Hashcat Training Lab

What is Hashcat?

Hashcat is the world's fastest and most advanced password recovery tool. Unlike traditional CPU-based crackers, Hashcat leverages the massive parallel processing power of modern GPUs to crack password hashes at extraordinary speeds.

It supports over 350 different hash algorithms and 5 unique attack modes, making it the tool of choice for penetration testers, security researchers, and password recovery specialists worldwide.

Hashcat vs John the Ripper

Key Differences

• Processing Power: Hashcat uses GPU acceleration (OpenCL/CUDA), making it 10-100x faster than CPU-only tools like John the Ripper
• Speed Example: Cracking MD5 hashes - Hashcat can achieve 50+ GH/s (billions per second) on modern GPUs vs 1-2 GH/s with John on CPU
• Hash Support: Hashcat supports 350+ hash algorithms with consistent syntax
• Attack Modes: Hashcat has 5 distinct attack modes (dictionary, combination, brute-force, hybrid wordlist+mask, hybrid mask+wordlist)
• Platform: Hashcat runs on Windows, Linux, and macOS with GPU support

When to Use Each

• Use Hashcat when: You have a GPU, need maximum speed, working with modern hash formats, or have large wordlists
• Use John when: No GPU available, need specific format support, or want built-in wordlist mangling rules

GPU vs CPU Cracking

Why GPUs Are Faster

Modern CPUs have 4-16 cores optimized for sequential tasks. Modern GPUs have thousands of smaller cores designed for parallel operations. Password cracking is perfectly suited for parallelization - each hash attempt is independent.

Hash Speed Rankings (Fastest to Slowest)

Different algorithms have different computational costs:

1. Fast: MD5, SHA1, NTLM - Designed for speed, easy to crack (billions/second)
2. Moderate: SHA256, SHA512 - More computational work (millions/second)
3. Slow: bcrypt, PBKDF2, scrypt - Intentionally slow to resist cracking (thousands/second)
4. Very Slow: Argon2 - Modern memory-hard algorithm (hundreds/second)

Hash Modes

Hashcat uses numeric mode identifiers to specify which algorithm to crack. You must identify the correct hash mode before starting an attack.

Common Hash Modes

Mode	Algorithm	Common Uses	Speed Class
0	MD5	Legacy systems, older web apps	Very Fast
100	SHA1	Git commits, older security	Very Fast
1000	NTLM	Windows password hashes	Very Fast
1400	SHA256	Modern applications	Fast
1700	SHA512	Linux /etc/shadow (older)	Fast
3200	bcrypt	Modern secure storage	Slow
1800	sha512crypt	Linux /etc/shadow (modern)	Slow
13100	Kerberos 5 TGS-REP	Active Directory attacks	Moderate
22000	WPA-PBKDF2-PMKID+EAPOL	WiFi handshakes	Slow

Identifying Hash Types

Common hash patterns:

Attack Modes

Hashcat supports 5 distinct attack modes, each optimized for different scenarios:

Mode 0: Dictionary Attack

Tries every word from a wordlist against the hash. Fast and efficient when attackers have good wordlists.

Mode 1: Combination Attack

Combines words from two different wordlists (wordlist1 + wordlist2). Useful for compound passwords.

Mode 3: Brute-Force (Mask Attack)

Tries all possible character combinations matching a pattern (mask). Most thorough but slowest.

Mode 6: Hybrid Wordlist + Mask

Takes words from wordlist and appends a mask pattern. Great for "password123" style combinations.

Mode 7: Hybrid Mask + Wordlist

Prepends a mask pattern to wordlist words. Less common but useful for specific patterns.

Mask Attacks and Charsets

Masks define the pattern of characters to try. Each position uses a charset placeholder:

Built-in Charsets

Mask	Charset	Characters	Count
?l	Lowercase	abcdefghijklmnopqrstuvwxyz	26
?u	Uppercase	ABCDEFGHIJKLMNOPQRSTUVWXYZ	26
?d	Digits	0123456789	10
?s	Special	!"#$%&'()*+,-./:;<=>?@[\]^_`{|}~	32
?a	All printable	?l + ?u + ?d + ?s	95
?b	Binary	All bytes (0x00-0xFF)	256

Mask Examples

Custom Charsets

You can define your own character sets:

Rules and Rule Files

Rules transform wordlist entries to generate variations. This is incredibly powerful - a 1000-word wordlist with 100 rules becomes 100,000 password attempts.

Common Rule Operations

• : - Do nothing (use word as-is)
• l - Convert to lowercase
• u - Convert to uppercase
• c - Capitalize first letter
• $X - Append character X
• ^X - Prepend character X
• r - Reverse the word
• d - Duplicate the word

Rule Examples

Using Rule Files

Hashcat includes several built-in rule files:

• best64.rule - 64 most effective rules
• dive.rule - Extensive ruleset
• leetspeak.rule - L33t sp34k transformations
• toggles1.rule - Case toggles

Legal and Ethical Considerations

When Is It Legal?

• Your Own Systems: Testing passwords on systems you personally own and administer
• Written Authorization: Penetration testing with a signed contract/statement of work
• CTF Competitions: Capture The Flag events explicitly designed for security education
• Academic Research: Using publicly disclosed breach data for research (not exploitation)
• Password Recovery: Recovering your own forgotten passwords from your own files

When Is It ILLEGAL?

• Cracking passwords to access systems you don't own or have permission to test
• Using breached password databases to attempt account access
• Testing corporate systems without explicit written permission
• "Just seeing if I can" - curiosity is not a legal justification
• Accessing someone else's accounts, even if you know them personally

Real-World Consequences

Professional Ethics

As a security professional, you must:

• Get it in writing: Never start testing without a signed authorization
• Stay in scope: Only test what's explicitly authorized
• Protect findings: Treat cracked credentials as highly sensitive data
• Responsible disclosure: Report vulnerabilities to the organization, not publicly
• Secure your tools: Don't leave Hashcat sessions or potfiles accessible

Best Practices for Authorized Testing

1. Obtain written authorization specifying scope, duration, and approved methods
2. Document all activities with timestamps and commands used
3. Store cracked passwords securely (encrypted, access-controlled)
4. Provide findings in a professional report with remediation recommendations
5. Delete cracked credentials after the engagement unless retention is required
6. Never use cracked credentials for purposes beyond the authorized test scope

Getting Started with Real Hashcat

Ready to try Hashcat on your own system? Here's how to get started:

Installation

Your First Hash Crack (Practice)

Useful Hashcat Options

• --show - Display cracked hashes from previous runs
• --force - Bypass warnings (use carefully)
• -w 3 - Workload profile (1=low, 2=default, 3=high, 4=extreme)
• -O - Enable optimized kernels (faster but limited password length)
• --status - Auto-update status screen
• --session=NAME - Name your session for pause/resume