Created by Justin Wang || Revised by Kent Ickler

This blog is part of Offensive Tooling Cheatsheets: An Infosec Survival Guide Resource. You can learn more and find all of the cheatsheets HERE: https://www.blackhillsinfosec.com/offensive-tooling-cheatsheets/

Hashcat Cheatsheet: PRINT-FRIENDLY PDF

Find the tool here: https://github.com/hashcat/hashcat

---

Hashcat is a powerful tool for recovering lost passwords, and, thanks to GPU acceleration, it’s one of the fastest. It works by rapidly trying different password guesses to determine the original password from its scrambled (hashed) version. Hashcat uses various clever techniques, like dictionary attacks (testing common passwords), leetspeak tricks (e.g., replacing “e” with “3”), pattern-based guessing, and combining different words or phrases. This helps expose weak passwords and poor security habits, which many people rely on when configuring and registering accounts online. Because of its effectiveness, Hashcat is widely used in cybersecurity training, ethical hacking, and penetration testing to improve password security and help organizations strengthen their defenses.

hashcat -m # <file storing your hash> <path to wordlist> -a <attack>

Commonly Used Modes (-m)

Attack Modes (-a)

0 = Straight Dictionary Attack Example: hashcat -m 500 -a 0 hash.txt dict.txt

1 = Combination Attack Example: hashcat -m 500 -a 1 hash.txt dict1.txt dict2.txt

3 = Brute Force Attack Example: hashcat -m 500 -a 3 hash.txt ?l?d?u

6 = Hybrid Wordlist + Mask Example: hashcat -m 500 -a 6 hash.txt wordlist.txt ?d?s

7 = Mask + Wordlist Example: hashcat -m 500 -a 7 hash.txt ?d?s wordlist.txt

Useful Command Arguments

"--runtime=X"	Abort session after X seconds of runtime.
"--session=X"	Define session name to be string X.
"--restore"	Restore Session from –session.
"-o"	Define output file for recovered hash.
"--show"	Show the cracked hashes.
"--left"	Show the uncracked hashes.
"--username"	Enable ignoring of usernames in hashfile.
"--remove"	Enable removal of hashes once they are cracked.
"-b"	Run benchmark of selected hash modes.

Mask Character Sets (?)

?l	abcdefghijklmnopqrstuvwxyz
?u	ABCDEFGHIJKLMNOPQRSTUVWXYZ
?d	123456789
?h	0123456789abcdef
?H	0123456789ABCDEF
?s	!”#$%&'()*+,-./:;<=>?@[\]^_`{|}~
?a	?l?u?d?s
?b	0x00 – 0xff

Example:

hashcat -m500 -a 3 ?l?l?a?a?a?a?d?d

Brute force cracking using the masks to check for passwords that has 2 lowercase letters, 4 characters of all possibilities and 2 numbers.

For a more expansive cheat sheet, check this out:

https://www.blackhillsinfosec.com/wp-content/uploads/2020/09/HashcatCheatSheet.v2018.1b.pdf

---

---

---

---