performing-hash-cracking-with-hashcat

Identify the hash type first, then select the matching Hashcat mode number and an attack mode such as dictionary (-a 0), brute-force mask (-a 3), or rule-based (-a 0 -r). Run the attack with a wordlist and rules, then analyze which passwords were recovered.

Match the hash length and character set against known formats: MD5 is 32 hex chars, NTLM is 32 hex chars from Windows, sha512crypt starts with $6$, and bcrypt starts with $2. Each maps to a specific Hashcat mode number such as 0, 1000, 1800, or 3200.

Use rule-based attacks (-a 0 -r) that apply transformation rules to a dictionary for policy-compliant variations, or hybrid modes (-a 6/7) that append masks to wordlist entries for passwords ending in numbers.

Yes, Hashcat supports bcrypt (mode 3200) and Kerberos TGS-REP (mode 13100) among over 300 hash types. Bcrypt is intentionally slow, so expect much lower cracking rates than fast hashes like MD5 or NTLM.

Hash cracking is only legal with explicit written authorization, such as a penetration testing engagement or internal password audit. All captured hash data must be secured, results reported to asset owners, and cracked passwords destroyed after the engagement.