Attack modes
TLDR
using a word list
hashcat -a 0 -m 0 hashes.txt wordlist.txt
using two word lists
hashcat -a 1 -m 0 hashes.txt words1.txt words2.txt
try every combination of characters
hashcat -a 3 -m 0 hashes.txt
limit attempts to 8 character lower case words
hashcat -a 3 -m 0 hashes.txt ?l?l?l?l?l?l?l?l
add a digit mask to the end of the word from a word list
hashcat -a 6 hashes.txt wordlist.txt ?d
-a 0
Try every word in the word list is used to guess the hash
# hashes.txt contains the list of hashes
# wordlist.txt contains list of words
# -a 0 specify the attack type
# -m 0 specify the hash type (md5)
hashcat -a 0 -m 0 hashes.txt wordlist.txt
-a 1
Create words from two word lists by combining them
# words1.txt and words2.txt contains words
# which will be used to create new words
# if words1 contains cat and
# words2 contains dog
# hashcat will create a word: catdog
hashcat -a 1 -m 0 hashes.txt words1.txt words2.txt
-a 3
Hashcat will try every combination of characters to crack the hash
# hashes.txt contains the list of hashes
# -a 3 specify a brute force attack
# -m 0 specify the hash type (md5)
hashcat -a 3 -m 0 hashes.txt
-a 3 with masks
If you know a word is exactly 8 characters long and contains only lower case alphabetical characters, you can specify a mask such as:
?l?l?l?l?l?l?l?l
This will reduce the search space
The full list of character masks is below
?l = abcdefghijklmnopqrstuvwxyz
?u = ABCDEFGHIJKLMNOPQRSTUVWXYZ
?d = 0123456789
?h = 0123456789abcdef
?H = 0123456789ABCDEF
?s = «space»!"#$%&'()*+,-./:;<=>?@[\]^_`{|}~
?a = ?l?u?d?s
?b = 0x00 – 0xff
an example with hashcat
hashcat -a 3 -m 0 hashes.txt ?l?l?l?l?l?l?l?l
-a 6
generate words from a mask and append them to the word list
if we have a word
cat
and we use the command
hashcat -a 6 hashes.txt wordlist.txt ?d
hashcat will generate words such as
cat0
cat1
cat2
...
cat9
-a 7
same as -a 6 but adds the mask in front of the word 0cat etc.
Rules
Read the rules page on hashcats website
Hash modes
Read about hash modes on hashcats website