https://github.com/hashcat/hashcat
Attack Types
Attack (-a 0)
hashcat -a 0 -m 0 “myHash” /usr/share/wordlists/rockyou.txtDictionary attack.
Attack (-a 1)
https://hashcat.net/wiki/doku.php?id=combinator_attack
hashcat -a 1 -m 0 "myHash" myPrefix.txt /usr/share/wordlists/rockyou.txtDictionary attack with a prefix.
Attack (-a 3)
https://hashcat.net/wiki/doku.php?id=mask_attack
Jokers
?labcdefghijklmnopqrstuvwxyz
?uABCDEFGHIJKLMNOPQRSTUVWXYZ
?d0123456789
?h0123456789abcdef
?H0123456789ABCDEF
?s«space»!"#$%&'()*+,-./:;<=>?@[]^_`{|}~
?a?l?u?d?s
?b0x00 - 0xff
Examples
hashcat -a 3 -m 0 "myHash" ?l?l?l?lBrute force from aaaa to zzzz.
hashcat -a 3 -m 0 "myHash" "passBegining?l?l?l?l"Brute force from passBeginingaaaa to passBeginingzzzz.
Flags
-aAttack mode (ex: 0 = straight dictionary list).
-mHashing type (ex: 1800 = MD5).
-o myOutFileStore output info in myFile.
Hash Types
https://hashcat.net/wiki/doku.php?id=example_hashes
-m 0MD5.
-m 500MD5crypt, MD5 (Unix), Cisco-IOS.
-m 1800SHA256 Unix.
-m 1000NTLM.
hashcat -a 0 -m 5600 myHashes.txt /usr/share/wordlists/rockyou.txtCrack NetNTMLv2 hashes.
hashcat -a 0 -m 1100 0 '15a57c379ebdfea572ad1ff91eb6ef0c:Administrator' /usr/share/wordlists/rockyou.txtCrack DCC (Domain Cached Credentials) hash.
-m 2100MS Cache - DCC2 (Domain Cached Credentials 2).
hashcat -a 0 -m 13100 myHash.txt /usr/share/wordlists/rockyou.txtCrack Kerberos KRB_TGS_REP hash.
-m 13000RAR.
zip2john myFile.zip > forhashcat.txtRemove name of the file and archive from the hash (at the beginning and the end).
hashcat -a 0 -m 13600 forhashcat.txt /usr/share/wordslist/rockyou.txtCrack ZIP archive password.