Hashcat explained: How this password cracker works

What is hashcat?

Hashcat is a popular and effective password cracker widely used by both penetration testers and sysadmins, as well as criminals and spies.

Cracking passwords is different from guessing a web login password, which typically allows only a small number of guesses before locking your account. Instead, someone who has access to a system with encrypted passwords (“hashes”) will often try to crack those hashes to recover those passwords.

Why is hashcat important?

Passwords are no longer stored in plaintext (or shouldn’t be, anyway). Instead, passwords are encrypted using a one-way function called a hash. Calculating a password like “Password1” into a hash is lightning quick. What if all you’ve got is the hash? A brute-force attack to reverse the hash function and recover the password could be computationally infeasible. Like, until the heat death of the universe infeasible.

Luckily, or unluckily depending on your point of view, none of us is likely to live that long, but there are many ways to reverse a hash to recover the original password without resorting to a probably fruitless brute-force attack.

Enter hashcat.

It turns out humans are so predictable in their password choices that hashcat can often recover a password.

Hashcat uses

Cracking passwords has many legitimate uses, besides the obvious criminal and espionage ones. A sysadmin may wish to pre-emptively check the security of user passwords. If hashcat can crack them, so can an attacker.

Penetration testers on engagement will frequently find themselves cracking stolen password hashes to move laterally inside a network, or to escalate privileges to an admin user. Since penetration testers work to find security holes on purpose, under contract, so that their customer can improve their security, this is also a perfectly legitimate use case.

Hashcat, as mentioned previously, can also be used to perform security audits, to ensure passwords end-users employ are difficult to crack. Hashcat is also often used to conduct forensics as part of incident response strategies, as it is often important for security administrators to know what passwords were associated with a given account in gathering evidence about a security incident.

Hashcat can also be used in research and development to vet the strength of cryptographic algorithms and hash functions.

The real takeaway is that both illegal attackers and legit defenders use hashcat. The best way to prevent an attacker from using hashcat against you is to test your own defenses first to make sure any such attack can’t succeed.

How does hashcat work?

At its most basic level, hashcat guesses a password, hashes it, and then compares the resulting hash to the one it’s trying to crack. If the hashes match, we know the password. If not, keep guessing. There are numerous attacks short of a full brute-force attempt, including dictionary attacks, combinator attacks, mask attacks, and rule-based attacks. Hashcat can also harness the power of your GPU to brute force if you have the computing rig for it — and time to spare.

Hashcat examples

Hashcat dictionary attack 

Since humans tend to use really bad passwords, a dictionary attack is the first and obvious place to start. The rockyou.txt word list is a popular option. Containing more than 14 million passwords sorted by frequency of use, it begins with common passwords such as “123456”, “12345”, “123456789”, “password”, “iloveyou”, “princess”, “1234567”, and “rockyou”, all the way to less common passwords such as “xCvBnM”, “ie168”, “abygurl69”, “a6_123”, and “*7¡Vamos!”.

Many other free wordlists exist on the internet, especially targeted at specific languages. Hashcat lets you specify the wordlist of your choice.

Hashcat combinator attack 

Humans often create passwords that are two words mushed together. Hashcat exploits this using a combinator attack that takes two-word lists (also known as “dictionaries”) and creates a new word list of every word combined with every other word.

The hashcat documentation gives the following example of two dictionaries:

yellow green black blue

and:

car bike

Hashcat then smushes up every word with every other word, and then test the following passwords:

yellowcar greencar blackcar bluecar yellowbike greenbike blackbike bluebike

Punctuation such as hyphens (-), exclamation points (!) and other special characters can also be added to create a final word list that has passwords like “yellow-car!” and “blue-bike!” and so forth.

Hashcat mask attack 

Lots of users tend to use passwords in a certain format. One uppercase letter followed by six letters plus a digit on the end is common for older passwords — “Bananas1”, for example. Instead of trying to brute-force every possible password, you can use hashcat to search for all passwords in that format, which drastically reduces the number of possible guesses necessary — if, indeed, the password in question is in that format.

The hashcat documentation explains why a mask attack is often orders of magnitude faster than a brute-force attack:

“In traditional brute-force attack we require a charset that contains all uppercase letters, all lowercase letters and all digits (a.k.a. “mixalpha-numeric”). The password length is 9, so we have to iterate through 62^9 (13.537.086.546.263.552) combinations. Let’s say we crack with a rate of 100M/s, this requires more than four years to complete.

“In mask attack we know about humans and how they design passwords. The above password matches a simple but common pattern. A name and year appended to it. We can also configure the attack to try the uppercase letters only on the first position. It is very uncommon to see an uppercase letter only in the second or the third position. To make it short, with mask attack we can reduce the keyspace to 52*26*26*26*26*10*10*10*10 (237.627.520.000) combinations. With the same cracking rate of 100M/s, this requires just 40 minutes to complete.”

Hashcat rule-based attack 

If other, easier, options fail, and you’ve got a specific sense of how your target constructs a password, hashcat offers a programming language-like syntax for a rule-based attack, in which you can specify what kind of passwords to try.

“The rule-based attack is one of the most complicated of all the attack modes,” the hashcat website says. “The rule-based attack is like a programming language designed for password candidate generation. It has functions to modify, cut or extend words and has conditional operators to skip some, etc. That makes it the most flexible, accurate and efficient attack.”

The learning curve to get started with hashcat is very low but learning the hashcat rule syntax will spike that learning curve sharply.

Hashcat brute-force attack If all else fails, throw a hail Mary and hope hashcat’s brute-force attack succeeds before our sun goes nova and engulfs the Earth. You never know, you might get lucky.