1. Mental Model & Architectural Core
Hashcat is the world's fastest password recovery tool, using GPU acceleration to crack hash types from NTLM and MD5 to bcrypt and Kerberos TGS. It supports dictionary attacks, rule-based mutations, brute-force mask attacks, and hybrid combinations processing billions of candidate passwords per second.
A password hash is a fingerprint. If you have someone's fingerprint, you can't reverse it back to the finger directly but you can take millions of fingers (candidate passwords), fingerprint each one in real time, and compare until you find a match. Hashcat does this with GPU parallelization at 1+ billion attempts per second.
- Crack NTLM hashes from Windows SAM dumps, NTDS.dit, or Responder captures
- Crack Kerberoast TGS hashes (etype 23, mode 13100)
- Crack AS-REP Roast hashes (mode 18200)
- Crack NetNTLMv2 challenge-response hashes captured via Responder
- Verify password policy effectiveness by testing crack rates
- secretsdump output → crack NTLM hashes against rockyou.txt + OneRuleToRuleThemAll rule
- Kerberoast TGS tickets → target RC4 (etype 23) tickets with rockyou + corporate rule sets
- NetNTLMv2 from Responder → crack with wordlist in minutes on modern GPU
Hashcat leverages OpenCL/CUDA to parallelize hash computation across GPU shader units. A single RTX 4090 can compute 300 billion MD5 hashes or 50 billion NTLM hashes per second. Rule-based attacks apply transformation rules (append numbers, capitalize first letter, l33t substitution) to each wordlist entry before hashing, exponentially expanding the candidate space from a smaller wordlist.
2. Syntax, Flags & Live Telemetry
| Flag / Option | Description |
|---|---|
| -m 1000 | Hash mode 1000 = NTLM (Windows password hash) |
| -m 13100 | Hash mode 13100 = Kerberos 5 TGS-REP etype 23 (Kerberoast) |
| -m 18200 | Hash mode 18200 = Kerberos 5 AS-REP etype 23 (AS-REP Roast) |
| -m 5600 | Hash mode 5600 = NetNTLMv2 (Responder captures) |
| -m 3200 | Hash mode 3200 = bcrypt (slow, requires patience) |
| -a 0 | Attack mode 0 = Dictionary attack (wordlist + optional rules) |
| -a 3 | Attack mode 3 = Brute-force mask attack |
| -r /usr/share/hashcat/rules/OneRuleToRuleThemAll.rule | Apply OneRule mutation rules to every wordlist entry |
| --force | Force execution even with driver warnings |
| --status | Show live cracking progress and speed during attack |
| --show | Show already-cracked hashes from potfile |
| -o cracked.txt | Save cracked passwords to output file |
| --potfile-disable | Disable potfile (re-crack known hashes) |
hashcat -m 1000 -a 0 ntlm_hashes.txt /usr/share/wordlists/rockyou.txt -r /usr/share/hashcat/rules/OneRuleToRuleThemAll.rule --force
hashcat -m 13100 -a 0 kerberoast_hashes.txt /usr/share/wordlists/rockyou.txt -r best64.rule --force
Always use OneRuleToRuleThemAll.rule for corporate password cracking it is statistically the single most effective ruleset. Then try KoreLogicRulesAppendNumSpecial, then nsa-rules. 80% of corporate passwords crack within 3 rulesets against rockyou.txt.
3. Hands-On Practice Labs & Cyber Ranges
4. Detection & Prevention Playbook
- Enforce minimum 15-character passwords with complexity requirements
- Block common passwords using Microsoft Entra Password Protection (banned password list)
- Use Argon2id or bcrypt for application passwords instead of MD5/SHA1
- Detect hash dumping events before hashes reach the cracker