performing-hash-cracking-with-hashcat

Crack NTLM hashes with hashcat using mode 1000, for example a dictionary attack with -a 0 -m 1000 against a wordlist. Add rule files with -r to transform dictionary candidates and recover policy-compliant password variations.

Identify hash types by matching the hash format and length against known patterns, such as 32 hex characters for MD5 or the $6$ prefix for sha512crypt. Correct identification is required because hashcat needs the exact mode number, like 1800 for sha512crypt or 13100 for Kerberos TGS-REP.

Use dictionary mode (-a 0) for known password patterns, rule-based mode (-a 0 -r) for complex variations, mask mode (-a 3) for short passwords, and hybrid modes (-a 6/7) for passwords with appended numbers. Start with dictionary plus rules before slower brute-force.

Yes, hashcat supports over 300 hash types including bcrypt (mode 3200) and Kerberos TGS-REP (mode 13100). Bcrypt is computationally expensive by design, so cracking it is significantly slower than fast hashes like MD5 or NTLM.

Hash cracking is only appropriate with explicit written authorization and within the rules of engagement for the test scope. Captured hashes must be secured in transit and at rest, cracked passwords reported to asset owners, and the data destroyed after the engagement.