Hashcat Tutorial: Cracking Password Hashes Step by Step

Hashcat is widely considered the fastest and most versatile password recovery tool available today, built specifically to take advantage of GPU acceleration across a massive range of hash types. Where CPU-based tools eventually hit a performance ceiling against large or complex password sets, Hashcat's architecture makes it the standard choice for professional password audits, penetration testing, and forensic recovery work.

This tutorial walks through installing Hashcat, identifying hash types, running your first cracking session, and progressing to advanced attack modes like combinator and rule-based attacks, all in the context of authorized security testing. SageFox Cybersecurity relies on Hashcat as part of internal password audits and authorized engagements, and this guide reflects the practical workflow we use with clients.

What Is Hashcat and Why It Matters for Security Testing

GPU Acceleration as the Core Advantage

Hashcat's primary strength is its ability to leverage GPU compute power, which can process billions of hash guesses per second depending on hardware, compared to the far more limited throughput of CPU-only tools. For organizations conducting internal password policy audits, this speed difference is the reason a realistic assessment of password strength is even feasible at scale.

Legal and Ethical Use Only

Password cracking must only be performed against systems and accounts you own or have explicit written authorization to test. Running these techniques against systems without permission is illegal in most jurisdictions. If your organization needs a structured, authorized password audit, SageFox Cybersecurity's assessment team at www.sagefoxusa.com can help scope and run this safely.

Installing Hashcat

Installing on Linux

Hashcat is available directly through most package managers, though installing the latest release from the official binaries ensures access to the newest hash mode support:

bash

sudo apt update
sudo apt install hashcat -y
hashcat --version

For the latest release with expanded hash mode coverage:

bash

wget https://hashcat.net/files/hashcat-6.2.6.7z
7z x hashcat-6.2.6.7z
cd hashcat-6.2.6

Confirming GPU Detection

Before running any cracking session, confirm Hashcat can see your GPU hardware correctly:

bash

hashcat -I

If no compatible device is detected, verify your GPU drivers and OpenCL or CUDA runtime are properly installed, since Hashcat's performance advantage depends entirely on this being configured correctly.

Understanding Hash Modes Before You Start

Identifying the Correct Hash Type

Hashcat requires you to specify a numeric mode corresponding to the exact hash type you are targeting. Guessing incorrectly will produce no results even if the password exists in your wordlist. Identifying an unknown hash:

bash

hashid '$2y$10$examplehashvaluehere'

This example, prefixed with $2y$, indicates a bcrypt hash, which corresponds to Hashcat mode 3200.

Common Hash Modes Referenced in Testing

A few modes come up repeatedly in real-world audits:

• Mode 0: raw MD5
• Mode 1000: Windows NTLM
• Mode 1800: sha512crypt, common on modern Linux systems
• Mode 3200: bcrypt
• Mode 13100: Kerberos 5 TGS-REP, used in Kerberoasting-style credential testing

Extracting Hashes for Testing

On a Linux system you are authorized to test, combining passwd and shadow files into a crackable format:

bash

sudo unshadow /etc/passwd /etc/shadow > combined_hashes.txt

For Windows environments, NTLM hashes extracted from an authorized test domain controller can be exported using a credential dumping utility appropriate to your engagement scope, then formatted for Hashcat processing.

Running Your First Cracking Session

Basic Dictionary Attack

The most straightforward starting point is a dictionary attack, referred to in Hashcat as attack mode 0:

bash

hashcat -m 1800 -a 0 combined_hashes.txt /usr/share/wordlists/rockyou.txt

Here, -m 1800 specifies the sha512crypt hash mode, and -a 0 specifies a straight dictionary attack.

Viewing Cracked Results

Cracked passwords are stored automatically and can be reviewed at any time without rerunning the session:

bash

hashcat -m 1800 combined_hashes.txt --show

Monitoring Session Progress

While a session runs, pressing the s key displays a live status update including guesses per second, estimated time remaining, and current progress, which is useful for tracking longer audits against large hash sets.

Advanced Attack Modes for Better Results

Rule-Based Attacks

Real passwords rarely appear exactly as written in a wordlist. Hashcat's rule engine simulates common human modifications like appending numbers or capitalizing the first letter:

bash

hashcat -m 1000 -a 0 windows_hashes.txt /usr/share/wordlists/rockyou.txt -r rules/best64.rule

Applying a solid rule set to a modest wordlist consistently outperforms a much larger wordlist used without rules, since it targets realistic human password behavior directly.

Combinator Attacks

A combinator attack merges two wordlists together, useful for testing passwords built from combined words, a common pattern in corporate environments:

bash

hashcat -m 0 -a 1 md5_hashes.txt wordlist1.txt wordlist2.txt

Mask Attacks for Known Password Structures

When you know something about the expected password structure, such as a company policy requiring a specific length and character composition, a mask attack targets that pattern directly:

bash

hashcat -m 1000 -a 3 windows_hashes.txt '?u?l?l?l?l?l?d?d?d'

This mask targets an uppercase letter followed by five lowercase letters and three digits, a structure surprisingly common where password policies enforce only basic complexity requirements.

Hybrid Attacks

Hybrid mode combines a wordlist with a mask, useful for testing passwords built from a base word plus a predictable suffix, such as a year or a symbol pattern:

bash

hashcat -m 1000 -a 6 windows_hashes.txt /usr/share/wordlists/rockyou.txt '?d?d?d?d'

Auditing Organizational Password Strength

Running a Controlled Active Directory Audit

Hashcat is frequently used defensively to measure how many accounts in an organization would fall to a realistic attack. Extracting NTLM hashes from a test Active Directory environment and running a rule-based attack provides concrete data:

bash

hashcat -m 1000 -a 0 ad_hashes.txt /usr/share/wordlists/rockyou.txt -r rules/best64.rule --potfile-path=ad_audit.pot

Reporting Results to Leadership

Tracking the percentage of accounts cracked within a defined time window, for example two hours on a standard GPU rig, gives leadership a concrete, defensible metric for password policy risk. Organizations running this kind of audit for the first time are often surprised at how quickly a meaningful percentage of accounts fall using nothing more than a public wordlist and a common rule set. If you want this audit run and reported professionally rather than as a self-guided exercise, www.sagefoxusa.com can scope and execute this safely within your environment.

Optimizing Performance

Benchmarking Your Hardware

Before committing to a long-running session, benchmark your setup against common hash modes to estimate realistic completion times:

bash

hashcat -b -m 1000

Tuning Workload Profiles

Hashcat allows workload tuning to balance cracking speed against system responsiveness, particularly important if the machine is also being used for other tasks during a long audit:

bash

hashcat -m 1000 -a 0 windows_hashes.txt /usr/share/wordlists/rockyou.txt -w 3

Higher workload values prioritize cracking speed at the cost of system responsiveness, and should generally be reserved for dedicated audit hardware rather than a shared workstation.

Common Mistakes to Avoid

Specifying the Wrong Hash Mode

An incorrect mode number is the most frequent reason a session produces no results even against a weak password. Always verify the hash format before launching a full session.

Ignoring Session Restore Capability

Long-running sessions against large hash sets can be interrupted. Hashcat supports session naming and restore specifically for this reason:

bash

hashcat -m 1000 -a 0 windows_hashes.txt /usr/share/wordlists/rockyou.txt --session=ad_audit --restore

Failing to use named sessions on multi-hour audits means losing all progress if the process is interrupted unexpectedly.

Skipping Documentation and Authorization

Even in a personal lab environment, documenting scope and authorization for every cracking exercise builds the discipline required for professional engagements, where scope violations carry real legal and contractual consequences.

Wrapping Up

Hashcat's speed and flexibility make it the standard tool for serious password security testing, whether you are learning the fundamentals of offensive security or running a defensive audit of your own organization's password policy. Progressing from basic dictionary attacks through rule-based, mask, and hybrid techniques mirrors the actual workflow professional testers rely on, and understanding this process makes it far easier to justify investment in multi factor authentication and stronger password policies to leadership.

If your organization wants a professional, authorized password audit rather than a self-guided exercise, SageFox Cybersecurity can help design and execute that assessment safely. Visit www.sagefoxusa.com to learn more about our password security and penetration testing services.