Hashcat cracking mode parameter settings tutorial (very detailed and practical information, worth saving)

I. Combination Mode (-A 1)

Sometimes we encounter problems like this. For example, the password is in the abcdabcd pattern, but there is no abcdabcd in our dictionary. If we generate it, it will take up a lot of space. Is there a way to generate abcdabcd using abcd? In hashcat, it is certainly possible. In this section, we will first talk about this pattern, namely the dictionary combination attack pattern (the parameter is denoted as -a 1).

1. Combination pattern of the same dictionary

First, we will describe the meaning of -a 1 through a simple example, and then take you step by step to the complex application of this pattern.

hashcat –a 1 –m 0 mima.txt –o outfile dic.txt dic.txt

This command means to use dic.txt This dictionary is combined to decipher mima.txt. If dic.txt is the dictionary

as shown in the figure below, then the new dictionary for deciphering mima.txt formed by this command is:

. That is, each line in dic.txt is combined with itself to form a new dictionary.

2. Combination mode of different dictionaries

The previous introduction was about combining the same dictionary. If they are different dictionaries, hashcat also supports it. The command is as follows:

indicates that all rows in dic1.txt are combined with all rows in dic2.txt, and the resulting dictionary solves mima.txt.

Under what circumstances is the combination mode used? The combination mode is generally used when the user's password is clearly divided into two paragraphs, such as abcd1234, asdfasdf, aaa19770101, etc., where the password is clearly displayed as the previous paragraph and the next paragraph.

3. Points to note

(1) In combination mode, hashcat can currently only support combining two dictionaries (or the same dictionary twice), and cannot support multiple dictionaries (more than 3 dictionaries) or combining the same dictionary more than 3 times.

This means that the following command is incorrect:

hashcat  –a 1 –m 0 mima.txt –ooutfile dic.txt dic.txt

hashcat  –a 1 –m 0 mima.txt –ooutfile dic1.txt dic2.txt dic3.txt

(2) In combination mode, directories are also not supported (in the previous text, the entire directory is supported in -a 0 mode), which means that the following two situations are also not possible.

hashcat  –a 1 –m 0 mima.txt –ooutfile /dic/

hashcat  –a 1 –m 0 mima.txt –ooutfile /dic/*.txt

(3) Timeliness issue

When using the combination mode, if the dictionary is very large, for example, two dictionaries are 10,000,000, then the space for combination is 100,000,000,000,000, which is equivalent to an attack of 10,000,000 dictionaries (each dictionary has 10,000,000 entries). The space is too large, and there may be a lot of duplication. Although the coverage rate increases, the timeliness is not high.

 II. Brute-force cracking mode (-a 3)

Brute-force cracking, as the name suggests, involves brute-force exhaustion of a specified plaintext space. It is a last resort (because you cannot shrink the exhaustion space).

Before we formally discuss brute-force hacking, let's first talk about exhausting space. Taking common lowercase letters + numbers as an example, if the password length is 4, then its space is 36**4=1679616, which seems small, but it will come out in a moment. If the password length is 8, then its space is 36**8 = 2821109907456. If the solution time is 1000,000,000 (1 billion times/s), then the solution time is about 2820 seconds, about 47 minutes, which seems tolerable. If the password length is 10, then its space is 36**10=3656158440062976. If the solution time is 1000,000,000 (1 billion times/s), then the solution time exceeds 1000 hours, which is unacceptable.

There are many different types of brute-force hacking modes in hashcat (parameter represented as -a 3). Below, we will discuss them one by one.

1. Simple Mode

hashcat has 8 default character sets: l (26 lowercase letters), u (26 uppercase letters), d (10 numbers), H (lowercase hexadecimal characters), H (uppercase hexadecimal characters), s (31 special characters), A (a collection of 95 full characters of l, u, d, and s), and b (binary

0-0xff). As shown in the following figure

For example

(1) If the 6-bit space for lowercase letters is exhausted, the command is as follows:

(2) If the 8-bit space for full characters is exhausted, the command is as follows:

(3) If the full number space ranging from 4 to 6 bits is exhausted, the command is as follows:

Here, a parameter is added --inrcement --increment-min 4 --inrcement --increment-max 6 indicates the minimum and maximum values of the exhaustion length.

2. Combination Pattern

The combination pattern here is the organization pattern under exhaustive mode, not the (-a 1) pattern.

To illustrate directly:

(1) A password has an exhaustive range. It is assumed that the password length is 6. The first digit is the full character set, the second digit is lowercase letters, the third digit is uppercase letters, and the fourth, fifth, and sixth digit are the full character set. Then the command can use the following pattern:

(2) Several combination patterns are given below.

One: If the range of a password is uppercase and lowercase + numbers, and the length is 6, then the command is as follows:

Here -1 is used. l? He? d represents uppercase and lowercase letters + numbers.

Second: If the exhaustive range is 6 bits, with the first and fourth bits being uppercase and lowercase + numbers, the second bit being uppercase and lowercase, the third and fifth bits being uppercase + numbers, and the sixth bit being numbers, then the command is as follows:

Of course, you can also specify the minimum and maximum lengths, as shown in the image below.

3. Custom Mode

Earlier, we introduced that hashcat has 8 built-in character sets, but what if the character set the user needs is not among these 8? What should I do? No problem, hashcat has also prepared a wealth of custom brute force attack modes for everyone.

Using the hashcat –h command, you can see that the following usage pattern is defined.

Below, we will explain it through examples:

(1) If the password is 8 bits long and each bit consists of "0123456789aqwcfhj,.<>=-_+", then the following command can be used.

You can also write these characters to a file, such as char.txt, using the following command.

(2) If the password length is 8 bits, the first, third, and sixth bits are in "43545yt", the second and fourth bits are in "345dfv-=_+", the fifth and seventh bits are in "9vjnbbf-brg", and the eighth bit is in "345fkfggh", the following command can be used.

Of course, these characters can also be written into different files, such as char1.txt, ..., using the following command.

Note: Some symbols have special meanings in the command line, so when there are special symbols in the character set, it is best to write these symbols in file form.

(3) Based on (2), increase the minimum length and maximum length, such as 4-8 bits. Then you can use the following command.

III. Use of Some Parameters

In the previous article, we introduced the use of some parameters. Today, we will continue to introduce some commonly used parameters. Today we'll focus on the screen display parameters

. In the previous article, we introduced commands related to file output (-o/--outfile-format). These commands can be used to output the results of hashcat password cracking to a file in a certain format. However, while hashcat is running, we cannot see which passwords hashcat has cracked. It would be more intuitive and convenient if we could directly print the password deciphered by hashcat onto the screen when working with hashcat. There are exactly a few parameters in hashcat that can output the results of hashcat runs to the screen.

1. --show

The show command outputs the decrypted hash and password cached in the pot file to the screen window.

2, --left

The left command outputs the undecrypted hash value of hashcat to the screen

3, --stdout

The stdout command does not decrypt, but it prints the contents of the dictionary used for decryption.

Fourth, summary

hashcat has many commands, and different parameters vary greatly. To fully utilize the functions and roles of hashcat, it is recommended that everyone try different commands to become familiar with the combination methods of different hashcat commands. For the functionality of the hashcat parameter, you can refer to the hashcat online help (-h).