Module 4 · Hashcat — Password Cracking 🔒

Hashcat is the world’s fastest and most widely-used password cracking tool. GPU-accelerated, supporting 300+ hash algorithms, it’s what every serious pen-tester and every serious attacker uses after recovering password hashes.

When you use Hashcat

• Pen-test: you extracted NTLM hashes from an AD dump (DCSync, ntds.dit). Crack to recover passwords.
• Pen-test: you recovered /etc/shadow. Crack SHA-512 hashes.
• Pen-test: Kerberoasting returned service ticket hashes (mode 13100). Crack to get service passwords.
• Audit: check your own password policy by attempting to crack your own hash dumps. Gauge hygiene.

Core workflow

# Syntax
hashcat -m MODE -a ATTACK_TYPE hashfile wordlist [rules]

# Crack NTLM hashes from ntds.dit dump (mode 1000), dictionary attack
hashcat -m 1000 ntlm_hashes.txt /usr/share/wordlists/rockyou.txt

# With rules (mutate each word: Password → Password1, P@ssword, etc.)
hashcat -m 1000 hashes.txt rockyou.txt -r best64.rule

# Brute force mask: 8 chars, lower + digit
hashcat -m 1000 hashes.txt -a 3 ?l?l?l?l?l?l?d?d

# Kerberoast (mode 13100 for RC4, 19700 for AES-256)
hashcat -m 13100 kerb.txt rockyou.txt -r best64.rule

Attack modes

• -a 0 — Dictionary (wordlist)
• -a 1 — Combinator (wordlist + wordlist)
• -a 3 — Mask (brute force with pattern)
• -a 6 — Hybrid Wordlist + Mask
• -a 7 — Hybrid Mask + Wordlist
• -a 9 — Association (hashes + hints)

Common hash modes

Rules — the secret to good cracking

A wordlist alone cracks passwords like “password” and “summer”. Rules transform each word into dozens of variants:

# Transformations applied by rule engine:
password   → Password1  → P@ssword  → password123
         → password!  → PASSWORD  → passwordpassword

# Classic rule files (in hashcat/rules/):
best64.rule         # Small, fast, essential
rockyou-30000.rule  # Medium-large, derived from rockyou patterns
dive.rule           # Comprehensive, slow

GPU performance (2026 consumer hardware)

• RTX 4090: ~100 GH/s on MD5, ~10 GH/s on NTLM, ~200 MH/s on bcrypt (cost-hardened)
• RTX 4080: ~70% of 4090
• CPU only: ~1000-10000× slower than GPU

Practical translation: weak 8-char NTLM passwords fall in minutes. bcrypt with high cost takes years. This is why correct algorithm choice matters far more than password length alone.