Skip to main content
GPU-accelerated password cracker. Commands below are ready to copy: swap in your hash file and wordlist path, then run.

​
Quick Mode Reference

ModeHash TypeWhere You Get It
0MD5Web apps, databases
100SHA1Web apps, Git
1400SHA256Web apps
1700SHA512Web apps
1800sha512crypt $6$Linux /etc/shadow
500md5crypt $1$Linux /etc/shadow (old)
7400sha256crypt $5$Linux /etc/shadow
3200bcrypt $2*$Web apps, Linux
1000NTLMSAM, NTDS.dit, secretsdump output
5500NetNTLMv1Responder
5600NetNTLMv2Responder, Inveigh
2100DCC2 / mscash2Cached domain creds (secretsdump)
13100Kerberoast RC4 ($krb5tgs$23$)GetUserSPNs, Rubeus, nxc
19600Kerberoast AES128 ($krb5tgs$17$)GetUserSPNs, Rubeus
19700Kerberoast AES256 ($krb5tgs$18$)GetUserSPNs, Rubeus
18200AS-REP ($krb5asrep$23$)GetNPUsers, Rubeus, nxc
19000Kerberos TGT AES128Rubeus
19100Kerberos TGT AES256Rubeus
7300IPMI2 RAKPResponder IPMI
22000WPA2 PMKID/handshakehcxdumptool
16500JWTWeb tokens
116007-ZipEncrypted archives
13600WinZipEncrypted archives
5200Password Safe v3 .psafe3Password manager databases
300MySQL4+MySQL PASSWORD()
1731MSSQL 2012/2014SQL Server sys.sql_logins
12PostgreSQLPostgreSQL MD5

​
Windows / Active Directory

These are the most commonly encountered hashes in AD engagements.

​
NTLM

Extracted from SAM hives, NTDS.dit, or secretsdump output. Format: username:RID:LMhash:NThash:::: crack only the NT hash (right side of the last colon). 
# Wordlist
hashcat -m 1000 ntlm.txt ~/tools/wordlists/rockyou

# Wordlist + rules (covers most real-world AD passwords)
hashcat -m 1000 ntlm.txt ~/tools/wordlists/rockyou -r /usr/share/hashcat/rules/best64.rule

# Company name + year pattern brute force
hashcat -m 1000 ntlm.txt -a 3 Company?d?d?d?d!
hashcat -m 1000 ntlm.txt -a 3 Company?u?l?l?l?d?d?d?d?s

# Incremental mask (Season+Year pattern common in AD)
hashcat -m 1000 ntlm.txt -a 3 ?u?l?l?l?l?d?d?d?d

​
NetNTLMv2

Captured via Responder or Inveigh. Cannot be passed directly (must crack to plaintext). 
# Wordlist
hashcat -m 5600 netntlmv2.txt ~/tools/wordlists/rockyou

# Wordlist + rules
hashcat -m 5600 netntlmv2.txt ~/tools/wordlists/rockyou -r /usr/share/hashcat/rules/best64.rule
hashcat -m 5600 netntlmv2.txt ~/tools/wordlists/rockyou -r /usr/share/hashcat/rules/OneRuleToRuleThemAll.rule

​
NetNTLMv1

Older protocol, weaker than v2. If you capture one, also try ntlmv1-multi to pre-compute via crack.sh. 
hashcat -m 5500 netntlmv1.txt ~/tools/wordlists/rockyou
hashcat -m 5500 netntlmv1.txt ~/tools/wordlists/rockyou -r /usr/share/hashcat/rules/best64.rule

​
Kerberoast

RC4 (mode 13100) is always worth trying first: weaker encryption and fastest to crack. If the account only issues AES tickets, use 19700. 
# RC4 TGS (most common)
hashcat -m 13100 kerberoast.txt ~/tools/wordlists/rockyou
hashcat -m 13100 kerberoast.txt ~/tools/wordlists/rockyou -r /usr/share/hashcat/rules/best64.rule

# AES128 TGS
hashcat -m 19600 kerberoast.txt ~/tools/wordlists/rockyou
hashcat -m 19600 kerberoast.txt ~/tools/wordlists/rockyou -r /usr/share/hashcat/rules/best64.rule

# AES256 TGS
hashcat -m 19700 kerberoast.txt ~/tools/wordlists/rockyou
hashcat -m 19700 kerberoast.txt ~/tools/wordlists/rockyou -r /usr/share/hashcat/rules/best64.rule

​
AS-REP Roast

Hashes from accounts with pre-authentication disabled. Same cracking approach as Kerberoast but mode 18200. 
hashcat -m 18200 asrep.txt ~/tools/wordlists/rockyou
hashcat -m 18200 asrep.txt ~/tools/wordlists/rockyou -r /usr/share/hashcat/rules/best64.rule
hashcat -m 18200 asrep.txt ~/tools/wordlists/rockyou -r /usr/share/hashcat/rules/OneRuleToRuleThemAll.rule

​
DCC2 / mscash2

Cached domain credentials stored locally when a DC is unreachable. Very slow to crack: use a targeted wordlist. 
# Slow: use focused wordlist, not full rockyou unless you have a GPU farm
hashcat -m 2100 dcc2.txt ~/tools/wordlists/rockyou
hashcat -m 2100 dcc2.txt company_words.txt -r /usr/share/hashcat/rules/best64.rule

​
Linux

Linux shadow hashes from /etc/shadow. Match the $id$ prefix to pick the right mode. 
# sha512crypt $6$ (most modern systems)
hashcat -m 1800 shadow.txt ~/tools/wordlists/rockyou
hashcat -m 1800 shadow.txt ~/tools/wordlists/rockyou -r /usr/share/hashcat/rules/best64.rule

# sha256crypt $5$
hashcat -m 7400 shadow.txt ~/tools/wordlists/rockyou

# md5crypt $1$ (older systems)
hashcat -m 500 shadow.txt ~/tools/wordlists/rockyou

# bcrypt $2b$ / $2y$ (slow; use short targeted list)
hashcat -m 3200 shadow.txt ~/tools/wordlists/rockyou

​
Web Application Hashes

Common hashes from database dumps. MD5 and SHA1 crack fast; bcrypt requires targeted wordlists. 
# MD5
hashcat -m 0 hashes.txt ~/tools/wordlists/rockyou
hashcat -m 0 hashes.txt ~/tools/wordlists/rockyou -r /usr/share/hashcat/rules/best64.rule

# SHA1
hashcat -m 100 hashes.txt ~/tools/wordlists/rockyou

# SHA256
hashcat -m 1400 hashes.txt ~/tools/wordlists/rockyou

# SHA512
hashcat -m 1700 hashes.txt ~/tools/wordlists/rockyou

# bcrypt (slow: targeted list only)
hashcat -m 3200 hashes.txt ~/tools/wordlists/rockyou

​
Database Hashes

# MySQL 4+
hashcat -m 300 mysql.txt ~/tools/wordlists/rockyou

# MSSQL 2012 / 2014
hashcat -m 1731 mssql.txt ~/tools/wordlists/rockyou

# PostgreSQL MD5
hashcat -m 12 pg.txt ~/tools/wordlists/rockyou

​
Other

# JWT (crack the signature secret)
hashcat -m 16500 jwt.txt ~/tools/wordlists/rockyou

# WPA2 handshake (convert cap to hccapx with hcxtools first)
hashcat -m 22000 handshake.hc22000 ~/tools/wordlists/rockyou

# 7-Zip archive
hashcat -m 11600 archive.txt ~/tools/wordlists/rockyou

# WinZip archive
hashcat -m 13600 archive.txt ~/tools/wordlists/rockyou

# Password Safe v3 (.psafe3), potfile disabled for this mode, use -o to save results
hashcat -m 5200 db.psafe3 ~/tools/wordlists/rockyou -o cracked.txt
hashcat -m 5200 db.psafe3 ~/tools/wordlists/rockyou -r /usr/share/hashcat/rules/best64.rule -o cracked.txt

​
Attack Modes

Beyond wordlists, use rules for mangled passwords and masks when you know the pattern. 
# -a 0: wordlist (default)
hashcat -m 1000 hash.txt ~/tools/wordlists/rockyou

# -a 0 with rules: covers capitalization, l33t, appended digits
hashcat -m 1000 hash.txt ~/tools/wordlists/rockyou -r /usr/share/hashcat/rules/best64.rule
hashcat -m 1000 hash.txt ~/tools/wordlists/rockyou -r /usr/share/hashcat/rules/OneRuleToRuleThemAll.rule

# -a 3: mask brute force
hashcat -m 1000 hash.txt -a 3 ?u?l?l?l?l?d?d?d?d   # Typical AD pattern
hashcat -m 1000 hash.txt -a 3 Company?d?d?d?d!       # Company name + year + special
hashcat -m 1000 hash.txt -a 3 ?u?l?l?l?l?l?l?d?d    # 8-char with trailing digits

# -a 6: wordlist + mask (append mask to each word)
hashcat -m 1000 hash.txt -a 6 ~/tools/wordlists/rockyou ?d?d?d?d   # word + 4 digits

# -a 7: mask + wordlist (prepend mask)
hashcat -m 1000 hash.txt -a 7 ?d?d?d?d ~/tools/wordlists/rockyou

​
Mask Charset Reference

?l  lowercase a-z
?u  uppercase A-Z
?d  digit 0-9
?s  special !"#$%&'()*+,-./:;<=>?@[\]^_{|}~
?a  all printable (?l?u?d?s)
?h  hex lowercase 0-9a-f
?H  hex uppercase 0-9A-F

​
Useful Flags

--show              # Print already-cracked hashes from potfile
--username          # Strip username from hash:user format (secretsdump output)
-O                  # Optimized kernels (faster, slight rule coverage tradeoff)
-w 3                # Workload profile: 1=low, 2=default, 3=high, 4=nightmare
--status            # Print status every N seconds
--status-timer 10   # Set status interval to 10s
-o cracked.txt      # Write cracked plaintexts to file
--potfile-path pot  # Use a custom potfile instead of default hashcat.potfile

​
Identify a Hash

When you are unsure of the type, use hashid or name-that-hash before picking a mode. 
hashid '$6$rounds=5000$salt$hash'   # identifies sha512crypt
name-that-hash -t '$krb5tgs$23$*'  # identifies Kerberoast RC4