Getting Started with hashcat: The Complete Guide

If you're serious about ethical hacking, you need to master hashcat. While tools like John the Ripper have their place, hashcat is built for raw, GPU-accelerated speed. In my experience running hundreds of pentests, hashcat is consistently the tool that turns captured hashes into actionable plaintext passwords.

But here is the thing nobody tells you: hashcat can be incredibly overwhelming for beginners. The sheer number of attack modes, rules, and hardware tuning options can feel like drinking from a firehose. In this guide, we'll break it down step-by-step.

Understanding Hash Types and hashcat Modes

Before you can crack a hash, you need to know what kind of hash it is. Is it MD5? NTLM? bcrypt? hashcat uses numerical "modes" (the -m flag) to identify the hash type. You can't just throw a hash at it and expect it to guess.

If you're unsure what hash you have, use a tool like hashid or simply run hashcat's built-in identification. Hashcat can attempt best-effort hash-type identification:

hashcat --identify my_hashes.txt

Common modes you'll use constantly:

• -m 0: Standard MD5
• -m 1000: NTLM (Windows Active Directory)
• -m 22000: WPA-PBKDF2-PMKID+EAPOL
• -m 3200: bcrypt (Web app passwords, usually very slow to crack)

The Baseline: Dictionary Attacks (Attack Mode 0)

The most straightforward way to use hashcat is a simple dictionary attack. We take a list of known passwords (like the infamous rockyou.txt) and try them one by one. The attack mode is specified with -a 0.

hashcat -m 1000 -a 0 hashes.txt /usr/share/wordlists/rockyou.txt

Leveling Up: Rule-Based Attacks

A pure dictionary attack rarely works against modern password policies (which require numbers and symbols). This is where rules come in. Rules tell hashcat to mutate the words in your dictionary—capitalizing the first letter, appending numbers, substituting 'a' with '@', etc.

Hashcat comes with several built-in rules (found in /usr/share/hashcat/rules/ on Kali). The best64.rule is an excellent starting point, but OneRuleToRuleThemAll.rule (available on GitHub) is legendary for corporate pentests.

hashcat -m 1000 -a 0 hashes.txt rockyou.txt -r /usr/share/hashcat/rules/best64.rule

This command takes every word in rockyou.txt, applies the transformations defined in best64.rule, and tests the result. It significantly increases your success rate against complex passwords.

Brute-Force and Mask Attacks (Attack Mode 3)

Sometimes you need to exhaust a specific pattern. For instance, what if you know the password is exactly 8 characters long, starts with "Admin", and ends with three digits? You use a mask attack (-a 3).

Hashcat has built-in character sets:

• ?l : lowercase letters (a-z)
• ?u : uppercase letters (A-Z)
• ?d : digits (0-9)
• ?s : special characters
• ?a : all of the above

To crack the "Admin + 3 digits" pattern:

hashcat -m 1000 -a 3 hashes.txt Admin?d?d?d

Cracking WPA2 Handshakes (The Modern Way)

If you're doing wireless pentesting, you're likely capturing WPA2 handshakes (as discussed in our Evil Twin guide). Historically, you used aircrack-ng for this, but hashcat is infinitely faster.

For captures that need conversion, hcxpcapngtool can convert supported capture files into Hashcat's hc22000 format.

# Convert the capture file
hcxpcapngtool -o target.hc22000 capture.cap

# Crack it with hashcat using a dictionary and rules
hashcat -m 22000 target.hc22000 rockyou.txt -r rules/best64.rule

Session Management and The Potfile

Cracking can take days or weeks. Hashcat automatically manages this. If you interrupt a session (Ctrl+C), you can resume it later by running hashcat --restore.

Furthermore, hashcat saves every cracked password in a file called the hashcat.potfile. Before it even attempts to crack a hash, it checks this file to see if it already knows the answer. This saves an enormous amount of time when dealing with recycled passwords across different engagements.

Hashcat is a journey. Start with the basics, build custom wordlists, experiment with rules, and soon you'll be cracking hashes that previously seemed impossible.