root@thehacksparrow:~/writeups$ SYSTEM ONLINE
· log in sign up
← back to cheatsheets
root@sparrow:~/writeups$ cat hashcat.md
// cracking

Hashcat

21 Jul 2026 · 6 min read
crackingcheatsheetshashcat
hashcat is the fastest GPU-based password cracker available: it takes captured hashes and tries candidates until it recovers the original password. It supports hundreds of algorithms (MD5, NTLM, SHA, Kerberos, WPA…) selected by their -m mode. It is a core tool in Active Directory audits and in validating password policies.

What really decides the outcome is not the flags but picking the right hash mode (-m) and attack type (-a): a wrong mode will never crack anything, and a blind dictionary yields far less than one well combined with rules or masks. hashcat stores every result in its potfile, so --show and --left rely on that state instead of repeating work.

1. Beginner level — dictionary, masks and rules

HASHCAT cheat sheet — Beginner
CommandWhat it does
hashcat -m 0 -a 0 hash.txt <wl>Cracks MD5 with a dictionary attack
hashcat -m 1000 -a 0 hash.txt <wl>Cracks NTLM hashes
hashcat -m 1800 -a 0 hash.txt <wl>Cracks SHA-512 hashes (Unix)
hashcat -m 100 -a 0 hash.txt <wl>Cracks SHA1 hashes
hashcat -a 3 hash.txt ?a?a?a?a?a?aBrute force with a character mask
hashcat --show hash.txtShows the passwords already cracked
hashcat --status hash.txt <wl>Shows progress during the attack
hashcat -o out.txt hash.txt <wl>Saves the results to a file
hashcat -m 0 hash.txt <wl> --forceForces execution ignoring warnings
hashcat --example-hashesLists the supported hash types
hashcat -m 0 hash.txt <wl> -OOptimizes the attack (optimized kernel)
hashcat -a 0 hash.txt <wl> -r best64.ruleApplies mutation rules to the wordlist
hashcat -IShows the hardware information
hashcat -bRuns a performance benchmark

2. Advanced level — Kerberoasting, sessions and tuning

HASHCAT cheat sheet — Advanced
CommandWhat it does
hashcat -m 1000 hash.txt <wl> -r .ruleAdvanced password mutation rules
hashcat -a 6 hash.txt <wl> ?d?d?dHybrid attack: wordlist + mask at the end
hashcat -a 7 hash.txt ?d?d?d <wl>Hybrid attack: mask + wordlist at the start
hashcat -m 13100 hash.txt <wl>Cracks Kerberos tickets (Kerberoasting)
hashcat -m 18200 hash.txt <wl>Cracks AS-REP Roasting
hashcat -m 5600 hash.txt <wl>Cracks NetNTLMv2
hashcat --potfile-path pot.txt -m 0 hash.txt <wl>Uses a custom potfile
hashcat -a 3 hash.txt -1 ?l?u ?1?1?1?1?1?1Defines a custom charset
hashcat --session ataque -m 0 hash.txt <wl>Names the session so it can be paused
hashcat --restore --session ataqueResumes a paused session
hashcat -m 0 hash.txt <wl> -w 3Adjusts the performance profile (workload)
hashcat -m 0 hash.txt <wl> -d 1,2Specifies which GPUs to use
hashcat --left hash.txt -m 0Shows the hashes still left to crack
hashcat -m 22000 hash.txt <wl>Cracks WPA/WPA2 handshakes (.hc22000)

3. Details people miss

  • The most common mistake is getting the -m mode wrong: check --example-hashes to confirm the exact format before launching the attack.
  • -O enables optimized kernels and is much faster, but it caps the maximum candidate password length; if you find nothing long, try again without -O.
  • hashcat caches everything cracked in the potfile: if you rerun an already-broken hash it won't show it again unless you use --show or delete/change the potfile.
  • --force bypasses the driver's safety checks; use it only for testing, as it can produce corrupt results or false negatives.
  • Always name long sessions with --session: without a name you won't be able to resume them with --restore if they are interrupted.

Responsible use

These commands are for systems you own or have explicit written authorisation to test (labs, CTFs, contracted engagements). Using them against third-party infrastructure without permission is illegal in most countries.