## 🔑 Hashcat Cheat Sheet
## 🔢 Common Hash Types (-m)
| Hash Type | Mode | Description |
|---|---|---|
| MD5 | 0 | md5($pass) |
| SHA1 | 100 | sha1($pass) |
| SHA256 | 1400 | sha256($pass) |
| NTLM | 1000 | NT Hash (Windows) |
| bcrypt | 3200 | Blowfish (Unix $2*$) |
| WPA/WPA2 | 22000 | Wi-Fi handshake (HC22000) |
| LM | 3000 | LAN Manager (legacy) |
| WordPress MD5 | 400 | md5($pass.$salt) |
## 🎯 Attack Modes (-a)
| Mode | Type | Description |
|---|---|---|
| 0 | Dictionary | Wordlist attack |
| 1 | Combination | Combine two wordlists |
| 3 | Brute-force (Mask) | Try every combination |
| 6 | Hybrid Wordlist+Mask | Append mask to wordlist |
| 7 | Hybrid Mask+Wordlist | Prepend mask to wordlist |
## 📂 Examples
# Dictionary Attack
hashcat -m 0 -a 0 hashes.txt rockyou.txt
# Brute-force (Mask Attack)
hashcat -m 0 -a 3 hashes.txt ?a?a?a?a?a
# Hybrid Attack (Wordlist + Mask)
hashcat -m 0 -a 6 hashes.txt rockyou.txt ?d?d
# Resume Cracking
hashcat --restore
# Show Cracked Passwords
hashcat -m 0 -a 0 hashes.txt rockyou.txt --show
## 🛠️ Useful Options
| Option | Description |
|---|---|
--force |
Bypass warnings (use cautiously) |
--show |
Show cracked results |
--username |
Ignore usernames in hashfile |
--status |
Show live cracking status |
--outfile |
Save cracked hashes to file |
--increment |
Enable incremental mask attack |
--session <name> |
Save or resume by session name |
--restore |
Resume from session |
--potfile-disable |
Don’t write to .potfile |