# hashcat Cheatsheet - Cheatsheets - Launch Pad

__ _______________________ _________._________________________ \_ _____/ \______ \ / _ \ / _____/ / _____/ | | \_ _____/ | __) | _/ / /_\ \ / \ ___ / \ ___ | | | __)_ | \ | | \ / | \ \ \_\ \ \ \_\ \ | |___ | \ \___ / |____|_ / \____|__ / \______ / \______ / |_______ \ /_______ / \/ \/ \/ \/ \/ \/ \/

# hashcat Cheatsheet

← Back to cheatsheets

← Home

hashcat is an advanced password recovery tool featuring GPU acceleration and support for over 300 hash types. It's the fastest and most advanced password cracking tool available.

## Basic Syntax

- hashcat -m <hash_type> <hash_file> <wordlist> - Basic attack

- hashcat -m 0 hash.txt wordlist.txt - MD5 attack

- hashcat -m 1000 hash.txt wordlist.txt - NTLM attack

- hashcat -m 22000 hash.hc22000 wordlist.txt - WPA/WPA2 attack

## Common Hash Types

- -m 0 - MD5

- -m 100 - SHA1

- -m 1000 - NTLM

- -m 1800 - sha512crypt $6$ (Linux)

- -m 22000 - WPA/WPA2 PMKID+EAPOL (hc22000 format)

- -m 16800 - WPA/WPA2 PMKID

- -m 2500 - WPA/WPA2 handshake

- -m 500 - md5crypt $1$ (Linux)

- -m 3200 - bcrypt $2$

- -m 17210 - sha256crypt $5$ (Linux)

- -m 1410 - sha256($salt.$pass)

- -m 13100 - Kerberos 5 TGS-REP

## Attack Modes

- -a 0 - Dictionary attack (default)

- -a 1 - Combinator attack

- -a 3 - Brute-force/Mask attack

- -a 6 - Hybrid wordlist + mask

- -a 7 - Hybrid mask + wordlist

## Brute-Force Masks

- -a 3 ?l?l?l?l?l?l?l?l - 8 lowercase letters

- -a 3 ?u?u?u?u - 4 uppercase letters

- -a 3 ?d?d?d?d - 4 digits

- -a 3 ?l?l?d?d - 2 letters + 2 digits

- -a 3 ?a?a?a?a - 4 characters (any)

- -a 3 password?d?d?d - "password" + 3 digits

### Mask Characters

- ?l - Lowercase letters (a-z)

- ?u - Uppercase letters (A-Z)

- ?d - Digits (0-9)

- ?s - Special characters (!@#$%^&*...)

- ?a - All characters (?l?u?d?s)

- ?b - Binary (0x00-0xff)

- ?h - Lowercase hex (0-9a-f)

- ?H - Uppercase hex (0-9A-F)

## Performance Options

- -w <1-4> - Workload profile (1=low, 2=default, 3=high, 4=insane)

- -O - Optimized kernels (may reduce supported password lengths)

- --force - Ignore warnings

- --hwmon-temp-abort=<temp> - Abort if GPU temp exceeds (Celsius)

- --hwmon-disable - Disable hardware monitoring

## Output Options

- -o <file> - Output file for recovered hashes

- --outfile-format=<num> - Output format (1=hash:pass, 2=hex, 3=hash[:salt]:pass)

- --show - Show cracked hashes

- --left - Show uncracked hashes

- --username - Show username (for formats with username)

- --remove - Remove cracked hashes from hash file

- --potfile-path=<file> - Path to potfile

- --outfile-autohex-disable - Disable hex encoding in output

## Session Options

- --session=<name> - Session name

- --restore - Restore session

- --status - Enable status update screen

- --status-timer=<sec> - Status update interval (default 10)

- --stdout - Output to stdout (no status screen)

- --quiet - Suppress output

## Rules and Masks

- -r <file> - Rules file

- -g <num> - Generate num random rules

- --rules-file=<file> - Rules file

## Common Examples

### MD5 Dictionary Attack

    hashcat -m 0 hash.txt wordlist.txt

### WPA/WPA2 Attack

    hashcat -m 22000 hash.hc22000 wordlist.txt

### NTLM Attack

    hashcat -m 1000 ntlm_hash.txt wordlist.txt

### Brute Force 8 Lowercase

    hashcat -m 0 hash.txt -a 3 ?l?l?l?l?l?l?l?l

### Brute Force 4-8 Digits

    hashcat -m 0 hash.txt -a 3 -i --increment-min=4 --increment-max=8 ?d?d?d?d

### Combinator Attack

    hashcat -m 0 hash.txt -a 1 wordlist1.txt wordlist2.txt

### With Rules

    hashcat -m 0 hash.txt wordlist.txt -r rules/best64.rule

### Show Cracked Hashes

    hashcat -m 0 hash.txt --show

### Resume Session

    hashcat --restore --session my_session

### High Performance

    hashcat -m 0 hash.txt wordlist.txt -w 4 -O

### Save Results

    hashcat -m 0 hash.txt wordlist.txt -o cracked.txt

## Tips

- Use -w 4 for maximum performance (may affect system usability)

- Use -O for optimized kernels (faster but limited password length)

- Use --show to display already cracked hashes

- Save session with --session to resume later

- Use -a 3 with masks for targeted brute force

- Combine dictionary with rules (-r) for better results

- Monitor GPU temperature to prevent damage

- Use -m 22000 for modern WPA/WPA2 captures (hc22000 format)

- Always test on authorized systems only

- Check hashcat examples on website for specific hash types

- Use --remove to clean up successfully cracked hashes

- Start with small wordlists before large brute force attacks

← Back to cheatsheets

← Home