Pentesting.Site - Hashcat Cheat Sheet

Hashcat is a powerful and versatile password-cracking tool widely used in security testing. It supports a vast range of hash types and leverages GPUs for fast and efficient cracking. Hashcat is a favorite among penetration testers for uncovering weak passwords and assessing password policies, helping identify vulnerabilities that could lead to unauthorized access or privilege escalation within a network. This cheat sheet provides practical Hashcat commands used by penetration testers to crack password hashes including NTLM, Kerberos, WPA/WPA2, Office documents, and encrypted archives.

Download Hashcat

Installation and Setup

From Package Managers

Kali Linux: Pre-installed. Run directly with hashcat.

1
sudo apt update && sudo apt install hashcat

1
brew install hashcat

From Source

1
git clone https://github.com/hashcat/hashcat.git
2
cd hashcat
3
make
4
./hashcat --help

Using Docker

1
docker pull hashcat/hashcat
2
docker run -it --rm hashcat/hashcat --help

Updating Hashcat

1
cd hashcat && git pull && make clean && make

1
sudo apt update && sudo apt upgrade hashcat

Hashcat Basics

Hashcat Hash Modes

The following table lists some of the common hashcat hash modes. A full list can be found here.

1
hashcat -m 0 hashes.txt wordlist.txt                       #MD5 Hash
2
hashcat -m 100 hashes.txt wordlist.txt                     #SHA1
3
hashcat -m 1400 hashes.txt wordlist.txt                    #SHA256
4
hashcat -m 1700 hashes.txt wordlist.txt                    #SHA512
5
hashcat -m 500 hashes.txt wordlist.txt                     #md5crypt
6
hashcat -m 1500 hashes.txt wordlist.txt                    #descrypt (DES Unix)
7
hashcat -m 1800 hashes.txt wordlist.txt                    #sha512crypt (Unix)
8
hashcat -m 3200 hashes.txt wordlist.txt                    #bcrypt
9
hashcat -m 1000 hashes.txt wordlist.txt                    #NTLM Hash
10
hashcat -m 3000 hashes.txt wordlist.txt                    #LM Hash
11
hashcat -m 5500 hashes.txt wordlist.txt                    #NetNTLMv1
12
hashcat -m 5600 hashes.txt wordlist.txt                    #NetNTLMv2
13
hashcat -m 13100 hashes.txt wordlist.txt                   #Kerberos 5 TGS-REP etype 23
14
hashcat -m 7500 hashes.txt wordlist.txt                    #Kerberos 5 AS-REQ Pre-Auth etype 23
15
hashcat -m 7300 hashes.txt wordlist.txt                    #IPMI2 RAKP HMAC-SHA1
16
hashcat -m 15300 hashes.txt wordlist.txt                   #DPAPI masterkey file v1
17
hashcat -m 15900 hashes.txt wordlist.txt                   #DPAPI domain backup key
18
hashcat -m 2100 hashes.txt wordlist.txt                    #Domain Cached Credentials (DCC2)
19
hashcat -m 2500 -a 3 handshake.hccapx wordlist.txt         #WPA/WPA2 Handshake (old format)
20
hashcat -m 22000 -a 3 handshake.22000 wordlist.txt         #WPA/WPA2 PMKID/EAPOL (recommended)
21
hashcat -m 12500 hashes.txt wordlist.txt                   #Kerberos 5 TGS-REP etype 17/18
22
hashcat -m 16800 hashes.txt wordlist.txt                   #WPA-PMKID (no EAPOL)
23
hashcat -m 7100 hashes.txt wordlist.txt                    #macOS v10.8+ (PBKDF2-SHA512)
24
hashcat -m 11600 hashes.txt wordlist.txt                   #7-Zip
25
hashcat -m 13400 hashes.txt wordlist.txt                   #KeePass 1.x
26
hashcat -m 13711 hashes.txt wordlist.txt                   #VeraCrypt SHA256 + XTS 512 bit
27
hashcat -m 11300 hashes.txt wordlist.txt                   #TrueCrypt PBKDF2-SHA512 + XTS
28
hashcat -m 18300 hashes.txt wordlist.txt                   #BitLocker
29
hashcat -m 19500 hashes.txt wordlist.txt                   #MS Office 2016

Hashcat Attack Modes

The attack modes available are:

1
-a
2

3
0 | Straight
4
1 | Combination
5
3 | Brute-force
6
6 | Hybrid Wordlist + Mask
7
7 | Hybrid Mask + Wordlist
8
9 | Association

Some examples of common attack modes are shown below:

1
hashcat -a 0 -m 0 hashes.txt wordlist.txt                 #Wordlist Attack
2
hashcat -a 3 -m 0 hashes.txt ?a?a?a?a                     #Mask Attack
3
hashcat -a 6 -m 0 hashes.txt wordlist.txt ?d?d            #Hybrid Wordlist + Mask
4
hashcat -a 7 -m 0 hashes.txt ?d?d wordlist.txt            #Hybrid Mask + Wordlist
5
hashcat -a 1 -m 0 hashes.txt wordlist1.txt wordlist2.txt  #Combinator Attack

Real Pentesting Attack Scenarios

1
hashcat -m 1000 hashes.txt rockyou.txt               #Crack NTLM hashes from a Windows dump
2
hashcat -m 5600 netntlmv2.txt rockyou.txt            #Crack captured NetNTLMv2 hashes
3
hashcat -m 18200 asrep_hashes.txt rockyou.txt        #Crack AS-REP roasted Kerberos hashes
4
hashcat -m 13100 kerberoast_hashes.txt rockyou.txt   #Crack Kerberoasted service tickets
5
hashcat -m 2100 dcc_hashes.txt rockyou.txt           #Crack Domain Cached Credentials (DCC2)
6
hashcat -m 7500 wifi.hccapx rockyou.txt              #Crack WPA/WPA2 handshake
7
hashcat -m 11600 7zip.hash rockyou.txt               #Crack 7zip encrypted archive
8
hashcat -m 13600 keepass.hash rockyou.txt            #Crack KeePass database password
9
hashcat -m 9600 office.hash rockyou.txt              #Crack MS Office document password
10
hashcat -m 10500 pdf.hash rockyou.txt                #Crack PDF password

Identifying Hash Types

1
hashid hashes.txt                                #Use hashid to identify hash
2
hashcat -m 0 --example-hashes                    #View example hashes for mode 0
3
hashcat --example-hashes | grep NTLM             #Search example hashes for NTLM
4
hashcat --example-hashes > examples.txt          #Export all example hashes

More generic hash types can be found here.

Performance Tuning

Optimizing Performance

1
hashcat -w 3 -m 1000 hashes.txt wordlist.txt             #Workload level 3 (high)
2
hashcat -w 4 -m 1000 hashes.txt wordlist.txt             #Workload level 4 (max)
3
hashcat --opencl-device-types 1,2                        #Select CPU (1) and GPU (2)
4
hashcat --backend-info                                   #Display backend info

Benchmarking

Benchmarking allows testing GPU or CPU performance before running long cracking jobs.

1
hashcat -b                                                #Run benchmark for default hash types
2
hashcat --benchmark-all                                   #Benchmark all supported hash modes
3
hashcat --speed-only -m 1000 hashes.txt wordlist.txt      #Estimate cracking speed and exit
4
hashcat --progress-only -m 1000 hashes.txt wordlist.txt   #Display expected workload size

Device and Hardware Control

1
hashcat -I                                                     #Display available OpenCL devices
2
hashcat -D 1 -m 1000 hashes.txt wordlist.txt                   #Use CPU only
3
hashcat -D 2 -m 1000 hashes.txt wordlist.txt                   #Use GPU only
4
hashcat -D 1,2 -m 1000 hashes.txt wordlist.txt                 #Use CPU and GPU
5
hashcat -d 1 -m 1000 hashes.txt wordlist.txt                   #Select specific device ID
6
hashcat --opencl-platforms=1 -m 1000 hashes.txt wordlist.txt   #Select OpenCL platform

Hardware Monitoring

Useful when cracking on GPUs to prevent overheating.

1
hashcat --hwmon-disable -m 1000 hashes.txt wordlist.txt           #Disable hardware monitoring
2
hashcat --hwmon-temp-abort=90 -m 1000 hashes.txt wordlist.txt     #Abort if GPU temperature reaches 90°C
3
hashcat --hwmon-temp-retain=80 -m 1000 hashes.txt wordlist.txt    #Throttle GPU to maintain temperature

Workload Tuning

These options are used when optimising cracking speed on specific GPUs or CPUs.

1
hashcat -w 1 -m 1000 hashes.txt wordlist.txt                   #Low workload profile
2
hashcat -w 2 -m 1000 hashes.txt wordlist.txt                   #Default workload profile
3
hashcat -w 3 -m 1000 hashes.txt wordlist.txt                   #High workload profile
4
hashcat -w 4 -m 1000 hashes.txt wordlist.txt                   #Nightmare workload profile
5
hashcat --kernel-accel=64 -m 1000 hashes.txt wordlist.txt      #Manually tune GPU acceleration
6
hashcat --kernel-loops=1024 -m 1000 hashes.txt wordlist.txt    #Adjust kernel loop count
7
hashcat --nvidia-spin-damp=50 -m 1000 hashes.txt wordlist.txt  #Reduce GPU spin-wait load

Wordlist and Rules

Using Wordlists

1
hashcat -m 0 -a 0 hashes.txt /usr/share/wordlists/rockyou.txt
2
hashcat -m 0 -a 0 hashes.txt custom_wordlist.txt

Applying Rules

1
hashcat -m 0 -a 0 hashes.txt wordlist.txt -r rules/best64.rule
2
hashcat -m 0 -a 0 hashes.txt wordlist.txt -r rules/combinator.rule

Wordlist Encoding and Hex Handling

These options help when cracking hashes that use non-standard encodings or binary inputs.

1
hashcat --encoding-from=utf-16 --encoding-to=utf-8 -m 1000 hashes.txt wordlist.txt   #Convert wordlist encoding
2
hashcat --hex-wordlist -m 1000 hashes.txt wordlist.txt                               #Treat wordlist entries as hex
3
hashcat --hex-salt -m 1000 hashes.txt wordlist.txt                                   #Treat salt as hex
4
hashcat --hex-charset -m 1000 -a 3 hashes.txt ?b?b?b?b                               #Interpret charset as hex

Generating Wordlists

1
hashcat --stdout -a 3 ?u?u?u?d?d > generated_wordlist.txt         #Generate a wordlist consisting of combinations of 3 uppercase letters followed by 2 digits
2
hashcat --stdout -a 3 ?l?l?l?l?d > generated_wordlist.txt         #Generate a wordlist consisting of combinations of 4 lowercase letters followed by a 1 digit
3
hashcat --stdout -a 3 ?l?l?l?l?l?u > generated_wordlist.txt       #Generate a wordlist consisting of combinations of 5 lowercase letters followed by 1 uppercase letter
4
hashcat --stdout -a 3 ?d?d?s?s?s > generated_wordlist.txt         #Generate a wordlist consisting of combinations of 2 digits followed by 3 special characters
5
hashcat --stdout -a 3 ?l?l?l?u?u?d > generated_wordlist.txt       #Generate a wordlist consisting of 3 lowercase letters, 2 uppercase letters, and 1 digit
6
hashcat --stdout -a 3 ?l?l?l?l?l?l?d?d > generated_wordlist.txt   #Generate a wordlist consisting of 6 lowercase letters followed by 2 digits
7
hashcat --stdout -a 3 ?l?d?l?d > generated_wordlist.txt           #Generate a wordlist consisting of alternating lowercase letters and digits (e.g., `a1b2`)
8
hashcat --stdout -a 3 ?d?d?d?l?l?l > generated_wordlist.txt       #Generate a wordlist consisting of 3 digits followed by 3 lowercase letters
9
hashcat --stdout -a 3 ?u?u?u?u?s > generated_wordlist.txt         #Generate a wordlist consisting of 4 uppercase letters followed by 1 special character

Mask Attacks

The character sets for mask attacks in Hashcat are:

1
l | abcdefghijklmnopqrstuvwxyz [a-z]
2
u | ABCDEFGHIJKLMNOPQRSTUVWXYZ [A-Z]
3
d | 0123456789                 [0-9]
4
h | 0123456789abcdef           [0-9a-f]
5
H | 0123456789ABCDEF           [0-9A-F]
6
s | !"#$%&'()*+,-./:;<=>?@[\]^_`{|}~
7
a | ?l?u?d?s
8
b | 0x00 - 0xff

Common Masks

1
hashcat -a 3 -m 0 hashes.txt ?d?d?d?d                     #4-digit PIN
2
hashcat -a 3 -m 0 hashes.txt ?u?l?l?l?d                   #Upper, lower, lower, lower, digit
3
hashcat -a 3 -m 0 hashes.txt ?a?a?a?a                     #Any 4 printable ASCII characters
4
hashcat -a 3 -m 0 hashes.txt ?u?u?u?u                     #4 uppercase letters
5
hashcat -a 3 -m 0 hashes.txt ?l?l?l?l                     #4 lowercase letters
6
hashcat -a 3 -m 0 hashes.txt ?d?d?d?d?d                   #5-digit PIN
7
hashcat -a 3 -m 0 hashes.txt ?u?u?u?l?l                   #3 uppercase and 2 lowercase letters
8
hashcat -a 3 -m 0 hashes.txt ?l?l?l?d?d                   #3 lowercase letters followed by 2 digits
9
hashcat -a 3 -m 0 hashes.txt ?l?l?l?l?d                   #4 lowercase letters followed by 1 digit
10
hashcat -a 3 -m 0 hashes.txt ?l?d?l?d?l                   #Alternating lowercase and digits (e.g., `a1b2c`)
11
hashcat -a 3 -m 0 hashes.txt ?u?d?u?d?l                   #Upper, digit, upper, digit, lower
12
hashcat -a 3 -m 0 hashes.txt ?a?a?a?d                     #Any 3 printable ASCII characters followed by a digit
13
hashcat -a 3 -m 0 hashes.txt ?d?d?d?l                     #3 digits followed by a lowercase letter
14
hashcat -a 3 -m 0 hashes.txt ?u?d?d?d?u                   #Upper, digit, digit, digit, upper
15
hashcat -a 3 -m 0 hashes.txt ?s?s?s?s                     #Any 4 special characters
16
hashcat -a 3 -m 0 hashes.txt ?l?u?d?s                     #Lowercase, uppercase, digit, special character
17
hashcat -a 3 -m 0 hashes.txt ?d?d?l?l?l                   #2 digits followed by 3 lowercase letters

Custom Charset Masks

1
hashcat -a 3 -m 0 hashes.txt -1 ?l?u ?1?1?1?1             #4 mixed-case letters
2
hashcat -a 3 -m 0 hashes.txt -2 abc ?2?2?2?2              #4 characters from 'abc'

Incremental Mask Attacks

1
hashcat -m 1000 -a 3 hashes.txt ?l?l?l?l?l?l --increment           #Enable mask increment
2
hashcat -m 1000 -a 3 hashes.txt ?l?l?l?l?l?l --increment-min=4     #Minimum mask length
3
hashcat -m 1000 -a 3 hashes.txt ?l?l?l?l?l?l --increment-max=8     #Maximum mask length

Hybrid Attacks

1
hashcat -a 6 -m 0 hashes.txt wordlist.txt ?d?d            #Wordlist + 2 digits
2
hashcat -a 7 -m 0 hashes.txt ?d?d wordlist.txt            #2 digits + Wordlist

Markov Attacks

Markov chains optimise brute-force attacks by prioritising likely character sequences.

1
hashcat -m 1000 -a 3 --markov-hcstat2=my.hcstat2 hashes.txt ?a?a?a?a?a?a   #Use custom Markov statistics file
2
hashcat -m 1000 -a 3 --markov-disable hashes.txt ?a?a?a?a?a?a              #Disable Markov optimization
3
hashcat -m 1000 -a 3 --markov-classic hashes.txt ?a?a?a?a?a?a              #Use classic Markov chains
4
hashcat -m 1000 -a 3 --markov-threshold=100 hashes.txt ?a?a?a?a?a?a        #Limit Markov candidate acceptance

Hashcat Brain (Distributed Cracking)

The brain feature prevents duplicate cracking attempts across multiple cracking machines.

1
hashcat --brain-server                                                                                    #Start brain server
2
hashcat --brain-client --brain-host=127.0.0.1 -m 1000 hashes.txt wordlist.txt                             #Connect to brain server
3
hashcat --brain-client --brain-host=10.10.10.5 --brain-password=secret -m 1000 hashes.txt wordlist.txt    #Authenticate to brain server
4
hashcat --brain-client --brain-host=10.10.10.5 --brain-port=13743 -m 1000 hashes.txt wordlist.txt         #Specify custom brain port

Common Hash Types

1
hashcat -m 22000 -a 3 handshake.22000 ?a?a?a?a?a?a?a?a           #WPA/WPA2 Handshake Cracking
2
hashcat -m 1000 -a 0 ntlm_hashes.txt wordlist.txt                #NTLM Hashes
3
hashcat -m 1400 -a 0 sha256_hashes.txt wordlist.txt              #SHA256 Hashes
4
hashcat -m 0 -a 0 md5_hashes.txt wordlist.txt                    #MD5 Hashes
5
hashcat -m 100 -a 0 sha1_hashes.txt wordlist.txt                 #SHA1 Hashes
6
hashcat -m 3200 -a 0 bcrypt_hashes.txt wordlist.txt              #bcrypt Hashes
7
hashcat -m 1700 -a 0 sha512_hashes.txt wordlist.txt              #SHA512 Hashes
8
hashcat -m 11000 -a 0 cisco_pix_hashes.txt wordlist.txt          #Cisco PIX Hashes
9
hashcat -m 300 -a 0 mysql_hashes.txt wordlist.txt                #MySQL 5.x Hashes
10
hashcat -m 9600 -a 0 office2013_hashes.txt wordlist.txt          #Office 2013 Hashes (RC4)
11
hashcat -m 3900 -a 0 cfhashes.txt wordlist.txt                   #Adobe ColdFusion 10 Hashes
12
hashcat -m 18200 -a 0 kerberos_hashes.txt wordlist.txt           #Kerberos 5 AS-REQ Pre-Auth Hashes
13
hashcat -m 1500 -a 0 des_hashes.txt wordlist.txt                 #DES Hashes
14
hashcat -m 7400 -a 0 hmac_sha256_hashes.txt wordlist.txt         #HMAC-SHA256 Hashes
15
hashcat -m 2200 -a 0 pbkdf2_hmac_sha1_hashes.txt wordlist.txt    #PBKDF2-HMAC-SHA1 Hashes
16
hashcat -m 3000 -a 0 lm_hashes.txt wordlist.txt                  #LM Hashes (Windows Legacy)
17
hashcat -m 400 -a 0 wordpress_hashes.txt wordlist.txt            #WordPress Hashes (MD5-based)
18
hashcat -m 13000 -a 0 radmin_hashes.txt wordlist.txt             #Radmin 3.x Hashes
19
hashcat -m 900 -a 0 openssl_md5_hashes.txt wordlist.txt          #OpenSSL MD5 Hashes
20
hashcat -m 12500 -a 0 rar3_hashes.txt wordlist.txt               #Rar3 Hashes (Rar3.x Archives)
21
hashcat -m 110 -a 0 office2007_2013_hashes.txt wordlist.txt      #MS Office 2007-2013 Hashes
22
hashcat -m 10500 -a 0 pdf_hashes.txt wordlist.txt                #PDF 1.7 Hashes (Encrypted PDFs)
23
hashcat -m 5000 -a 0 aix_hashes.txt wordlist.txt                 #AIX LM Hashes
24
hashcat -m 6211 -a 0 truecrypt_hashes.txt wordlist.txt           #TrueCrypt Hashes

Working with Files

Splitting and Sorting

1
split -l 1000 large_wordlist.txt smaller_list             #Split large wordlist
2
sort wordlist.txt | uniq > sorted_wordlist.txt            #Sort and remove duplicates

Cleaning Hashes

1
cat hashes.txt | sort | uniq > clean_hashes.txt           #Remove duplicate hashes

Using Potfile

Default Potfile

1
hashcat -m 0 -a 0 hashes.txt wordlist.txt --potfile-disable   #Disable potfile
2
hashcat --show -m 0 hashes.txt                                #Show cracked passwords
3
hashcat --left -m 1000 hashes.txt                             #Show remaining uncracked hashes
4
hashcat --potfile-disable -m 1000 hashes.txt wordlist.txt     #Disable writing to potfile

Custom Potfile

1
hashcat -m 0 -a 0 hashes.txt wordlist.txt --potfile-path=custom.pot

Session and Restore

Save a Session

1
hashcat -m 0 -a 0 hashes.txt wordlist.txt --session=my_session

Restore a Session

1
hashcat --restore --session=my_session

Disable Restore File Creation

1
hashcat --restore-disable -m 1000 hashes.txt wordlist.txt

Runtime Control

1
hashcat --runtime=3600 -m 1000 hashes.txt wordlist.txt     #Stop after one hour
2
hashcat --runtime=86400 -m 1000 hashes.txt wordlist.txt    #Run for 24 hours

Output and Logging

1
hashcat -o cracked.txt --outfile-format=2 -m 1000 hashes.txt wordlist.txt   #Custom output format
2
hashcat --outfile-check-timer=30 -m 1000 hashes.txt wordlist.txt            #Check outfile every 30 seconds
3
hashcat --separator=":" -m 1000 hashes.txt wordlist.txt                     #Change output separator
4
hashcat --logfile-disable -m 1000 hashes.txt wordlist.txt                   #Disable log file creation

The following custom output formats are available:

1
--outfile-format=
2

3
1 | hash[:salt]
4
2 | plain
5
3 | hex_plain
6
4 | crack_pos
7
5 | timestamp absolute
8
6 | timestamp relative

Monitoring and Status

1
hashcat --status -m 1000 hashes.txt wordlist.txt                      #Enable runtime status display
2
hashcat --status-timer=30 -m 1000 hashes.txt wordlist.txt             #Update status every 30 seconds
3
hashcat --machine-readable --status -m 1000 hashes.txt wordlist.txt   #Machine-readable status output
4
hashcat --logfile-disable -m 1000 hashes.txt wordlist.txt             #Disable log file creation