Skip to main content

​
Overview

hashcat is the fastest offline password cracker available. For wireless attacks it cracks WPA2 handshakes (mode 22000), MSCHAPv2 hashes captured from WPA Enterprise rogue AP attacks (mode 5500), and NTLMv2 hashes from hostile portal attacks (mode 5600).

​
Install

sudo apt install hashcat

​
Relevant Hash Modes

ModeHash Type
22000WPA-PMKID / WPA handshake (current)
2500WPA handshake (legacy)
5500NetNTLMv1 / MSCHAPv2
5600NetNTLMv2

​
Usage

hashcat -a <attack_mode> -m <hash_mode> <hashfile> <wordlist> [options]

​
Attack Modes

FlagMode
-a 0Dictionary attack
-a 1Combination attack
-a 3Brute-force / mask attack
-a 6Hybrid wordlist + mask

​
Common Flags

FlagDescription
-m <mode>Hash type
-a <mode>Attack mode
-w <1-4>Workload profile (4 = insane)
--forceIgnore warnings (needed in VMs)
-o <file>Output cracked hashes to file
--showShow previously cracked hashes
-r <rules>Apply rule file
--statusShow live status during attack

​
Examples

WPA2 handshake (mode 22000): 
hashcat -a 0 -m 22000 hash.22000 ~/rockyou.txt --force
MSCHAPv2 from WPA Enterprise rogue AP (mode 5500): 
hashcat -a 0 -m 5500 hashcat.5500 ~/rockyou.txt --force
NTLMv2 from hostile portal (mode 5600): 
hashcat -a 0 -m 5600 responder.5600 ~/rockyou.txt --force
WPA2 legacy mode 2500: 
hashcat -a 0 -m 2500 hostapd.hccapx ~/rockyou.txt --force