Hashcat cheatsheet

hashcat -m <mode> -a <attack> hash.txt wordlist.txt
hashcat -m 1000 -a 0 ntlm.txt rockyou.txt
hashcat --show hash.txt          # show cracked
hashcat --left hash.txt          # show uncracked
hashcat -b                       # benchmark all modes
hashcat -b -m 1000              # benchmark specific mode
hashcat --restore                # resume last session
hashcat --session=myrun -m 1000 -a 0 hash.txt wordlist.txt

# Output cracked to file
hashcat -m 1000 hash.txt wordlist.txt -o cracked.txt

# Output format (comma-separated field selection)
hashcat -m 1000 hash.txt wordlist.txt --outfile-format=2
# 1 = hash[:salt]
# 2 = plain
# 3 = hex_plain
# 4 = crack_pos
# 5 = timestamp absolute
# 6 = timestamp relative
# Default: --outfile-format=1,3

# Show already cracked from potfile
hashcat -m 1000 hash.txt --show
hashcat -m 1000 hash.txt --show --outfile-format=2

# Username:hash format
hashcat -m 1000 hash.txt wordlist.txt --username
hashcat -m 1000 hash.txt --show --username

# Name a session
hashcat --session=crack1 -m 1000 hash.txt wordlist.txt

# Pause (press p during execution)
# Resume
hashcat --session=crack1 --restore

# Skip current attack and move to next
# Press s during execution

# Checkpoint (quit + save at next restore point)
# Press c during execution

# Status display during run
# Press s for status
hashcat --status --status-timer=10 -m 1000 hash.txt wordlist.txt

# hashid - identify hash type
hashid '$2a$10$...'
hashid -m 'hash_value'    # show hashcat mode
hashid -j 'hash_value'    # show John format

# hash-identifier (interactive)
hash-identifier

# haiti - modern identifier
haiti 'hash_value'
haiti -e hashcat 'hash_value'  # show hashcat modes only

# hashcat built-in (v6.2.6+)
hashcat --identify hash.txt

# Name-That-Hash
nth -t 'hash_value'
nth -f hash.txt

# From /etc/shadow (Linux)
unshadow /etc/passwd /etc/shadow > combined.txt

# From Windows SAM
secretsdump.py -sam SAM -system SYSTEM -security SECURITY LOCAL

# From NTDS.dit (AD)
secretsdump.py -ntds ntds.dit -system SYSTEM LOCAL
secretsdump.py domain/user:pass@dc-ip -just-dc-ntlm

# From KeePass
keepass2john database.kdbx > keepass.hash

# From 7-Zip
7z2john archive.7z > 7z.hash

# From RAR
rar2john archive.rar > rar.hash

# From PDF
pdf2john.pl document.pdf > pdf.hash

# From Office documents
office2john.py document.docx > office.hash

# From Wi-Fi captures
hcxpcapngtool capture.pcapng -o hash.22000

# From Kerberos (Impacket)
GetUserSPNs.py domain/user:pass -dc-ip DC -request -outputfile tgs.txt
GetNPUsers.py domain/ -usersfile users.txt -dc-ip DC -format hashcat

Table of rule functions:

# Capitalize + append year
c $2 $0 $2 $5
c $2 $0 $2 $6

# Leet speak substitutions
sa@ se3 si1 so0 ss$
sa@ se3 si! so0 ss5 st7

# Common patterns - capitalize + suffix
c $!       # Password!
c $1 $2 $3 # Password123
c $!$!     # Password!!
c $@       # Password@

# Uppercase all
u           # PASSWORD

# Duplicate word
c d         # PasswordPassword

# Prepend and append
^( $)       # (password)
^# $!       # #password!

# Year patterns
$2 $0 $2 $4
$2 $0 $2 $5
$2 $0 $2 $6

# Multi-rule chaining
c sa@ se3 $1 $!     # P@ssword -> P@ssw0rd1!

# Single rule file
hashcat -m 1000 hash.txt wordlist.txt -r best64.rule

# Multiple rule files (chained - multiplicative)
hashcat -m 1000 hash.txt wordlist.txt -r best64.rule -r toggles1.rule
# Total rules = best64 x toggles1 combinations

# Inline rule
hashcat -m 1000 hash.txt wordlist.txt -j 'c$!'

# Generate rules randomly
hashcat -m 1000 hash.txt wordlist.txt -g 10000

# Debug rules (see which rule cracked what)
hashcat -m 1000 hash.txt wordlist.txt -r best64.rule --debug-mode=1 --debug-file=matched.rule

# Rule-left (for straight attack) and rule-right
hashcat -m 0 hash.txt wordlist.txt -j 'c' -k '$!'

# 8-char lowercase
hashcat -m 0 -a 3 hash.txt ?l?l?l?l?l?l?l?l

# Password pattern: Ullllldd (capital + lower + 2 digits)
hashcat -m 0 -a 3 hash.txt ?u?l?l?l?l?l?d?d

# 4-digit PIN
hashcat -m 0 -a 3 hash.txt ?d?d?d?d

# 6-8 digit PIN with increment
hashcat -m 0 -a 3 hash.txt ?d?d?d?d?d?d?d?d --increment --increment-min=6

# Custom charset: only specific chars
hashcat -m 0 -a 3 hash.txt -1 'Pp' -2 'Aa' ?1?2ssword?d?d

# Upper + lower + digit
hashcat -m 0 -a 3 hash.txt -1 ?l?u?d ?1?1?1?1?1?1?1?1

# Increment: try all lengths 1-8
hashcat -m 0 -a 3 hash.txt ?a?a?a?a?a?a?a?a --increment --increment-min=1

# Common password structure: Word + digits + special
hashcat -m 0 -a 3 hash.txt -1 ?l?u ?1?1?1?1?1?1?d?d?s

# Hex charset (for specific attacks)
hashcat -m 0 -a 3 hash.txt -1 '0123456789abcdef' ?1?1?1?1?1?1?1?1

# Create a mask file with multiple patterns
# File: corporate.hcmask
# One mask per line, optionally with custom charsets
?u?l?l?l?l?l?d?d
?u?l?l?l?l?l?l?d?d
?u?l?l?l?l?l?d?d?d?d
?u?l?l?l?l?l?l?d?d?d?d
1,?l?u,?u?l?l?l?l?1?d?d
?u?l?l?l?l?l?l?l?d?d?s

# Use mask file
hashcat -m 1000 -a 3 hash.txt corporate.hcmask

# Mode 6: Wordlist + Mask (append)
# word + 3 digits
hashcat -m 1000 -a 6 hash.txt wordlist.txt ?d?d?d

# word + year
hashcat -m 1000 -a 6 hash.txt wordlist.txt ?d?d?d?d

# word + special + digits
hashcat -m 1000 -a 6 hash.txt wordlist.txt ?s?d?d

# Mode 7: Mask + Wordlist (prepend)
# 3 digits + word
hashcat -m 1000 -a 7 hash.txt ?d?d?d wordlist.txt

# Hybrid with rules
hashcat -m 1000 -a 6 hash.txt wordlist.txt ?d?d?d -r best64.rule

# Combine two wordlists: word1 + word2
hashcat -m 0 -a 1 hash.txt list1.txt list2.txt

# With rules applied to left or right word
hashcat -m 0 -a 1 hash.txt list1.txt list2.txt -j 'c' -k '$!'
# left rule (-j): capitalize first list
# right rule (-k): append ! to second list

# Example: colors.txt + animals.txt
# blue + cat = bluecat, Blue + Cat! etc.

# PRINCE: PRobability INfinite Chained Elements
# Install princeprocessor
pp64 < wordlist.txt | hashcat -m 1000 hash.txt

# Chain 1-4 words together
pp64 --elem-cnt-min=2 --elem-cnt-max=4 < wordlist.txt | hashcat -m 1000 hash.txt

# With length limits
pp64 --pw-min=8 --pw-max=16 < wordlist.txt | hashcat -m 1000 hash.txt

# combinator3 - combine three wordlists
combinator3 list1.txt list2.txt list3.txt | hashcat -m 0 hash.txt

# Pipe from external tools
crunch 8 8 -t @@@@%%%% | hashcat -m 1000 hash.txt

# From custom scripts
python3 gen.py | hashcat -m 1000 hash.txt

# kwprocessor (keyboard walks)
kwp basechars/full.base keymaps/en-us.keymap routes/2-to-16-max-3-direction-changes.route | hashcat -m 1000 hash.txt

# Workload profiles
-w 1    # Low (desktop usable)
-w 2    # Default
-w 3    # High (some lag)
-w 4    # Nightmare (system unusable)

# Optimized kernels (faster, max pw length 32)
-O

# Specific devices
-D 1        # CPU only
-D 2        # GPU only
-D 1,2      # CPU + GPU
--opencl-device-types=1,2

# Select specific GPU
-d 1        # First GPU
-d 1,2      # First and second GPU

# Force (bypass warnings - use cautiously)
--force

# Disable potfile (when re-cracking)
--potfile-disable

# Temperature control
--hwmon-temp-abort=90

# Limit GPU usage
-n 64       # Kernel accel (outerloop step size)
-u 256      # Kernel loops (innerloop step size)

Approximate speeds for NTLM (mode 1000):

Approximate speeds for bcrypt (mode 3200):

# Brain server (v6.0+)
# Server side
hashcat --brain-server --brain-password=secret

# Client side
hashcat -m 1000 hash.txt wordlist.txt --brain-client --brain-host=server-ip --brain-password=secret

# Manual split (no brain)
# Split wordlist and run on multiple machines
hashcat -m 1000 hash.txt wordlist.txt --skip=0 --limit=5000000
hashcat -m 1000 hash.txt wordlist.txt --skip=5000000 --limit=5000000

# Keyspace split for mask attacks
hashcat -m 1000 -a 3 hash.txt ?a?a?a?a?a?a --keyspace
# Then split with --skip and --limit

# For slow hashes (bcrypt, scrypt, Argon2, etc.)
# Use smaller, targeted wordlists
# 1. Top passwords first
hashcat -m 3200 hash.txt top1000.txt

# 2. Small wordlist + light rules
hashcat -m 3200 hash.txt rockyou-top10k.txt -r best64.rule -w 3

# 3. Targeted wordlist (company-specific)
hashcat -m 3200 hash.txt custom-company.txt -r best64.rule

# 4. Mask for common patterns only
hashcat -m 3200 -a 3 hash.txt ?u?l?l?l?l?l?d?d

# Kerberoasting (TGS tickets - RC4)
hashcat -m 13100 tgs.txt rockyou.txt -r best64.rule

# Kerberoasting (AES128)
hashcat -m 19600 tgs_aes128.txt rockyou.txt -r best64.rule

# Kerberoasting (AES256)
hashcat -m 19700 tgs_aes256.txt rockyou.txt -r best64.rule

# AS-REP Roasting
hashcat -m 18200 asrep.txt rockyou.txt -r best64.rule

# DCC2 / mscash2 (cached domain credentials)
hashcat -m 2100 dcc2.txt rockyou.txt -r best64.rule -w 3

# NTLM hashes (from secretsdump)
hashcat -m 1000 ntlm.txt rockyou.txt -r OneRuleToRuleThemAll.rule

# NTLMv2 (from Responder)
hashcat -m 5600 ntlmv2.txt rockyou.txt -r best64.rule

# NTLMv1 (from Responder)
hashcat -m 5500 ntlmv1.txt rockyou.txt

# NTLMv1 - DES crack approach (crack.sh alternative)
hashcat -m 14000 des_block.txt -a 3 ?b?b?b?b?b?b?b?b

# DPAPI masterkey v1
hashcat -m 15300 dpapi_v1.txt rockyou.txt

# DPAPI masterkey v2
hashcat -m 15900 dpapi_v2.txt rockyou.txt

# MS SNTP / TimeRoast (hashcat v7+)
hashcat -m 31300 timeroast.txt rockyou.txt -r best64.rule

# Group Policy Preferences (GPP / cPassword)
# Decrypt directly with gpp-decrypt, no hashcat needed

# bcrypt ($2a$, $2b$, $2y$)
hashcat -m 3200 bcrypt.txt rockyou.txt -w 3

# MD5 (raw)
hashcat -m 0 md5.txt rockyou.txt -r dive.rule

# MD5 salted (salt:hash or hash:salt)
hashcat -m 10 md5salt.txt rockyou.txt    # md5($pass.$salt)
hashcat -m 20 md5salt.txt rockyou.txt    # md5($salt.$pass)

# SHA1
hashcat -m 100 sha1.txt rockyou.txt

# SHA256
hashcat -m 1400 sha256.txt rockyou.txt

# SHA512
hashcat -m 1700 sha512.txt rockyou.txt

# WordPress (phpass)
hashcat -m 400 wp.txt rockyou.txt

# Drupal 7
hashcat -m 7900 drupal7.txt rockyou.txt -w 3

# Django PBKDF2-SHA256
hashcat -m 10000 django.txt rockyou.txt -w 3

# MySQL 4.1+ (SHA1)
hashcat -m 300 mysql.txt rockyou.txt

# PostgreSQL MD5
hashcat -m 12 pg.txt rockyou.txt

# Convert cap/pcapng to hashcat format
hcxpcapngtool capture.pcapng -o hash.22000

# Convert from aircrack legacy format
hcxpcapngtool capture.cap -o hash.22000

# PMKID + EAPOL (recommended)
hashcat -m 22000 hash.22000 rockyou.txt

# PMKID only
hashcat -m 16800 pmkid.txt rockyou.txt

# Wi-Fi with rules
hashcat -m 22000 hash.22000 rockyou.txt -r best64.rule

# Wi-Fi mask (8-digit numeric)
hashcat -m 22000 -a 3 hash.22000 ?d?d?d?d?d?d?d?d

# Wi-Fi mask (common home router patterns)
hashcat -m 22000 -a 3 hash.22000 -1 ?l?d ?1?1?1?1?1?1?1?1

# Identify the hash type from prefix
# $1$  = md5crypt (mode 500)
# $5$  = sha256crypt (mode 7400)
# $6$  = sha512crypt (mode 1800)
# $y$  = yescrypt (not yet supported by hashcat - use john)

# sha512crypt
hashcat -m 1800 shadow.txt rockyou.txt -w 3

# md5crypt
hashcat -m 500 shadow.txt rockyou.txt

# sha256crypt
hashcat -m 7400 shadow.txt rockyou.txt -w 3

# Extract hashes from shadow file
awk -F: '$2 ~ /^\$/ {print $1":"$2}' /etc/shadow > hashes.txt

# 7-Zip
7z2john archive.7z > 7z.hash
# Clean the hash (remove filename prefix if needed)
hashcat -m 11600 7z.hash rockyou.txt

# RAR5
rar2john archive.rar > rar.hash
hashcat -m 13000 rar.hash rockyou.txt

# RAR3
hashcat -m 12500 rar3.hash rockyou.txt

# ZIP (PKZIP)
hashcat -m 17200 zip.hash rockyou.txt    # PKZIP compressed
hashcat -m 17210 zip.hash rockyou.txt    # PKZIP uncompressed
hashcat -m 17220 zip.hash rockyou.txt    # PKZIP compressed (multi-file)
hashcat -m 17225 zip.hash rockyou.txt    # PKZIP mixed
hashcat -m 13600 zip.hash rockyou.txt    # WinZip AES

# PDF
hashcat -m 10400 pdf.hash rockyou.txt    # PDF 1.1-1.3
hashcat -m 10500 pdf.hash rockyou.txt    # PDF 1.4-1.6
hashcat -m 10600 pdf.hash rockyou.txt    # PDF 1.7 L3
hashcat -m 10700 pdf.hash rockyou.txt    # PDF 1.7 L8

# MS Office
hashcat -m 9600 office.hash rockyou.txt  # Office 2013+
hashcat -m 9500 office.hash rockyou.txt  # Office 2010
hashcat -m 9400 office.hash rockyou.txt  # Office 2007
hashcat -m 9700 office.hash rockyou.txt  # Office 97-03 MD5
hashcat -m 9800 office.hash rockyou.txt  # Office 97-03 SHA1

# KeePass
hashcat -m 13400 keepass.hash rockyou.txt -w 3

# CeWL - generate wordlist from website
cewl https://target.com -d 3 -m 5 -w cewl.txt

# CeWL with email scraping
cewl https://target.com -d 3 -m 5 -w cewl.txt -e --email_file=emails.txt

# Username mangling for passwords
# john, John, JOHN, john123, John!, etc.
cat users.txt | hashcat --stdout -r best64.rule > user_passwords.txt

# crunch - pattern-based generation
crunch 8 8 -t @@@@%%%% -o wordlist.txt
# @ = lowercase, , = uppercase, % = digit, ^ = special

# CUPP - Common User Passwords Profiler
cupp -i  # Interactive - build target profile

# Mentalist - GUI wordlist generator
# Configure base words + rules visually

# hashcat stdout mode (apply rules without cracking)
hashcat --stdout wordlist.txt -r best64.rule > expanded.txt
hashcat --stdout wordlist.txt -r best64.rule -r toggles1.rule > expanded.txt

# 1. Build company-specific wordlist
# Gather: company name, products, locations, seasons, years
echo -e "CompanyName\nProduct1\nCity\nSummer\nWinter" > base.txt

# 2. Expand with rules
hashcat --stdout base.txt -r best64.rule > company_expanded.txt

# 3. Add common passwords
cat rockyou-top10k.txt company_expanded.txt > target_wordlist.txt

# 4. Sort and deduplicate
sort -u target_wordlist.txt -o target_wordlist.txt

# "Token length exception"
# Hash format is wrong or mode mismatch
# Check hash format and -m mode

# "No hashes loaded"
# Wrong mode or malformed hash
hashcat --identify hash.txt  # identify correct mode

# "Separator unmatched"
# Hash contains colon but format expects different separator
hashcat -m 1000 hash.txt --separator=':'

# "All hashes found in potfile"
# Already cracked - view with --show
hashcat -m 1000 hash.txt --show
# Or disable potfile
hashcat -m 1000 hash.txt wordlist.txt --potfile-disable

# "Insufficient memory"
# Reduce workload or use smaller wordlist
-w 1 or -n 8

# "CL_OUT_OF_RESOURCES"
# GPU overloaded
-w 1 -n 8 -u 32

# Device driver warning
# Update GPU drivers
# Or use --force (not ideal)

# Default potfile location
# ~/.local/share/hashcat/hashcat.potfile (Linux)
# %APPDATA%/hashcat/hashcat.potfile (Windows)

# Show cracked from potfile
hashcat -m 1000 hash.txt --show

# Show uncracked
hashcat -m 1000 hash.txt --left

# Custom potfile
hashcat -m 1000 hash.txt wordlist.txt --potfile-path=/tmp/custom.pot

# Disable potfile
hashcat -m 1000 hash.txt wordlist.txt --potfile-disable

# Remove potfile (start fresh)
rm ~/.local/share/hashcat/hashcat.potfile

# Quick benchmark of common modes
for m in 0 100 1000 1400 1800 3200 5600 13100; do
  hashcat -b -m $m 2>/dev/null | tail -1
done

# Extract hashes from secretsdump output (NTLM only)
awk -F: '{print $4}' secretsdump.txt | sort -u > ntlm_only.txt

# Extract username:NTLM pairs
awk -F: '{print $1":"$4}' secretsdump.txt > user_ntlm.txt

# Count unique hashes
sort -u hashes.txt | wc -l

# Remove blank/LM hashes (aad3b435...)
grep -v 'aad3b435b51404eeaad3b435b51404ee' hashes.txt > filtered.txt

# Convert hashcat potfile output to user:password
# From: hash:password
# With: user:hash file
while IFS=: read -r hash pass; do
  user=$(grep -m1 "$hash" user_hash.txt | cut -d: -f1)
  echo "$user:$pass"
done < potfile_results.txt

• Hashcat
• Hashcat Wiki
• Hashcat GitHub
• example_hashes
• HackTricks
• PayloadsAllTheThings

• Cracking Toolkit (Hash identifier, crack time estimator, hex converter)
• John the Ripper (Alternative cracker)
• Net-NTLMv1 (NTLMv1 cracking)
• NetExec (Hash capture via Responder)
• Mimikatz (Credential dumping)
• BloodHound (AD attack paths)
• AD Toolkit (AD cheatsheet hub)