Hashcat for Beginners : Part-1

“hashcat is the world’s fastest and most advanced password recovery utility, supporting five unique modes of attack for over 200 highly-optimized hashing algorithms. hashcat currently supports CPUs, GPUs, and other hardware accelerators on Linux, Windows, and OSX, and has facilities to help enable distributed password cracking” :- Kali.org

In simple words i can say we can use Hashcat to crack any password. Hashcat support many hashing algorithms. It provides different attacks that we can use to crack passwords.

As we know we can not reverse HASH so first and normal approach is to guess the password and compare HASH value.

Note : if you are not using Kali linux then you need to download it from it’s official website. LINK

Let’s See how to use Hashcat. Let’s open terminal and type “hashcat” and press enter.

hashcat

Now let’s try

hashcat --help

Hashcat Help -1

Hashcat help 2

As we can see hashcat help gives us all the information and also gives us example.

Handles(eg. -d) that we should know before going to see examples.

-a number   : attack mode
-m number   : type of hash
-o filename : output

Let’s see syntax

hashcat -a number -m number -o OUTPUT.txt HASH.txt WORDLIST.txt
here,
-a defines attack mode
-m defines hash type
-o we want to save output result in OUTPUT.txt file
HASH.txt is file that contain hash values that we want to crack
WORDLIST.txt is file from which we think password can be matched 

Now let’s try one example.

Let’s first create md5 hash value for “password” string. In kali Linux we can use md5sum to generate md5 hash value.

generating hash using md5sum

Let’s save all this hash value in one file. we will store hash values of following strings “password,internet,Password!,admin,qwerty”

File that contain hash values.

we used tr -d to remove any space and hyphen(-) from md5sum output.

we will use following command

hashcat -m 0 -a 0 hash.txt /usr/share/wordlist/rockyou.txt --force

• -m 0 defines hash type (md5)
• -a 0 defines Dictionary attack
• hash.txt is file in which we have saved all hashes
• we used /usr/share/wordlist/rockyou.txt as our wordlist.

result 1

result

As we can see hashcat is able to identify all passwords.

This is part-1 we will see more examples in next part-2.