Ctrlk
For the complete documentation index, see llms.txt. This page is also available as Markdown.

Hashcat

Generating hashes (printf vs echo)

When you need to generate a hash for comparison, overwriting a stored hash, or building a hash:password pair (e.g. for salted formats), use printf, not echo. echo is inconsistent and easy to get wrong:

Command
What gets hashed
SHA256 result

echo "hello"

hello + newline (6 bytes)

5891b5b5...

echo -n "hello"

hello (5 bytes) ✓

2cf24dba...

echo -n 0 "hello"

0hello (no newline)

d0023e67...

echo -n0 "hello"

0hello — -n0 is parsed as flag -n then arg 0

ec094cf2... (wrong)

printf "hello"

hello (5 bytes) ✓

2cf24dba...

Pitfall: Typing echo -n0 "hello" (thinking “no newline” + “hello”) actually hashes 0hello, so your generated hash never matches the app’s hash of "hello" and overwrite/login fails. Use printf "password" so the exact bytes are under your control.

# Correct: exact string, no newline
printf "hello" | sha256sum
# 2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824  -

# For salted formats, use the tool’s expected input (e.g. pass then salt) or hashcat to generate.

Hash Identification

# Identify hash type
hashcat --identify hash.txt

# Using hashid
hashid hash.txt

# Identify hash type and suggest hashcat mode
hashid -m '$1$FNr44XZC$wQxY6HHLrgrGX0e1195k.1'

# Using hash-identifier
hash-identifier

Common Hash Modes

Mode
Hash Type
Example Use

0

MD5

Web apps, databases

10

md5($pass.$salt)

Salted MD5 (pass first)

20

md5($salt.$pass)

Salted MD5 (salt first), CMS Made Simple

100

SHA1

Web apps

1400

SHA256

Modern apps, CrushFTP

1700

SHA512

Modern apps, CrushFTP

1800

sha512crypt ($6$)

Linux /etc/shadow

500

md5crypt ($1$)

Older Linux

1600

Apache $apr1$ MD5

.htpasswd files

3200

bcrypt ($2*$)

Modern web apps

400

phpass ($P$)

WordPress / Drupal portable PHP hashes

10900

PBKDF2-HMAC-SHA256

Flask/Werkzeug, Superset, Grafana, Mirth Connect 4.4.0+

1000

NTLM

Windows SAM/NTDS

5600

NetNTLMv2

Windows network auth

13100

Kerberos TGS-REP (etype 23)

Kerberoasting

18200

Kerberos AS-REP (etype 23)

AS-REP Roasting

5300

IKE-PSK MD5

IPsec VPN

5400

IKE-PSK SHA1

IPsec VPN

2500

WPA/WPA2

WiFi

22000

WPA-PBKDF2-PMKID+EAPOL

WiFi (modern)

13400

KeePass 1/2 (.kdbx)

Password managers

5200

Password Safe v3 (.psafe3)

Password managers

Password Safe v3 Cracking

Crack .psafe3 files directly (no extraction needed):

After cracking, open the database with passwordsafe:

.ibak files associated with Password Safe databases are also Password Safe V3 database format — check with file:

Network Device Hashes (Cisco)

Mode
Hash Type
Example

500

Cisco-IOS Type 5 ($1$)

enable secret 5 $1$salt$hash

5700

Cisco-IOS Type 4 (SHA256)

enable secret 4 hash

9200

Cisco-IOS Type 8 (PBKDF2-SHA256)

$8$salt$hash

9300

Cisco-IOS Type 9 (scrypt)

$9$salt$hash

Cisco Type 5 (MD5) Example:

Mirth Connect 4.4.0+ (PBKDF2, mode 10900): Stored hash is Base64; first 8 bytes = salt, rest = PBKDF2 output. Convert to sha256:600000:SALT_B64:HASH_B64 (salt and hash Base64-encoded, strip trailing =). See Mirth Connect for Python conversion and DB extraction.

Cisco Type 7 - NOT for hashcat! Type 7 is reversible obfuscation, not encryption:

Basic Usage

Example

Example

  • Hash f806fc5a2a0d5ba2471600758452799c

  • -a 0 sets the attack mode to a dictionary attack

  • -m 0 sets the hash mode for cracking MD5 hashes; for other types, run hashcat -h for a list of supported hashes.

  • f806fc5a2a0d5ba2471600758452799c this option could be a single hash like our example or a file that contains a hash or multiple hashes.

  • /usr/share/wordlists/rockyou.txt the wordlist/dictionary file for our attack

  • We run hashcat with --show option to show the cracked value if the hash has been cracked:

Mask Character Sets

Charset
Characters

?l

abcdefghijklmnopqrstuvwxyz

?u

ABCDEFGHIJKLMNOPQRSTUVWXYZ

?d

0123456789

?h

0123456789abcdef

?H

0123456789ABCDEF

?s

`` !"#$%&'()*+,-./:;<=>?@[]^_`{

?a

?l?u?d?s (all printable)

?b

0x00 – 0xff (all bytes)

Brute-Force / Mask Attack (-a 3)

When the password length is unknown, run incrementally — start short and increase:

Or use --increment to auto-increase length:

Hybrid Attack (-a 6 / -a 7)

Combine a wordlist with a mask. -a 6 appends the mask to each word, -a 7 prepends it.

Generating Massive Wordlists with Rules

Combine rockyou with rule files to produce mutation-expanded lists:

Reference: BlackHills Hashcat Cheatsheet

Brute-Force 4-digit PIN Example

Linux Shadow Hash Algorithm IDs

The $id$ prefix in /etc/shadow identifies the hashing algorithm:

ID
Algorithm

1

MD5

2a

Blowfish

5

SHA-256

6

SHA-512

sha1

SHA1crypt

y

Yescrypt

gy

Gost-yescrypt

7

Scrypt

Cracking DCC2 (MS Cache 2)

Cracking BitLocker (mode 22100)

Generating Mutated Wordlist

Hashcat Rule Functions

Function
Description

:

Do nothing

l

Lowercase all

u

Uppercase all

c

Capitalize first letter

sXY

Replace X with Y

$!

Append !

Cracking Linux Shadow Hashes

PreviousgobusterNextHydra User Guide

Last updated