tools

Overview

Hashcat is the world’s fastest and most advanced password recovery tool. Uses GPU acceleration to crack password hashes using wordlists, brute force, rule-based attacks, and more. Should be run on the host machine rather than a VM to utilize full GPU performance.

Target / Context

Password hashes from any source — Linux /etc/shadow, Windows SAM, web application databases, captured network hashes, and more.

Installation

ℹ︎Installation Commands: 
sudo apt install hashcat

Basic Usage

ℹ︎Basic Usage: 
hashcat -m <hash_type> -a <attack_mode> hashfile wordlist
hashcat hashfile wordlist
man hashcat

Note: Run on host machine, not VM — requires GPU access for best performance. Use hashcat hashfile wordlist to let Hashcat autodetect the hash type.

Flags & Options

ℹ︎Flags & Options:
FlagDescriptionExample
-mHash type (numerical format)-m 0 (MD5) / -m 1000 (NTLM)
-aAttack mode-a 0 (wordlist) / -a 3 (brute force)
-oOutput file for cracked hashes-o cracked.txt
—showShow previously cracked hasheshashcat —show hashfile
—forceIgnore warnings (use cautiously)—force
-rApply rule file to wordlist-r rules/best64.rule
—wordlistSpecify wordlist explicitly—wordlist /usr/share/wordlists/rockyou.txt
-1Define custom charset 1 (use ?1 in mask)-1 ?d?u (digits + uppercase)

Common Use Cases

Wordlist Attack

Crack hashes using a wordlist.

ℹ︎Commands: 
hashcat -m 0 -a 0 hashes.txt /usr/share/wordlists/rockyou.txt
hashcat -m 1000 -a 0 hashes.txt /usr/share/wordlists/rockyou.txt

Autodetect Hash Type

ℹ︎Commands: 
hashcat hashes.txt /usr/share/wordlists/rockyou.txt

Show Previously Cracked Hashes

ℹ︎Commands: 
hashcat --show hashes.txt

IPMI 2.0 RAKP Hash Cracking

IPMI 2.0 RAKP authentication returns a salted HMAC-SHA1 hash for any valid username — obtainable without authentication. HP iLO factory passwords are 8 uppercase letters and digits. See IPMI for the protocol flaw.

ℹ︎Commands: 
hashcat -m 7300 ipmi.txt -a 3 ?1?1?1?1?1?1?1?1 -1 ?d?u

— Mode 7300 = IPMI 2.0 RAKP HMAC-SHA1; -a 3 = mask attack; ?1 = custom charset 1; -1 ?d?u = digits + uppercase; 8-char mask covers HP iLO factory password pattern.

hashcat -m 7300 ipmi.txt wordlist.txt

— Dictionary attack for non-HP BMCs with weaker or reused passwords.

Filter Password Length Before Cracking

Script To Filter Password Length

ℹ︎Commands: 
awk 'length($0) > 6' wordlist.txt > filtered.txt
hashcat -m 0 hashes.txt filtered.txt
  • Password Cracking

References / Images