Hashcat

Hashcat itself is a legitimate password-recovery and security-auditing tool. It is legal to use on hashes from systems, accounts, or files that you own or have explicit written authorization to test — for example during a sanctioned penetration test or when recovering your own forgotten password. Cracking hashes you do not own or lack permission to test is illegal in most jurisdictions.

A dictionary attack (`-a 0`) tries every word from a wordlist such as `rockyou.txt`, which is fast and effective against human-chosen passwords. A brute-force / mask attack (`-a 3`) generates every possible combination for a defined pattern, e.g. `hashcat -a 3 -m 0 hashes.txt ?a?a?a?a?a?a` for six mixed characters. Dictionary attacks are usually tried first because they are far quicker.

It depends entirely on the hash algorithm, the password's length and complexity, and your GPU. Fast hashes like MD5 or NTLM can be tested at billions of guesses per second, while slow hashes like bcrypt are deliberately thousands of times slower. Run `hashcat -b -m <mode>` to benchmark your hardware and estimate feasibility before starting.

The potfile (`hashcat.potfile`, stored under `~/.local/share/hashcat/`) records every hash Hashcat has already cracked together with its plaintext. Recovered results are read from it automatically, so re-running a job shows previous successes instantly. Use `--show` to display cracked results or `--potfile-disable` to ignore it.

Yes. Hashcat is cross-platform and provides binaries for Windows, macOS, and Linux, though Kali Linux includes it by default. Performance depends on having working OpenCL or CUDA GPU drivers; run `hashcat -I` to confirm your device is detected on any platform.

'Exhausted' means Hashcat tried every candidate in your attack — the whole wordlist or the full mask keyspace — without cracking the remaining hashes. It is not an error; it simply means that particular attack did not find the password. Try a larger wordlist, add mutation rules with `-r`, or switch to a different mask.

Hashcat is used for offline password recovery and security auditing. It takes captured password hashes and attempts to find the original plaintext by testing millions of candidates per second using GPU acceleration. It supports over 300 hash types including MD5, SHA, NTLM, bcrypt, and WPA2.

Hashcat supports over 300 hash types including MD5 (mode 0), SHA-1 (mode 100), SHA-256 (mode 1400), NTLM (mode 1000), bcrypt (mode 3200), WPA/WPA2 (mode 2500), and many more. Each hash type has a specific mode number used with the -m flag.

While Hashcat can run on CPU alone, it is designed for GPU acceleration and performs significantly better with a compatible NVIDIA or AMD GPU. Without a GPU, John the Ripper may be more practical for CPU-based cracking.

You can identify hash types using tools like hash-identifier, or by examining the hash length and format. MD5 hashes are 32 hexadecimal characters, SHA-256 are 64 characters, and NTLM hashes are typically 32 characters extracted from Windows systems.

Rule-based attacks apply mutation rules to wordlist entries to generate password candidates. Built-in rules like best64.rule and dive.rule transform base words by adding numbers, symbols, case changes, and common substitutions. Rules are defined in .rule files.

Capture a WPA2 handshake using airodump-ng, convert it to .hccapx format using hcxpcapngtool, then run: hashcat -m 22000 capture.hccapx wordlist.txt. For PMKID attacks, use -m 22001 with the captured PMKID directly.

Use the largest wordlist possible, enable rules for mutations, set optimal workload with -w 3 or -w 4, use --force for testing, and ensure proper GPU cooling. For multi-GPU setups, use -d to select specific devices.

Yes. For salted hashes, provide the salt using the appropriate hash mode. For example, mode 10 is MD5 with salt, mode 1200 is SHA1 with salt. The hash format is hash:salt. Some modes support multiple salts for batch cracking.

Hashcat is GPU-accelerated and offers maximum speed for large hash sets. John the Ripper runs on CPU, automatically detects hash types, and supports more formats like encrypted archives. Use Hashcat for speed; John for convenience and format coverage.

Run hashcat -I to display installed OpenCL devices, driver versions, and supported hash types. This verifies your GPU is detected and shows its compute capability for optimal cracking performance.

Yes, first extract hashes using secretsdump.py, samdump2, or Mimikatz, then crack with hashcat -m 1000 for NTLM or -m 3000 for LM hashes. NTLM mode is the most common for modern Windows systems.

Hashcat Brain is a learned-password tracking system that prevents testing previously tried candidates. Enable with --brain-server and --brain-client flags to share tested-password databases across multiple cracking sessions.

Use mode 0 for raw MD5: hashcat -m 0 hashes.txt wordlist.txt. For MD5 with salt, use mode 10: hashcat -m 10 hash.txt wordlist.txt. The hash format is hash:salt for salted variants.

Yes, Hashcat supports Kerberos 5 AS-REP (mode 18200) and Kerberoasting TGS (mode 13100) hashes. Extract Kerberos hashes using Impacket's GetUserSPNs.py or Rubeus for offline cracking.

Use hashcat --show -session=restore to resume the last session, or hashcat --session=SESSION_NAME to resume a specific named session. Hashcat automatically saves progress for interruption recovery.

A mask attack tests candidates matching a specific pattern using placeholders: ?l (lowercase), ?u (uppercase), ?d (digits), ?s (symbols), ?a (all). For example, hashcat -a 3 hashes.txt ?u?l?l?l?l?d?d tests a pattern of ULLLLDD.

Rules transform wordlist entries using built-in or custom rule files: hashcat -r best64.rule hashes.txt wordlist.txt. Rules add numbers, change case, append symbols, and apply common password patterns to base words.

Yes, use mode 14700 for iTunes backup passwords: hashcat -m 14700 itunes_backup_hash.txt wordlist.txt. Extract the hash from the iOS backup using specialized tools before cracking.

Launch cloud GPU instances (AWS p3, GCP a100, Azure NC) with NVIDIA drivers installed, install Hashcat, and run your cracking session. Cloud GPUs offer massive parallelism but incur costs per hour.