --custom-charset4 | CS | User-defined charset ?4 |
- -i, --increment | | Enable mask increment mode |
- --increment-min | Num | Start mask incrementing at X | --increment-min=4
- --increment-max | Num | Stop mask incrementing at X | --increment-max=8
- - [ Hash modes ] -
- # | Name | Category
- ======+==================================================+======================================
- 0 | MD5 | Raw Hash
- 100 | SHA1 | Raw Hash
- 1400 | SHA-256 | Raw Hash
- 1700 | SHA-512 | Raw Hash
- 5000 | SHA-3 (Keccak) | Raw Hash
- 400 | phpass | Generic KDF
- 8900 | scrypt | Generic KDF
- 5600 | NetNTLMv2 | Network Protocols
- 11200 | MySQL CRAM (SHA1) | Network Protocols
- 12 | PostgreSQL | Database Server
- 131 | MSSQL (2000) | Database Server
- 132 | MSSQL (2005) | Database Server
- 1731 | MSSQL (2012, 2014) | Database Server
- 200 | MySQL323 | Database Server
- 300 | MySQL4.1/MySQL5 | Database Server
- 11500 | CRC32 | Checksums
- 1500 | descrypt, DES (Unix), Traditional DES | Operating Systems
- 500 | md5crypt, MD5 (Unix), Cisco-IOS $1$ (MD5) | Operating Systems
- 3200 | bcrypt $2*$, Blowfish (Unix) | Operating Systems
- 1800 | sha512crypt $6$, SHA512 (Unix) | Operating Systems
- 3000 | LM | Operating Systems
- 1000 | NTLM | Operating Systems
- 6600 | 1Password, agilekeychain | Password Managers
- 8200 | 1Password, cloudkeychain | Password Managers
- 11300 | Bitcoin/Litecoin wallet.dat | Password Managers
- 13400 | KeePass 1 (AES/Twofish) and KeePass 2 (AES) | Password Managers
- 15600 | Ethereum Wallet, PBKDF2-HMAC-SHA256 | Password Managers
- 15700 | Ethereum Wallet, SCRYPT | Password Managers
- - [ Outfile Formats ] -
- # | Format
- ===+========
- 1 | hash[:salt]
- 2 | plain
- 3 | hash[:salt]:plain
- 4 | hex_plain
- 5 | hash[:salt]:hex_plain
- 6 | plain:hex_plain
- 7 | hash[:salt]:plain:hex_plain
- 8 | crackpos
- 9 | hash[:salt]:crack_pos
- 10 | plain:crack_pos
- 11 | hash[:salt]:plain:crack_pos
- 12 | hex_plain:crack_pos
- 13 | hash[:salt]:hex_plain:crack_pos
- 14 | plain:hex_plain:crack_pos
- 15 | hash[:salt]:plain:hex_plain:crack_pos
- - [ Built-in Charsets ] -
- ? | Buit-in charset masks
- ===+=========
- l | abcdefghijklmnopqrstuvwxyz
- u | ABCDEFGHIJKLMNOPQRSTUVWXYZ
- d | 0123456789
- h | 0123456789abcdef
- H | 0123456789ABCDEF
- s | !"#$%&'()*+,-./:;<=>?@[\]^_`{|}~
- a | ?l?u?d?s
- b | 0x00 - 0xff
- - [ OpenCL Device Types ] -
- # | Device Type
- ===+=============
- 1 | CPU
- 2 | GPU
- 3 | FPGA, DSP, Co-Processor
- - [ Workload Profiles ] -
- # | Performance | Runtime | Power Consumption | Desktop Impact
- ===+=============+=========+===================+=================
- 1 | Low | 2 ms | Low | Minimal
- 2 | Default | 12 ms | Economic | Noticeable
- 3 | High | 96 ms | High | Unresponsive
- 4 | Nightmare | 480 ms | Insane | Headless
- - [ Rule Compatible Functions ] -
- Name | Rule | Description | Example Rule | In Word | Output Word |
- =============+========+===========================================+===============+===========+===========================+
- Nothing | : | Do nothing | : | p@ssW0rd | p@ssW0rd |
- Lowercase | l | Lowercase all letters | l | p@ssW0rd | p@ssw0rd |
- Uppercase | u | Uppercase all letters | u | p@ssW0rd | P@SSW0RD |
- Capitalize | c | Cap the 1st letter and lower the rest | c | p@ssW0rd | P@ssw0rd |
- Inv Capital | C | Lower 1st found char, uppercase the rest | C | p@ssW0rd | p@SSW0RD |
- Toggle Case | t | Toggle the case of all characters in word | t | p@ssW0rd | P@SSw0RD |
- Toggle @ | TN | Toggle the case of char at position N | T3 | p@ssW0rd | p@sSW0rd |
- Reverse | r | Reverse the entire word | r | p@ssW0rd | dr0Wss@p |
- Duplicate | d | Duplicate entire word | d | p@ssW0rd | p@ssW0rdp@ssW0rd |
- Reflect | f | Duplicate word reversed | f | p@ssW0rd | p@ssW0rddr0Wss@p |
- Rotate Left | { | Rotates the word left | { | p@ssW0rd | @ssW0rdp |
- Rotate Right | } | Rotates the word right | } | p@ssW0rd | dp@ssW0r |
- Append Char | $X | Append character X to end | $1 | p@ssW0rd | p@ssW0rd1 |
- Prepend Char | ^X | Prepend character X to front | ^1 | p@ssW0rd | 1p@ssW0rd |
- Truncate left| [ | Deletes first character | [ | p@ssW0rd | @ssW0rd |
- Trunct right | ] | Deletes last character | ] | p@ssW0rd | p@assW0r |
- Replace | sXY | Replace all instances of X with Y | ss$ | p@ssW0rd | p@$$W0rd |
- Purge | @X | Purge all instances of X | @s | p@ssW0rd | p@W0rd |
- - [ Rule Specific Functions ] -
- Name | Rule | Description | Example Rule | In Word | Output Word |
- =============+========+===========================================+===============+==============+========================+
- Swap front | k | Swaps first two characters | k | p@ssW0rd | @pssW0rd |
- Swap back | K | Swaps last two characters | K | p@ssW0rd | p@ssW0dr |
- Swap @ N | *NM | Swaps char at pos N with char at pos M | *34 | p@ssW0rd | p@sWs0rd |
- Btwise s/left| LN | Bitwise shift left character @ N | L2 | p@ssW0rd | p@æsW0rd |
- Btwise s/rght| RN | Bitwise shift right character @ N | R2 | p@ssW0rd | p@9sW0rd |
- Ascii incr | +N | Increment character @ N by 1 ascii value | +2 | p@ssW0rd | p@tsW0rd |
- Ascii decr | -N | Decrement character @ N by 1 ascii value | -1 | p@ssW0rd | p?ssW0rd |
- Replace N+1 | .N | Replaces char @N with value at @N + 1 | .1 | p@ssW0rd | psssW0rd |
- Replace N-1 | ,N | Replaces char @N with value at @N - 1 | ,1 | p@ssW0rd | ppssW0rd |
- Dup blck frnt| yN | Duplicates first N characters | y2 | p@ssW0rd | p@p@ssW0rd |
- Dup blck back| YN | Duplicates last N characters | Y2 | p@ssW0rd | p@ssW0rdrd |
- Title | E | Capitalize every word | E | p@ssW0rd w0rld| P@ssw0rd W0rld |
- Title w/sep | eX | Capitalize first word and after separator | e- | p@ssW0rd-w0rld| P@ssw0rd-W0rld |
- - [ Hashcat Mask Files ] -
- - [ Usage ] -
- [?1,][?2,][?3,][?4,]mask
- where the placeholders are as follows:
- [?1] the 1st custom charset (-1) will be set to this value, optional
- [?2] the 2nd custom charset (-2) will be set to this value, optional
- [?3] the 3rd custom charset (-3) will be set to this value, optional
- [?4] the 4th custom charset (-4) will be set to this value, optional
- [mask] the mask which should (but does not need) to use the custom-charset defined by [?1], [?2], [?3] or [?4]
- and can use any additional predefined charset (?d, ?l, ?u, ?s, ?a, ?b) and can contain fixed chars too
- (example value: pass?1?d?d?2?l?l)
- - [ Examples ] -
- example1.hcmask
- ?d?l,test?1?1?1
- abcdef,0123,ABC,789,?3?3?3?1?1?1?1?2?2?4?4?4?4
- company?d?d?d?d?d
- ?u?l,?s?d,?1?a?a?a?a?2
- ?u?l?l?l?d?d?d?d?d?d
- example2.hcmask
- ?u?l?l?l?l?l?l?d
- ?u?l?l?l?l?l?d?d?d?d
- ?u?l?l?l?l?l?l?l?d?d
- ?u?l?l?l?l?l?l?l?d?d
- ?u?l?l?l?l?l?l?d?d?d
- ?u?l?l?l?d?d?d?d?s
- ?u?l?l?l?l?ld?d?s
- ?s?u?l?l?l?d?d?d?d
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement
