Hashcat(1)

💖 hashcat(1) — General Commands Manual 💖

okay bestie, sit DOWN. this is the manual for hashcat, and it's lowkey the most iconic password recovery tool in the game. it's a General Commands Manual situation, so you already know it's giving official. grab a boba, we're doing this. 🧋✨

---

✨ NAME ✨

hashcat — Advanced CPU-based password recovery utility

✨ SYNOPSIS ✨

hashcat [options] hashfile [mask|wordfiles|directories]

🌸 DESCRIPTION 🌸

Hashcat is the world's fastest CPU-based password recovery tool. periodt.

Now listen — it's not as fast as its GPU counterpart oclHashcat, no cap. but if you've got large lists, you can easily split them in half with a good dictionary and a lil bit of knowledge of the command switches. it's giving resourceful. 💅

Hashcat is the self-proclaimed world's fastest CPU-based password recovery tool, and examples of hashcat-supported hashing algorithms include Microsoft LM Hashes, MD4, MD5, SHA-family, Unix Crypt formats, MySQL, and Cisco PIX. iconic lineup fr fr. 👑

---

🎀 OPTIONS 🎀

okay this is the big one. every flag, every vibe, no skips. 🫶

• -h, --help — show a summary of options. your lil cheat sheet.
• -V, --version — show the version of the program.
• -m, --hash-type=NUM — the hash-type. see the references below, bestie.
• -a, --attack-mode=NUM — the attack-mode. also in the references below.
• --quiet — suppress output. shhh. 🤫
• --force — ignore warnings. (the audacity, but okay.)
• --stdin-timeout-abort — abort if there's no input from stdin for X seconds.
• --machine-readable — display the status view in a machine-readable format.
• --keep-guessing — keep guessing the hash even after it's been cracked. obsessed with the grind.
• --self-test-disable — disable self-test functionality on startup.
• --loopback — add new plains to the induct directory.
• -b, --benchmark — run a benchmark.
• --hex-salt — assume the salt is given in hex.
• --hex-charset — assume the charset is given in hex.
• --hex-wordlist — assume the words in the wordlist are given in hex.
• --runtime=NUM — abort the session after NUM seconds of runtime.
• --status — enable automatic update of the status-screen. main character energy.
• --status-timer=NUM — seconds between status-screen updates.
• -o, --outfile=FILE — define the outfile for the recovered hash.
• --outfile-format=NUM — define the outfile-format for the recovered hash. see the references below.
• --outfile-autohex-disable — disable the use of $HEX[] in output plains.
• -p, --separator=CHAR — define the separator char for hashlists/outfile.
• --show — show cracked passwords only (see --username).
• --left — show uncracked passwords only (see --username).
• --username — enable ignoring of usernames in the hashfile. (Recommended: also use --show.)
• --remove — enable removal of the hash once it's cracked.
• --stdout — stdout mode.
• --potfile-disable — do not write the potfile.
• --debug-mode=NUM — defines the debug mode (hybrid only, by using rules). see the references below.
• --debug-file=FILE — output file for debugging rules (see --debug-mode).
• -c, --segment-size=NUM — size in MB to cache from the wordfile.
• -r, --rules-file=FILE — rules-file use: -r 1.rule
• -g, --generate-rules=NUM — generate NUM random rules.
• --generate-rules-func-min=NUM — force NUM functions per random rule minimum.
• --generate-rules-func-max=NUM — force NUM functions per random rule maximum.
• --generate-rules-seed=NUM — force the RNG seed to NUM.
• -1, --custom-charset1=CS — user-defined charsets. example: --custom-charset1=?dabcdef sets charset ?1 to 0123456789abcdef. -1 mycharset.hcchr sets charset ?1 to the chars contained in the file.
• -2, --custom-charset2=CS — user-defined charsets. example: --custom-charset2=?dabcdef sets charset ?2 to 0123456789abcdef. -2 mycharset.hcchr sets charset ?2 to the chars con$ (yes bestie, that's literally how it's written in the original, we don't question the con$)
• -3, --custom-charset3=CS — user-defined charsets. example: --custom-charset3=?dabcdef sets charset ?3 to 0123456789abcdef. -3 mycharset.hcchr sets charset ?3 to the chars con$
• -4, --custom-charset4=CS — user-defined charsets. example: --custom-charset4=?dabcdef sets charset ?4 to 0123456789abcdef. -4 mycharset.hcchr sets charset ?4 to the chars con$
• --increment — enable increment mode.
• --increment-min=NUM — start incrementing at NUM.
• --increment-max=NUM — stop incrementing at NUM.
• --markov-hcstat2 — specify the hcstat2 file to use.
• --markov-disable — disables markov-chains, emulates classic brute-force.
• --markov-classic — enables classic markov-chains, no per-position.
• -t, --markov-threshold — threshold X for when to stop accepting new markov-chains.
• --session=STR — define a specific session name.
• --restore — restore the session from --session.
• --restore-disable — do not write the restore file.
• --restore-file-path=FILE — specific path to the restore file.
• --outfile-check-timer=NUM — sets the seconds between outfile checks to X.
• --wordlist-autohex-disable — disable the conversion of $HEX[] from the wordlist.
• --remove-timer=NUM — update the input hash file each X seconds.
• --potfile-path=FILE — specific path to the potfile.
• --encoding-from=CODE — force the internal wordlist encoding from X.
• --encoding-to=CODE — force the internal wordlist encoding to X.
• --induction-dir=DIR — specify the induction directory to use for loopback.
• --outfile-check-dir=DIR — specify the outfile directory to monitor for plains.
• --logfile-disable — disable the logfile.
• --hccapx-message-pair=NUM — load only message pairs from hccapx matching X.
• --nonce-error-corrections=NUM — the BF size range to replace AP's nonce last bytes.
• --keyboard-layout-mapping=FILE — keyboard layout mapping table for special hash-modes.
• --truecrypt-keyfiles=FILE — keyfiles to use, separated with commas.
• --veracrypt-keyfiles=FILE — keyfiles to use, separated with commas.
• --veracrypt-pim=NUM — VeraCrypt personal iterations multiplier.
• --benchmark-all — run a benchmark of all hash-modes.
• --speed-only — return the expected speed of the attack, then quit.
• --progress-only — return the ideal progress step size and time to process.
• --bitmap-min=NUM — sets the minimum bits allowed for bitmaps to X.
• --bitmap-max=NUM — sets the maximum bits allowed for bitmaps to X.
• --cpu-affinity=STR — locks to CPU devices, separated with commas.
• --example-hashes — show an example hash for each hash-mode.
• -I, --opencl-info — show info about detected OpenCL platforms/devices.
• --opencl-platforms=STR — OpenCL platforms to use, separated with commas.
• -d, --opencl-devices=STR — OpenCL devices to use, separated with commas.
• -D, --opencl-device-types=STR — OpenCL device-types to use, separated with commas.
• --opencl-vector-width=NUM — manually override the OpenCL vector-width to X.
• -O, --optimized-kernel-enable — enable optimized kernels (this limits password length, jsyk 👀).
• -w, --workload-profile=NUM — enable a specific workload profile. see the pool below.
• -n, --kernel-accel=NUM — manual workload tuning: set the outerloop step size to X.
• -u, --kernel-loops=NUM — manual workload tuning: set the innerloop step size to X.
• -T, --kernel-threads=NUM — manual workload tuning: set the thread count to X.
• --spin-damp=NUM — use CPU for device synchronization, in percent.
• --hwmon-disable — disable temperature and fanspeed reads and triggers.
• --hwmon-temp-abort=NUM — abort if the temperature reaches X degrees Celsius.
• --scrypt-tmto=NUM — manually override the TMTO value for scrypt to X.
• -s, --skip=NUM — skip X words from the start.
• -l, --limit=NUM — limit X words from the start + skipped words.
• --keyspace — show keyspace base:mod values and quit.
• -j, --rule-left RULE — single rule applied to each word from the left wordlist.
• -k, --rule-right RULE — single rule applied to each word from the right wordlist.
• -S, --slow-candidates — enable slower (but advanced) candidate generators.
• --brain-server — enable the brain server.
• -z, --brain-client — enable the brain client, and it activates -S.
• --brain-client-features=NUM — define brain client features, see below.
• --brain-host=STR — brain server host (IP or domain).
• --brain-port=PORT — brain server port.
• --brain-password=STR — brain server authentication password.
• --brain-session=HEX — overrides the automatically calculated brain session.
• --brain-session-whitelist=HEX — allow given sessions only, separated with commas.

---

🦋 Permutation attack-mode options 🦋

(that's literally all it says up there, bestie — moving on, don't shoot the messenger)

💜 Outfile formats 💜

one per line, exactly as written:

1 = hash[:salt]
2 = plain
3 = hash[:salt]:plain
4 = hex_plain
5 = hash[:salt]:hex_plain
6 = plain:hex_plain
7 = hash[:salt]:plain:hex_plain
8 = crackpos
9 = hash[:salt]:crack_pos
10 = plain:crack_pos
11 = hash[:salt]:plain:crack_pos
12 = hex_plain:crack_pos
13 = hash[:salt]:hex_plain:crack_pos
14 = plain:hex_plain:crack_pos
15 = hash[:salt]:plain:hex_plain:crack_pos

🌈 Debug mode output formats 🌈

heads up: this one's for hybrid mode only, and only when you're using rules. iykyk.

1 = save finding rule
2 = save original word
3 = save original word and finding rule
4 = save original word, finding rule and modified plain

⭐ Built-in charsets ⭐

the holy grail, bestie. memorize these:

?l = abcdefghijklmnopqrstuvwxyz
?u = ABCDEFGHIJKLMNOPQRSTUVWXYZ
?d = 0123456789
?h = 0123456789abcdef
?H = 0123456789ABCDEF
?s =  !"#$%&'()*+,-./:;<=>?@[]^_`{|}~
?a = ?l?u?d?s
?b = 0x00 - 0xff

👑 Attack mode 👑

the vibes menu, fr:

0 = Straight
1 = Combination
3 = Brute-force
6 = Hybrid Wordlist + Mask
7 = Hybrid Mask + Wordlist

✨ Hash types ✨

okay bestie, gather round because this is the big one. the hash type menu. every number is a different flavor of "we're getting that password back". i'm not gonna lie, it's giving encyclopedia, but you asked for the whole thing so here's the whole thing. no skips. no cap. 💅

• 0 = MD5
• 10 = md5($pass.$salt)
• 20 = md5($salt.$pass)
• 30 = md5(unicode($pass).$salt)
• 40 = md5($salt.unicode($pass))
• 50 = HMAC-MD5 (key = $pass)
• 60 = HMAC-MD5 (key = $salt)
• 100 = SHA1
• 110 = sha1($pass.$salt)
• 120 = sha1($salt.$pass)
• 130 = sha1(unicode($pass).$salt)
• 140 = sha1($salt.unicode($pass))
• 150 = HMAC-SHA1 (key = $pass)
• 160 = HMAC-SHA1 (key = $salt)
• 200 = MySQL323
• 300 = MySQL4.1/MySQL5
• 400 = phpass, MD5(Wordpress), MD5(phpBB3), MD5(Joomla)
• 500 = md5crypt, MD5(Unix), FreeBSD MD5, Cisco-IOS MD5
• 900 = MD4
• 1000 = NTLM
• 1100 = Domain Cached Credentials (DCC), MS Cache
• 1400 = SHA256
• 1410 = sha256($pass.$salt)
• 1420 = sha256($salt.$pass)
• 1430 = sha256(unicode($pass).$salt)
• 1431 = base64(sha256(unicode($pass)))
• 1440 = sha256($salt.unicode($pass))
• 1450 = HMAC-SHA256 (key = $pass)
• 1460 = HMAC-SHA256 (key = $salt)
• 1600 = md5apr1, MD5(APR), Apache MD5
• 1700 = SHA512
• 1710 = sha512($pass.$salt)
• 1720 = sha512($salt.$pass)
• 1730 = sha512(unicode($pass).$salt)
• 1740 = sha512($salt.unicode($pass))
• 1750 = HMAC-SHA512 (key = $pass)
• 1760 = HMAC-SHA512 (key = $salt)
• 1800 = SHA-512(Unix)
• 2400 = Cisco-PIX MD5
• 2410 = Cisco-ASA MD5
• 2500 = WPA/WPA2
• 2600 = Double MD5
• 3200 = bcrypt, Blowfish(OpenBSD)
• 3300 = MD5(Sun)
• 3500 = md5(md5(md5($pass)))
• 3610 = md5(md5($salt).$pass)
• 3710 = md5($salt.md5($pass))
• 3720 = md5($pass.md5($salt))
• 3800 = md5($salt.$pass.$salt)
• 3910 = md5(md5($pass).md5($salt))
• 4010 = md5($salt.md5($salt.$pass))
• 4110 = md5($salt.md5($pass.$salt))
• 4210 = md5($username.0.$pass)
• 4300 = md5(strtoupper(md5($pass)))
• 4400 = md5(sha1($pass))
• 4500 = Double SHA1
• 4600 = sha1(sha1(sha1($pass)))
• 4700 = sha1(md5($pass))
• 4800 = MD5(Chap), iSCSI CHAP authentication
• 4900 = sha1($salt.$pass.$salt)
• 5000 = SHA-3(Keccak)
• 5100 = Half MD5
• 5200 = Password Safe SHA-256
• 5300 = IKE-PSK MD5
• 5400 = IKE-PSK SHA1
• 5500 = NetNTLMv1-VANILLA / NetNTLMv1-ESS
• 5600 = NetNTLMv2
• 5700 = Cisco-IOS SHA256
• 5800 = Android PIN
• 6300 = AIX {smd5}
• 6400 = AIX {ssha256}
• 6500 = AIX {ssha512}
• 6700 = AIX {ssha1}
• 6900 = GOST, GOST R 34.11-94
• 7000 = Fortigate (FortiOS)
• 7100 = OS X v10.8+
• 7200 = GRUB 2
• 7300 = IPMI2 RAKP HMAC-SHA1
• 7400 = sha256crypt, SHA256(Unix)
• 7900 = Drupal7
• 8400 = WBB3, Woltlab Burning Board 3
• 8900 = scrypt
• 9200 = Cisco $8$
• 9300 = Cisco $9$
• 9800 = Radmin2
• 10000 = Django (PBKDF2-SHA256)
• 10200 = Cram MD5
• 10300 = SAP CODVN H (PWDSALTEDHASH) iSSHA-1
• 11000 = PrestaShop
• 11100 = PostgreSQL Challenge-Response Authentication (MD5)
• 11200 = MySQL Challenge-Response Authentication (SHA1)
• 11400 = SIP digest authentication (MD5)
• 99999 = Plaintext

that's the whole hash type menu, bestie. every single one. no cap. 🫶

---

🦋 Specific hash type 🦋

and here's the specific hash type section, separate from the big list above. still valid, still here, still slaying. these are the special little guys. 👑

• 11 = Joomla < 2.5.18
• 12 = PostgreSQL
• 21 = osCommerce, xt:Commerce
• 23 = Skype
• 101 = nsldap, SHA-1(Base64), Netscape LDAP SHA
• 111 = nsldaps, SSHA-1(Base64), Netscape LDAP SSHA
• 112 = Oracle S: Type (Oracle 11+)
• 121 = SMF > v1.1
• 122 = OS X v10.4, v10.5, v10.6
• 123 = EPi
• 124 = Django (SHA-1)
• 131 = MSSQL(2000)
• 132 = MSSQL(2005)
• 133 = PeopleSoft
• 141 = EPiServer 6.x < v4
• 1421 = hMailServer
• 1441 = EPiServer 6.x > v4
• 1711 = SSHA-512(Base64), LDAP {SSHA512}
• 1722 = OS X v10.7
• 1731 = MSSQL(2012 & 2014)
• 2611 = vBulletin < v3.8.5
• 2612 = PHPS
• 2711 = vBulletin > v3.8.5
• 2811 = IPB2+, MyBB1.2+
• 3711 = Mediawiki B type
• 3721 = WebEdition CMS
• 7600 = Redmine Project Management Web App

---

👑 AUTHOR 👑

hashcat was written by Jens Steube <jens.steube@gmail.com> 💖

This manual page was written by Daniel Echeverry <epsilon77@gmail.com>, for the Debian project (and may be used by others).

---

and that's a wrap, bestie! source/version: Hashcat(1). date: February 20 2020. now go forth and be iconic. mwah 💋