Tool introduction: hashcat

In modern applications, passwords are not stored in plaintext but as hashes. Since cryptographic hash functions are designed as one-way functions, it is not possible to directly derive the original password from a given hash. Instead, password recovery relies on a fundamentally different approach: generating candidate passwords, applying the same hashing function, and comparing the result to the target hash.

This process is inherently computationally intensive and becomes more efficient with specialized tooling. hashcat is one of the most powerful tools available for this purpose. It is primarily used in offline password attacks, where attackers already possess password hashes and can perform verification locally. By leveraging the massive parallelism of modern GPUs via OpenCL or CUDA, hashcat can test extremely large numbers of password candidates in a very short time.

Basic Usage

The syntax of hashcat follows a consistent and modular structure:

hashcat -m [hash-type] -a [mode] [hash-file] [wordlist/mask]

This structure reflects the core idea of the tool: selecting a hash algorithm, defining an attack strategy, and supplying input data such as hashes and candidate sources.

Important Parameters

• -m (hash mode): Specifies the hashing algorithm used (e.g., 0 = MD5, 100 = SHA1, 1800 = SHA512-Crypt, 3200 = bcrypt)
• -a (attack mode): Defines the attack strategy (e.g., 0 = dictionary, 3 = mask)
• -o [file]: Writes successfully cracked passwords to an output file
• -b (benchmark): Measures the performance of the hardware for specific algorithms
• --show: Displays already cracked hashes from the potfile without re-running the attack

These parameters allow hashcat to be highly flexible while still maintaining a relatively simple command-line interface.

Attack Modes

hashcat provides several attack modes, each optimized for different assumptions about password structure and user behavior.

1. Dictionary Attack (-a 0)

A dictionary attack uses predefined lists of passwords, often derived from real-world data breaches. Instead of searching the entire keyspace, this approach focuses on likely candidates.

hashcat -m 0 -a 0 hashes.txt rockyou.txt

In practice, this is often the most efficient starting point. Many users reuse weak or previously leaked passwords, meaning that a well-chosen wordlist can yield results very quickly.

2. Mask Attack (Intelligent Brute Force, -a 3)

A mask attack refines the brute-force approach by introducing structure. Rather than testing all possible combinations blindly, it defines patterns that reflect common password formats.

hashcat provides predefined character classes:

• ?l → lowercase letters
• ?u → uppercase letters
• ?d → digits
• ?s → special characters

These can be combined to describe expected password patterns.

Example:

hashcat -m 0 -a 3 hashes.txt ?u?l?l?l?l?l?d?d

This mask represents a password starting with one uppercase letter, followed by five lowercase letters and ending with two digits. By reducing the search space to realistic patterns, mask attacks significantly improve efficiency compared to naive brute-force approaches.

3. Hybrid Attacks (-a 6, -a 7)

Hybrid attacks combine dictionary and mask techniques. They extend known password candidates with additional characters, reflecting common user behavior such as appending numbers or symbols.

• -a 6: wordlist + suffix
• -a 7: prefix + wordlist

Example:

hashcat -m 0 -a 6 hashes.txt rockyou.txt ?d

In this case, each password from the wordlist is extended by a digit. This approach is particularly effective because many real-world passwords follow predictable modification patterns.

4. Rule-Based Attacks (-r)

Rule-based attacks are among the most powerful techniques in hashcat. Instead of manually defining patterns, rules automatically transform password candidates from a wordlist according to predefined operations.

Rule	Description	Input	Output
c	Capitalize first letter	binsec	Binsec
$!	Append character	binsec	binsec!
sao	Substitute characters	banana	bonono
d	Duplicate	abc	abcabc

Example:

hashcat -m 0 -a 0 hashes.txt rockyou.txt -r rules/best64.rule

Rules are especially effective because they mimic real-world password creation patterns, such as replacing letters with numbers or adding suffixes like years or symbols.

Performance and Efficiency

The performance of hashcat is typically measured in hashes per second (H/s), indicating how many candidate passwords can be tested in a given time frame.

The achievable speed depends heavily on both the hardware and the hash algorithm:

• GPUs are extremely efficient for fast hash functions such as MD5, NTLM, or SHA1 due to their parallel architecture
• CPUs are often used for slower, memory-intensive algorithms such as bcrypt or Argon2, where raw parallelism is less effective

Note: hashcat stores cracked passwords in a file called hashcat.potfile. If a hash has already been cracked in a previous session, it will not be recomputed, which significantly improves efficiency in repeated runs.

Classification

In practical scenarios, success is rarely determined by brute computational power alone. Instead, it depends on selecting the appropriate attack strategy based on assumptions about password structure and user behavior.

Short, targeted attacks using wordlists and rule-based transformations often produce better results in minutes than exhaustive brute-force attacks would achieve over much longer periods.