🔥 How to Crack Passwords Using Hashcat

Hashcat is a powerful password-cracking tool that supports GPU acceleration for faster brute-force attacks. Here’s a step-by-step guide to using Hashcat for password cracking.

---

🛠 1. Install Hashcat

📌 Windows

1️⃣ Download Hashcat from 🔗 https://hashcat.net/hashcat/
2️⃣ Extract the ZIP file
3️⃣ Open Command Prompt (cmd) and navigate to the Hashcat folder

sh
cd path\to\hashcat

📌 Linux (Kali, Ubuntu)

sh
sudo apt update && sudo apt install hashcat -y

📌 macOS

sh
brew install hashcat

---

🔍 2. Identify the Hash Type

Before cracking, you need to determine the hash type.
You can use Hash-Identifier or check online 🔗 https://hashcat.net/wiki/doku.php?id=example_hashes.

Common Hash Types & Their Modes in Hashcat

Hash Type	Example	Mode ID
MD5	5f4dcc3b5aa765d61d8327deb882cf99	0
SHA-1	b3d44e29c9f5b89b507cfd9c72eac5f1eecfd567	100
SHA-256	9e107d9d372bb6826bd81d3542a419d6	1400
NTLM	32ed87bdb5fdc5e9cba88547376818d4	1000
bcrypt	$2a$12$wJr8UjhRzLXG4N7Mi.YE/O.	3200

You can also use Hashcat's built-in hash identifier:

sh
hashcat --help | grep -i "your hash type"

---

🔑 3. Crack the Password

📌 Step 1: Save the Hash

Create a text file (hash.txt) and paste the hash inside:

sh
echo "5f4dcc3b5aa765d61d8327deb882cf99" > hash.txt

📌 Step 2: Choose an Attack Mode

Hashcat supports different attack types:

• Dictionary Attack (Wordlist) → -a 0

• Brute-force Attack → -a 3

• Mask Attack → -a 3

• Hybrid Attack → -a 6 (Dictionary + Mask)

• Combinator Attack → -a 1

🔹 Option 1: Dictionary Attack (Fastest)

If you have a wordlist like rockyou.txt, use:

sh
hashcat -m 0 -a 0 hash.txt /usr/share/wordlists/rockyou.txt --force

💡 Replace -m 0 with your hash type mode ID.

🔹 Option 2: Brute-Force Attack (Slow but Effective)

If the password is unknown, try all possible character combinations:

sh
hashcat -m 0 -a 3 hash.txt ?a?a?a?a?a?a

• ?a → Any character (letters, numbers, symbols)

• ?l → Lowercase letters

• ?u → Uppercase letters

• ?d → Digits

• ?s → Special characters

Example: Crack a 6-character password with numbers & letters:

sh
hashcat -m 0 -a 3 hash.txt ?l?l?l?d?d?d

🔹 Option 3: Mask Attack (Partial Known Info)

If you know the password format (e.g., starts with "admin" and ends with numbers):

sh
hashcat -m 0 -a 3 hash.txt admin?d?d?d?d

---

🚀 4. Optimize Hashcat Performance

📌 Enable GPU Acceleration

sh
hashcat -m 0 -a 0 hash.txt rockyou.txt --force --opencl-device-types 1,2

• --force → Forces Hashcat to run

• --opencl-device-types 1,2 → Uses CPU + GPU

📌 Run Hashcat on Multiple Threads

sh
hashcat -m 0 -a 3 hash.txt ?a?a?a?a?a --threads=8 --force

📌 Use a Session (Resume Cracking Later)

Start cracking:

sh
hashcat -m 0 -a 3 hash.txt ?a?a?a?a?a --session=mySession

Pause and resume later:

sh
hashcat --session=mySession --restore

---

🛑 5. Stop Hashcat & Check Results

Stop Hashcat anytime using:

sh
Ctrl + C

Check cracked passwords:

sh
hashcat --show -m 0 hash.txt

---

⚠️ Legal Disclaimer

❌ Cracking passwords without permission is illegal. This guide is for educational & ethical hacking purposes only.