> For the complete documentation index, see [llms.txt](https://infra.newerasec.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://infra.newerasec.com/infrastructure-testing/password-cracking/hashcat.md).

# Hashcat

## Basics

**Installation:** 

You can download Hashcat from <https://hashcat.net/hashcat/>.&#x20;

**Example:**&#x20;

`hashcat64.exe -a 0 -m 0 example0.hash example.dict -r rules/best64.rule`&#x20;

Dictionary Attack:&#x20;

`hashcat64.exe -a 0 -m 0 example_md5_hashes.txt combined_seclists_password_list.txt -O`&#x20;

Note: Consider using `-w 4` for workload optimized&#x20;

## Mask attack&#x20;

```
?l = abcdefghijklmnopqrstuvwxyz 
?u = ABCDEFGHIJKLMNOPQRSTUVWXYZ 
?d = 0123456789 
?h = 0123456789abcdef 
?H = 0123456789ABCDEF 
?s = «space»!"#$%&'()*+,-./:;<=>?@[\]^_`{|}~ 
?a = ?l?u?d?s 
?b = 0x00 - 0xff 
```

example:&#x20;

`root@attackdefense:~# hashcat -m 10400 -a 3 pdfnew ?d?d?d?d198?d?u --force`&#x20;

## Using different charset:&#x20;

hashcat -m 0 -a 3 -1 ?l?d hash2 ?1?1?1?1 --force&#x20;

* -m 0 = hash type = md5&#x20;
* -a 3 = mode = brute-force&#x20;
* -1 ?l?d= -1  charset  = use charset of ?l (lower alpha) and ?d numbers&#x20;
* Hash2 = hash file &#x20;
* ?1?1?1?1 = the length of the password, use the charset we created  (-1)&#x20;
* \--force = use cpu&#x20;

## Hash examples

<https://hashcat.net/wiki/doku.php?id=example_hashes>