performing-hash-cracking-with-hashcat

Identify the hash mode first with hashid or hashcat --identify, then run hashcat with -m for the mode and -a for the attack type. Start with a dictionary attack using rockyou plus best64 rules, then add hybrid or mask attacks for remaining hashes.

Use hashid or hashcat --identify to detect the hash type before cracking. Watch for look-alikes: raw MD5 is mode 0 while md5crypt is 500, NTLM is 1000 while NetNTLMv2 is 5600, and bcrypt is 3200.

Mode -a 0 is a dictionary attack, -a 1 combines two wordlists, -a 3 is mask-based brute force, and -a 6/7 are hybrid attacks combining wordlists with masks. Adding -r applies transformation rules like best64.rule to dictionary candidates.

Hashcat supports bcrypt (mode 3200) but these slow hashes make brute force impractical. Prioritize curated wordlists with best64 rules, accept partial coverage, and report what keyspace was not attempted rather than claiming hashes are uncrackable.

The most common cause is a wrong hash mode, which wastes the entire run. Other gaps include using only a plain dictionary without rules or masks, missing org-specific or breach wordlists, and not verifying recovered plaintexts with hashcat --show.

Hashcat is legal only with explicit written authorization, such as during a contracted penetration test or password policy audit. Captured hashes must be secured, cracked passwords reported to asset owners, and data destroyed after the engagement.