How to use hashcat - Technical Sharing

There are four basic ways to decrypt hashcat:
1. Dictionary Decrypt

2. Combine string Decrypt

3. BruteDecrypt (Deprecated) – mask attack(maskDecrypt)
4. Hybrid decryption
There are also rule-based decryption methods, and case-switching methods, which can be classified as rules. decryption

dictionary decryption

-a 0 -m type hashfile dictionary1 dictionary2
It seems that gpu acceleration can also be used.

Combining strings decryption

If the contents of the dictionary are like this
11
22
33

, then the resulting combination is:
1111
1122
1133
2222
2233
3333

Specify the characters on the left or right

       

    -k,  --rule-right=rule             Single rule applied to each Word on the right dictionary123

For example:
Dictionary 1:

    11 
    2212

Dictionary 2:

    33 
    4412

commands:

    -j '$-' 
    -k '! The Word in the $ proxy dictionary above $'12

, -j '$-' means adding a -, -k '$ to the right of the Word! ' means to add one to the left of the Word!
So the resulting combination is:

    11-33! 
    22-33! 
    11-44! 
    22-44! The official explanation for 1234

Mask Attack

is relatively simple: mask attacks are stronger than brute-force in reducing the number of password tables. The algorithm for reducing the number of passwords is not explained in detail (based on the hcmask file), only simply mentioning that it uses some conventional password forms to reduce the number of passwords. For example: "Kele1997" will list all possibilities when brute-force decrypting , etc. However, during a mask attack, the program will try to capitalize only the first letter because most passwords rarely have a capital letter in the second or third position. These rules reduce the number of password candidates.

Officially, mask attacks have no disadvantages compared to brute-force passwords because they can generate all brute-force passwords.

Charset character set

Built-in character set 
? l = abcdefghijklmnopqrstuvwxyz 
? u = ABCDEFGHIJKLMNOPQRSTUVWXYZ 
? d = 0123456789 
? h = 0123456789abcdef 
? H = 0123456789ABCDEF 
? s = "space"! "#$%&'()*+,-./:; <=>? @[\]^_`{|}~ 
? A   =  ? l? He? d? s 
? b = 
0 - 0xff123456789

The program directory contains charsets containing various strange characters. If you have them in your password, you can use these files.

hashcat has four parameters to specify a custom character set:
–custom-charset1=CS
–custom-charset2=CS
–custom-charset3=CS
–custom-charset4=CS
. These four parameters can be replaced with the abbreviations -1, -2, -3, and -4. You can specify a custom character set for decryption

The following command sets the first custom charset (-1) to Russian language specific chars:
-1 charsets/special/Russian/ru_ISO-8859-5-special.hcchr

Password length increment

We don't need to specify a fixed password length; we can specify the – increment parameter to

  -i,  --increment                |      | Enable mask increment mode                           |              | Num  | Stop mask incrementing at X                   123

Hashcat mask files

-a 3 hash.txt mask_file.hcmask  Load the hcmask file and use the mask in the file to decrypt

hashcat comes with several hcmask files, which are placed under the program directory mask/

The string following the hex character

-- hex-charset   is 16.

Mix Decrypt

The password generated is a combination of characters generated by a dictionary and brute force Decrypt
For example: example.dict

         password 
    hello12

hashcat64 -a 6 example.dict ? d? d? d? d
? d? d? d? d represents a four-bit integer
, so the final generated password candidate sequence is:

    password0000 
    password0001 
    password0002 
    . 
    . 
    . 
    password99991234567

hashcat64 -a 6 ? d? d? d? d example.dict
Result:

0000password 
0001password 
. 
. 
. 
9999password123456

Using rules to emulate Hybrid attackDecrypt 

Using maskprocessor to exploit rules to generate brute forceDecryptThe rules required, and then the generated rule file can be loaded Using hashcat -r and mixed into password candidates Using a dictionary
For example: example.dict

hello 
password12

hash -o bf.rule '$? d $? d $? d $? The rule generated by d

looks like this: bf.rule

$0 $0 $0 $0 
$0 $0 $0 $1 
$0 $0 $0 $2 
$0 $0 $0 $3 
$0 $0 $0 $4 
. 
. 
. 
$9 $9 $9 $9123456789

Then use hashcat -a 6 example.dict -r bf.rule -m ....
The final result looks like this:

    hello0 0 0 0 
    password0 0 0 0 
    hello0 0 0 1 
    password0 0 0 1 
    hello0 0 0 2 
    password0 0 0 2 
    . 
    . 
    . 
    hello9 9 9 9 
    password9 9 9 91234567891011