Dictionary Attacks with Hashcat
Hashcat is the world's fastest password cracker, capable of testing billions of hash candidates per second using GPU acceleration. You will learn how to identify hash types, configure Hashcat for different attack modes, and use wordlists like rockyou.txt to crack real password hashes. Dictionary attacks succeed because most users choose passwords that appear in common wordlists.
Learning Objectives — Deep Dive
Each objective below is broken down into plain English so you know exactly what you are learning, why it matters, and what you will be able to do when you are done. Mark each one complete as you work through the lesson.
Identify the hash type
Take the hash you want to crack and run it through 'hashid <hash>' or paste it into the online tool at hashes.com/en/tools/hash_identifier. For a hash starting with '$6$', hashid will identify it as SHA-512-crypt (sha512crypt). For a plain 32-character hex string, it will suggest MD5, MD4, or NTLM as possibilities — you will need additional context (such as where the hash came from) to determine which one is correct. Misidentifying the hash type is the most common reason a cracking session produces zero results, so always verify before committing to a long run.
Find the Hashcat mode number
Visit hashcat.net/wiki/doku.php?id=hashcat and search for your hash type in the 'Hash modes' table, or run 'hashcat --help | grep -i <algorithm>' to search the built-in help. Common modes you will use frequently: 0 (MD5), 100 (SHA-1), 1000 (NTLM), 1800 (sha512crypt), 3200 (bcrypt), 5500 (NetNTLMv1), 5600 (NetNTLMv2). Write down the mode number before starting your session — you cannot change it mid-run. If you are unsure between two similar modes, check the 'Example Hashes' page and compare your hash format against the provided examples.
Run a dictionary attack
Run 'hashcat -m 1800 -a 0 hash.txt /usr/share/wordlists/rockyou.txt' to attempt a dictionary attack against a SHA-512-crypt hash. The -m flag specifies the hash mode, -a 0 specifies dictionary attack mode, hash.txt contains your target hash, and rockyou.txt is the wordlist. Hashcat will display the cracking speed (H/s), estimated time remaining, and recovered hashes as it finds them. If rockyou.txt does not crack the hash, try larger wordlists from SecLists (github.com/danielmiessler/SecLists) or generate a custom wordlist with CeWL from the target's website.
Add rules
Run 'hashcat -m 1800 -a 0 hash.txt /usr/share/wordlists/rockyou.txt -r /usr/share/hashcat/rules/best64.rule' to apply the best64 ruleset, which applies 64 common password transformations to each word in the wordlist. Rules can capitalize the first letter, append numbers, substitute letters with symbols (l33tspeak), and hundreds of other transformations — dramatically expanding the effective wordlist size without storing all variants on disk. The OneRuleToRuleThemAll.rule (available on GitHub) is a community-curated ruleset that covers the most common real-world password patterns and is worth adding to your toolkit.
Show cracked passwords
Run 'hashcat -m 1800 hash.txt --show' to display all previously cracked hashes and their plaintext passwords from Hashcat's potfile (the cache of cracked hashes stored at ~/.hashcat/hashcat.potfile). The potfile means you never need to re-crack a hash you have already cracked — Hashcat checks it automatically at the start of every session. Run 'cat ~/.hashcat/hashcat.potfile' to see all hashes you have ever cracked. In a penetration test, document each cracked password with its hash, the plaintext, the account it belongs to, and the technique used to crack it.