Hashcat

https://hashcat.net/wiki
Admin
Hashcat is the world's fastest and most advanced password recovery utility, supporting multiple...
Tokens:178,682
Snippets:1,276
Trust Score:9.8
Update:6 days ago
Show doc for...
Tokens:
Raw
### Start VCL on broker with /etc/init.d/vcl start

Source: https://hashcat.net/wiki/doku.php?id=vcl_cluster_howto_original

Run on the broker node to start VCL.

```bash
/etc/init.d/vcl start
```

--------------------------------

### Start a cracking job with hashcat

Source: https://hashcat.net/wiki/doku.php?id=restore

Example command to start a cracking job with a session name, hash file, and mask. This job can later be resumed with --restore.

```bash
hashcat -m 0 -a 3 --session session_name example0.hash masks/rockyou-7-2592000.hcmaskCopy
```

--------------------------------

### hashcat --help example commands for various attack modes

Source: https://hashcat.net/wiki/doku.php?id=ubernoobs

Shows example hashcat commands for different attack modes (Wordlist, Wordlist + Rules, Brute-Force, Combinator, Association) as displayed in the output of `hashcat --help`. The example hash files and rules ship with hashcat, except the association example requires a one-line dictionary you create yourself.

```bash
hashcat -a 0 -m 400 example400.hash example.dict
```

```bash
hashcat -a 0 -m 0 example0.hash example.dict -r rules/best66.rule
```

```bash
hashcat -a 3 -m 0 example0.hash ?a?a?a?a?a?a
```

```bash
hashcat -a 1 -m 0 example0.hash example.dict example.dict
```

```bash
hashcat -a 9 -m 500 example500.hash your1word.dict -r rules/best66.rule
```

--------------------------------

### gate example input dictionary

Source: https://hashcat.net/wiki/doku.php?id=hashcat_utils

Example input dictionary file used to demonstrate gate.bin.

```bash
$ cat numbers
1
2
3
4
5
6
7
8
9
10
11
12
13
14
```

--------------------------------

### cutb example wordlist

Source: https://hashcat.net/wiki/doku.php?id=hashcat_utils

Example wordlist file used to demonstrate cutb.bin.

```bash
$ cat wordlist
apple1234
theman
fastcars
```

--------------------------------

### Build winpty with configure, make, and make install

Source: https://hashcat.net/wiki/doku.php?id=hashcat_on_windows_ssh

Builds winpty from source in the project directory. By default, winpty is installed in /_usr_local_; pass PREFIX=<path> to make install to change the installation location.

```bash
$ ./configure
$ make
$ make installCopy
```

--------------------------------

### Manually install VCL binaries and libraries

Source: https://hashcat.net/wiki/doku.php?id=vcl_cluster_howto_original

Installs VCL v1.22 manually as root, creating directories and installing binaries and libraries. Do not run the installation script.

```bash
cd vcl-1.22/
 
mkdir /usr/lib/vcl /etc/vcl
install -m 0755 -o root opencld /sbin/opencld
install -m 0755 -o root opencld_1.2 /sbin/opencld_1.2
install -m 0755 -o root broker /sbin/broker
install -m 0755 -o root libOpenCL.so /usr/lib/vcl/libOpenCL.so
install -m 0644 -o root man/man7/vcl.7 /usr/share/man/man7/vcl.7
 
ln -s libOpenCL.so /usr/lib/vcl/libOpenCL.so.1
ln -s libOpenCL.so.1 /usr/lib/libOpenCL.soCopy
```

--------------------------------

### expander example

Source: https://hashcat.net/wiki/doku.php?id=hashcat_utils

Example of using expander.bin with input 'pass1' and sorting the output. It generates all possible substrings and mutations.

```bash
$ echo pass1 | ./expander.bin  | sort -u
1
1p
1pas
a
as
ass
ass1
p
pa
pas
pass
s
s1
s1p
s1pa
ss
ss1
ss1p
```

--------------------------------

### Output of screen -x with multiple sessions

Source: https://hashcat.net/wiki/doku.php?id=ssh_running_process

Example output when multiple screen sessions are running. It lists each session with its PID, tty.host, start time, and status, and instructs you to use 'screen [-d] -r [pid.]tty.host' to resume one.

```text
There are several suitable screens on:
	19814.pts-0.sl1	(09/19/11 15:28:06)	(Detached)
	12239.pts-0.sl1	(09/10/11 15:02:29)	(Detached)
	1942.name	(09/10/11 17:05:40)	(Detached)
Type "screen [-d] -r [pid.]tty.host" to resume one of them.Copy
```

--------------------------------

### Start VCL daemon

Source: https://hashcat.net/wiki/doku.php?id=vcl_cluster_howto_original

Starts the VCL daemon using the init script.

```bash
/etc/init.d/vcl startCopy
```

--------------------------------

### Install openssh-server, openssh-client, and screen on Ubuntu

Source: https://hashcat.net/wiki/doku.php?id=ssh_running_process

Install the SSH server/client and screen on Ubuntu. Run these commands in a terminal with sudo privileges.

```bash
  sudo apt-get install openssh-server openssh-clientCopy
```

```bash
  sudo apt-get install screenCopy
```

--------------------------------

### Run oclHashcat-plus example with output

Source: https://hashcat.net/wiki/doku.php?id=vcl_cluster_howto_original

Example run of oclHashcat-plus with a dictionary attack. Shows the command and its output, including device detection and cracked hashes.

```bash
root@token:~/oclHashcat-plus-0.15# export LD_LIBRARY_PATH=/usr/lib/vcl

root@token:~/oclHashcat-plus-0.15# ./oclHashcat-plus64.bin -t 32 -a 7 example0.hash ?a?a?a?a example.dict

oclHashcat-plus v0.15 by atom starting...

Hashes: 6494 total, 1 unique salts, 6494 unique digests
Bitmaps: 16 bits, 65536 entries, 0x0000ffff mask, 262144 bytes
Workload: 256 loops, 80 accel
Watchdog: Temperature abort trigger disabled
Watchdog: Temperature retain trigger disabled
Device #1: Cayman, 1024MB, 800Mhz, 24MCU
Device #2: Cypress, 512MB, 800Mhz, 20MCU
Device #3: Cayman, 1024MB, 800Mhz, 24MCU
Device #4: Cypress, 512MB, 800Mhz, 20MCU
Device #5: Cayman, 1024MB, 800Mhz, 24MCU
Device #6: Cypress, 512MB, 800Mhz, 20MCU
Device #7: Cayman, 1024MB, 800Mhz, 24MCU
Device #8: Cypress, 512MB, 800Mhz, 20MCU
Device #9: Cayman, 1024MB, 800Mhz, 24MCU
Device #10: Cypress, 512MB, 800Mhz, 20MCU
Device #11: Cayman, 1024MB, 800Mhz, 24MCU
Device #1: Kernel ./kernels/4098/m0000_a1.Cayman_938.2_CAL 1.4.1741.kernel (490316 bytes)
Device #2: Kernel ./kernels/4098/m0000_a1.Cypress_938.2_CAL 1.4.1741.kernel not found in cache! Building may take a while...
Device #2: Kernel ./kernels/4098/m0000_a1.Cypress_938.2_CAL 1.4.1741.kernel (456788 bytes)
Device #3: Kernel ./kernels/4098/m0000_a1.Cayman_938.2_CAL 1.4.1741.kernel (490316 bytes)
Device #4: Kernel ./kernels/4098/m0000_a1.Cypress_938.2_CAL 1.4.1741.kernel (456788 bytes)
Device #5: Kernel ./kernels/4098/m0000_a1.Cayman_938.2_CAL 1.4.1741.kernel (490316 bytes)
Device #6: Kernel ./kernels/4098/m0000_a1.Cypress_938.2_CAL 1.4.1741.kernel (456788 bytes)
Device #7: Kernel ./kernels/4098/m0000_a1.Cayman_938.2_CAL 1.4.1741.kernel (490316 bytes)
Device #8: Kernel ./kernels/4098/m0000_a1.Cypress_938.2_CAL 1.4.1741.kernel (456788 bytes)
Device #9: Kernel ./kernels/4098/m0000_a1.Cayman_938.2_CAL 1.4.1741.kernel (490316 bytes)
Device #10: Kernel ./kernels/4098/m0000_a1.Cypress_938.2_CAL 1.4.1741.kernel (456788 bytes)
Device #11: Kernel ./kernels/4098/m0000_a1.Cayman_938.2_CAL 1.4.1741.kernel (490316 bytes)

Cache-hit dictionary stats example.dict: 1210228 bytes, 129988 words, 129988 keyspace

e973fc5ba3f41964b28cbf1d3d3e7f5c:dyn10001000
7ac74b85753f5cee6c9446b103cc59e8:scas0000
aa1ce869d58da099b8c15859540ad220:linn01111986
0142b84c7d5ab92691cf9e21fbca9a08:f8140123
5be4a34c048a4d4af2462679b7886151:55bo02020202
d2a92d0b635bdc8fd3df226b7084dc8c:368901man
```

--------------------------------

### Install minimal X11 environment and fglrx

Source: https://hashcat.net/wiki/doku.php?id=linux_server_howto

Installs build-essential, dkms, a minimal X11 server, and fglrx. Required so libatiadlxx can monitor and manage the GPUs.

```bash
aptitude install build-essential dkms xserver-xorg xserver-xorg-core \
xserver-xorg-input-evdev xserver-xorg-video-dummy x11-xserver-utils fglrx xdm
```

--------------------------------

### Run oclHashcat-lite benchmark example with output

Source: https://hashcat.net/wiki/doku.php?id=vcl_cluster_howto_original

Example run of oclHashcat-lite in benchmark mode. Shows the command and its output, including device detection and NTLM speed results.

```bash
root@token:~/oclHashcat-lite-0.15# export LD_LIBRARY_PATH=/usr/lib/vcl

root@token:~/oclHashcat-lite-0.15# ./oclHashcat-lite64.bin -b --benchmark-mode 1 -m 1000

oclHashcat-lite v0.15 by atom starting...

Password lengths: 1 - 54
Watchdog: Temperature abort trigger disabled
Watchdog: Temperature retain trigger disabled
Device #1: Cayman, 1024MB, 800Mhz, 24MCU
Device #2: Cypress, 512MB, 800Mhz, 20MCU
Device #3: Cayman, 1024MB, 800Mhz, 24MCU
Device #4: Cypress, 512MB, 800Mhz, 20MCU
Device #5: Cayman, 1024MB, 800Mhz, 24MCU
Device #6: Cypress, 512MB, 800Mhz, 20MCU
Device #7: Cayman, 1024MB, 800Mhz, 24MCU
Device #8: Cypress, 512MB, 800Mhz, 20MCU
Device #9: Cayman, 1024MB, 800Mhz, 24MCU
Device #10: Cypress, 512MB, 800Mhz, 20MCU
Device #11: Cayman, 1024MB, 800Mhz, 24MCU

[s]tatus [p]ause [r]esume [q]uit =>
NOTE: Runtime limit reached, aborting...


Hash.Type....: NTLM
Speed.GPU.#1.:  9804.3M/s
Speed.GPU.#2.:  9400.3M/s
Speed.GPU.#3.:  9790.4M/s
Speed.GPU.#4.:  9381.1M/s
Speed.GPU.#5.:  9793.9M/s
Speed.GPU.#6.:  9381.4M/s
Speed.GPU.#7.:  9785.4M/s
Speed.GPU.#8.:  9381.3M/s
Speed.GPU.#9.:  9783.6M/s
Speed.GPU.#10.:  9936.9M/s
Speed.GPU.#11.:  9784.6M/s
Speed.GPU.#*.:   106.2G/s

Started: Fri Jan  4 11:38:37 2013
Stopped: Fri Jan  4 11:38:57 2013
```

--------------------------------

### len example input dictionary

Source: https://hashcat.net/wiki/doku.php?id=hashcat_utils

Example dictionary file used to demonstrate the len utility.

```bash
$ cat dict
1
123
test
pass
hello
world
```

--------------------------------

### ngramX example input text

Source: https://hashcat.net/wiki/doku.php?id=hashcat_utils

Example input text from alice_in_wonderland.txt used to demonstrate ngramX.

```bash
$ head alice_in_wonderland.txt
TITLE: Alice's Adventures in Wonderland
AUTHOR: Lewis Carroll
```

--------------------------------

### Simple example: dict1.txt contents

Source: https://hashcat.net/wiki/doku.php?id=combinator_attack

Sample first dictionary used in the simple example. Contains four words: pass, 12345, omg, Test.

```text
pass
12345
omg
Test
```

--------------------------------

### Simple example: dict2.txt contents

Source: https://hashcat.net/wiki/doku.php?id=combinator_attack

Sample second dictionary used in the simple example. Contains four words: alice, bob, cat, dog.

```text
alice
bob
cat
dog
```

--------------------------------

### ct3_to_ntlm example with ESS

Source: https://hashcat.net/wiki/doku.php?id=hashcat_utils

Example of using ct3_to_ntlm.bin with ESS. The input includes a CT3 value and a salt, and the output is the NTLM hash.

```bash
./ct3_to_ntlm.bin 7D01513435B36DCA 1122334455667788
1FA1B9C4ED8E570200000000000000000000000000000000
34d5
```

--------------------------------

### rli example input files w1.txt and w2.txt

Source: https://hashcat.net/wiki/doku.php?id=hashcat_utils

Example input files for rli: w1.txt contains the base list, w2.txt contains words to remove.

```text
password
123
cards
999
aceofspades
1234
veryfast
```

```text
123
999
1234
```

--------------------------------

### Speed-only output example

Source: https://hashcat.net/wiki/doku.php?id=machine_readable

Example of using --speed-only with --machine-readable to get only the device-id and hashes per second. The command runs a mask attack on target.hashlist with device 1, quiet mode, and speed-only output.

```bash
$ hashcat -m 0 -a 3 target.hashlist -d 1 --quiet --speed-only --machine-readable ?a?a?a?a?a?a?a?a
1:3273837251
```

--------------------------------

### Configure X11, XDM, and environment for headless GPU use

Source: https://hashcat.net/wiki/doku.php?id=linux_server_howto

Initializes AMD adapter configuration, sets up XDM startup script to disable DPMS and screen saver, sets DISPLAY for root and new users, enables XDM, and reboots.

```bash
amdconfig --adapter=all --initial -f

cat > /etc/X11/xdm/Xsetup << EOF
export PATH=/bin:/usr/bin:/sbin
export HOME=/root
export DISPLAY=:0
xset -dpms
xset s off
xhost +
EOF

echo 'export DISPLAY=:0' >> ~/.bashrc
echo 'export DISPLAY=:0' >> /etc/skel/.bashrc

update-rc.d xdm defaults

sync && reboot
```

--------------------------------

### Show version and help for kwp

Source: https://hashcat.net/wiki/doku.php?id=kwprocessor

Run ./kwp -V to print the version (v1.00) and ./kwp --help to display the full usage and options list.

```bash
$ ./kwp -V
v1.00

$ ./kwp --help
Advanced keyboard-walk generator with configurable basechars, keymap and routes

Usage: ./kwp [options]... basechars-file keymap-file routes-file

 Options Short / Long        | Type | Description                                                 | Default
=============================+======+=============================================================+=========
  -V, --version              |      | Print version                                               |
  -h, --help                 |      | Print help                                                  |
  -o, --output-file          | FILE | Output-file                                                 |
  -b, --keyboard-basic       | BOOL | Include characters reachable without holding shift or altgr | 1
  -s, --keyboard-shift       | BOOL | Include characters reachable by holding shift               | 0
  -a, --keyboard-altgr       | BOOL | Include characters reachable by holding altgr (non-english) | 0
  -z, --keyboard-all         |      | Shortcut to enable all --keyboard-* modifier                |
  -1, --keywalk-south-west   | BOOL | Include routes heading diagonale south-west                 | 0
  -2, --keywalk-south        | BOOL | Include routes heading straight south                       | 1
  -3, --keywalk-south-east   | BOOL | Include routes heading diagonale south-east                 | 0
  -4, --keywalk-west         | BOOL | Include routes heading straight west                        | 1
  -5, --keywalk-repeat       | BOOL | Include routes repeating character                          | 0
  -6, --keywalk-east         | BOOL | Include routes heading straight east                        | 1
  -7, --keywalk-north-west   | BOOL | Include routes heading diagonale north-west                 | 0
  -8, --keywalk-north        | BOOL | Include routes heading straight north                       | 1
  -9, --keywalk-north-east   | BOOL | Include routes heading diagonale north-east                 | 0
  -0, --keywalk-all          |      | Shortcut to enable all --keywalk-* directions               |
  -n, --keywalk-distance-min | NUM  | Minimum allowed distance between keys                       | 1
  -x, --keywalk-distance-max | NUM  | Maximum allowed distance between keys                       | 1
  -Copy
```

--------------------------------

### gate split into two dictionaries (offset 0)

Source: https://hashcat.net/wiki/doku.php?id=hashcat_utils

Example of gate.bin with mod 2 and offset 0, extracting every second line starting from line 1.

```bash
$ ./gate.bin 2 0 < numbers
1
3
5
7
9
11
13
```

--------------------------------

### gate split into two dictionaries (offset 1)

Source: https://hashcat.net/wiki/doku.php?id=hashcat_utils

Example of gate.bin with mod 2 and offset 1, extracting every second line starting from line 2.

```bash
$ ./gate.bin 2 1 < numbers
2
4
6
8
10
12
14
```

--------------------------------

### cutb negative offset fixed length

Source: https://hashcat.net/wiki/doku.php?id=hashcat_utils

Example of cutb.bin with negative offset -5 and length 3, extracting 3 characters starting 5 characters from the end.

```bash
$ ./cutb.bin -5 3 < wordlist
e12
hem
tca
```

--------------------------------

### splitlen: create directory and run

Source: https://hashcat.net/wiki/doku.php?id=hashcat_utils

Create a directory and run splitlen on rockyou.txt.

```bash
$ mkdir ldicts
$ ./splitlen.bin ldicts < rockyou.txt
```

--------------------------------

### Show version and help for mp64.bin

Source: https://hashcat.net/wiki/doku.php?id=maskprocessor

Run ./mp64.bin -V to print the version (v0.73) and ./mp64.bin --help to display the full usage and options list, including custom charsets and built-in charsets.

```bash
$ ./mp64.bin -V
v0.73

$ ./mp64.bin --help
High-Performance word generator with a per-position configurable charset

Usage: ./mp64.bin [options]... mask

* Startup:

  -V,  --version             Print version
  -h,  --help                Print help

* Increment:

  -i,  --increment=NUM:NUM   Enable increment mode. 1st NUM=start, 2nd NUM=stop
                             Example: -i 4:8 searches lengths 4-8 (inclusive)

* Misc:

       --combinations        Calculate number of combinations
       --hex-charset         Assume charset is given in hex
  -q,  --seq-max=NUM         Maximum number of multiple sequential characters
  -r,  --occurrence-max=NUM  Maximum number of occurrence of a character

* Resources:

  -s,  --start-at=WORD       Start at specific position
  -l,  --stop-at=WORD        Stop at specific position

* Files:

  -o,  --output-file=FILE    Output-file

* Custom charsets:

  -1,  --custom-charset1=CS  User-definable charsets
  -2,  --custom-charset2=CS  Example:
  -3,  --custom-charset3=CS  --custom-charset1=?dabcdef
  -4,  --custom-charset4=CS  sets charset ?1 to 0123456789abcdef

* Built-in charsets:

  ?l = abcdefghijklmnopqrstuvwxyz
  ?u = ABCDEFGHIJKLMNOPQRSTUVWXYZ
  ?d = 0123456789
  ?s =  !"#$%&'()*+,-./:;<=>?@[\]^_`{|}~
  ?a = ?l?u?d?s
  ?b = 0x00 - 0xff

```

--------------------------------

### Example: generate 5-letter words with sp64.bin

Source: https://hashcat.net/wiki/doku.php?id=statsprocessor

Runs sp64.bin with --pw-min 5 and --pw-max 5 using hashcat.hcstat and mask ?l?l?l?l?l, piping to head -9. Output shows the first nine generated words, starting with 'sange'.

```bash
root@sf:~/statsprocessor-0.07# ./sp64.bin --pw-min 5 --pw-max 5 hashcat.hcstat ?l?l?l?l?l | head -9
sange
songe
serin
singe
sunge
srane
shane
slane
snder
```

--------------------------------

### hashcat -m 0 -a 3 -w 1 example0.hash ?a?a?a?a?a?a?a?a?a?a

Source: https://hashcat.net/wiki/doku.php?id=faq_archive

Example command using a lower workload profile (-w 1) to reduce desktop lag. -w 1 costs speed; the default is -w 2. On multi-GPU machines, run hashcat -I to find device numbers and use -d to select GPUs other than the display GPU.

```bash
$ hashcat -m 0 -a 3 -w 1 example0.hash ?a?a?a?a?a?a?a?a?a?aCopy
```

--------------------------------

### len example filtering words of length 2-4

Source: https://hashcat.net/wiki/doku.php?id=hashcat_utils

Example command and output for len: filters words with length 2, 3, or 4 from the example dictionary.

```bash
$ ./len.bin 2 4 < dict
123
test
pass
```

--------------------------------

### htpasswd DEScrypt hash example

Source: https://hashcat.net/wiki/doku.php?id=frequently_asked_questions

Example of a DEScrypt htpasswd hash (mode 1500) with no prefix. DEScrypt truncates the password at 8 characters; the password for this example is 'hashcat'.

```text
admin:48c/R8JAv757A
```

--------------------------------

### combinatorX example with three lists

Source: https://hashcat.net/wiki/doku.php?id=hashcat_utils

Demonstrates the combinatorX tool, which combines up to eight elements with custom separators. This example uses three lists and shows the output combinations.

```bash
$ cat list1.txt
the
quick

$ cat list2.txt
brown
fox

$ cat list3.txt
jumped
over

$ combinatorX -1 list1.txt -2 list2.txt -3 list3.txt
thebrownjumped
thebrownover
thefoxjumped
thefoxover
quickbrownjumped
quickbrownover
quickfoxjumped
quickfoxover
```

--------------------------------

### generate-rules example

Source: https://hashcat.net/wiki/doku.php?id=hashcat_utils

Example of generating 10 random rules with seed 42 using generate-rules.bin.

```bash
./generate-rules.bin 10 42
$  $} z3
*61 t
l
o2*
L2
*6B *98 D1
x0A f x32
s^L
s[5 s'#
swU }
```

--------------------------------

### Install portable init script for VCL

Source: https://hashcat.net/wiki/doku.php?id=vcl_cluster_howto_original

Installs epixoip's portable init script and registers it with update-rc.d. The original source bindshell.nl/pub/vcl.init is gone, so the file must be sourced elsewhere.

```bash
install -m 0755 -o root vcl.init /etc/init.d/vcl
update-rc.d vcl defaultsCopy
```

--------------------------------

### Start the hashcat brain server

Source: https://hashcat.net/wiki/doku.php?id=frequently_asked_questions

Starts the brain server on the host. The brain is a shared memory of tried candidates, not a job scheduler.

```bash
$ hashcat --brain-server
```
Tokens:
Raw