Hashcat
Last updated
Last updated
Hashcat is another password-cracking tool. It is mostly used towards cracking hash-based passwords. As JtR it can take advantage of external hardware, such as GPUs.
First thing to do: check the help of the Hashcat tool:
Look in detail for the help and be amazed with the amount of options it supports.
Hashcat supports the following attack modes:
Brute-Force attack (3): This type of attack consists of massive character combination tries. This attack technique was discontinued on Hashcat and was replaced by Mask attacks.
Combination attack (1): This mode allows to append each word contained in a wordlist to the end of each word container in a second wordlist.
Dictionary attack (0): This mode, also called “Straight mode,” tries all lines contained in a file as a password. This is a simple wordlist attack.
Hybrid attack: The Hybrid attack mode allows combining a dictionary attack with a brute force attack. By using this mode, you can append or prepend wordlist elements to a bruteforce attack.
Mask attack (6 or 7): The Mask attack is an improvement of the brute force attack, aiming to design “intelligent” brute force attacks in which the user has control over the password candidate generation process. For example, the Mask attack allows users to define patterns like a capital letter for the first position of the password candidat only, or append dates at the end of the password candidate, or before, etc. The 6 mode enables Hybrid Wordlist + Mask, while the 7 mode enables Hybrid Mask + Wordlist.
To do a simple brute-force attack on a file with raw MD5 passwords (md5-passwords.txt) (download it here), we can simply run the command:
The option -m 0 means that we are using MD5 hashes.
And expect this to take a loooooooot of time to complete.
