{"id":193,"date":"2020-09-17T12:55:57","date_gmt":"2020-09-17T10:55:57","guid":{"rendered":"https:\/\/infosecscout.com\/?p=193"},"modified":"2023-11-22T13:02:24","modified_gmt":"2023-11-22T12:02:24","slug":"hashcat-tutorial-decrypt-md5","status":"publish","type":"post","link":"https:\/\/infosecscout.com\/hashcat-tutorial-decrypt-md5\/","title":{"rendered":"How to Install and Use Hashcat to Decrypt MD5? (Tutorial)"},"content":{"rendered":"\n<p>Decrypting MD5 hashes is probably a goal for most of you on this website, and hashcat seems a pretty good tool to help you in this task.<br>The problem is that it&#8217;s not the easier software to understand and use, whatever your operating system is.<br>In this tutorial, I will explain everything and show you effective ways to use hashcat.<\/p>\n\n\n\n<p><strong>Hashcat is one of the best password recovery tool, available for free on almost any operating system.<br>It can use several methods to find the clear password corresponding to an encrypted hash. It also supports most hash formats.<\/strong><\/p>\n\n\n\n<p>Today, the goal is firstly to introduce Hashcat and explain all the technical language around it, then to install it on your system, and finally give you a few examples on the most effective way to use Hashcat to decrypt MD5 encrypted passwords.<\/p>\n\n\n\n<div id=\"ez-toc-container\" class=\"ez-toc-v2_0_65 counter-hierarchy ez-toc-counter ez-toc-custom ez-toc-container-direction\">\n<div class=\"ez-toc-title-container\">\n<p class=\"ez-toc-title \" >Table of Contents<\/p>\n<span class=\"ez-toc-title-toggle\"><a href=\"#\" class=\"ez-toc-pull-right ez-toc-btn ez-toc-btn-xs ez-toc-btn-default ez-toc-toggle\" aria-label=\"Toggle Table of Content\"><span class=\"ez-toc-js-icon-con\"><span class=\"\"><span class=\"eztoc-hide\" style=\"display:none;\">Toggle<\/span><span class=\"ez-toc-icon-toggle-span\"><svg style=\"fill: #999;color:#999\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" class=\"list-377408\" width=\"20px\" height=\"20px\" viewBox=\"0 0 24 24\" fill=\"none\"><path d=\"M6 6H4v2h2V6zm14 0H8v2h12V6zM4 11h2v2H4v-2zm16 0H8v2h12v-2zM4 16h2v2H4v-2zm16 0H8v2h12v-2z\" fill=\"currentColor\"><\/path><\/svg><svg style=\"fill: #999;color:#999\" class=\"arrow-unsorted-368013\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"10px\" height=\"10px\" viewBox=\"0 0 24 24\" version=\"1.2\" baseProfile=\"tiny\"><path d=\"M18.2 9.3l-6.2-6.3-6.2 6.3c-.2.2-.3.4-.3.7s.1.5.3.7c.2.2.4.3.7.3h11c.3 0 .5-.1.7-.3.2-.2.3-.5.3-.7s-.1-.5-.3-.7zM5.8 14.7l6.2 6.3 6.2-6.3c.2-.2.3-.5.3-.7s-.1-.5-.3-.7c-.2-.2-.4-.3-.7-.3h-11c-.3 0-.5.1-.7.3-.2.2-.3.5-.3.7s.1.5.3.7z\"\/><\/svg><\/span><\/span><\/span><\/a><\/span><\/div>\n<nav><ul class='ez-toc-list ez-toc-list-level-1 eztoc-toggle-hide-by-default' ><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-1\" href=\"https:\/\/infosecscout.com\/hashcat-tutorial-decrypt-md5\/#Hashcat_glossary\" title=\"Hashcat glossary\">Hashcat glossary<\/a><ul class='ez-toc-list-level-3' ><li class='ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-2\" href=\"https:\/\/infosecscout.com\/hashcat-tutorial-decrypt-md5\/#What_is_Hashcat\" title=\"What is Hashcat?\">What is Hashcat?<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-3\" href=\"https:\/\/infosecscout.com\/hashcat-tutorial-decrypt-md5\/#Hashes\" title=\"Hashes\">Hashes<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-4\" href=\"https:\/\/infosecscout.com\/hashcat-tutorial-decrypt-md5\/#Dictionary\" title=\"Dictionary\">Dictionary<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-5\" href=\"https:\/\/infosecscout.com\/hashcat-tutorial-decrypt-md5\/#Attack_modes\" title=\"Attack modes\">Attack modes<\/a><\/li><\/ul><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-6\" href=\"https:\/\/infosecscout.com\/hashcat-tutorial-decrypt-md5\/#Install_Hashcat_on_your_computer\" title=\"Install Hashcat on your computer\">Install Hashcat on your computer<\/a><ul class='ez-toc-list-level-3' ><li class='ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-7\" href=\"https:\/\/infosecscout.com\/hashcat-tutorial-decrypt-md5\/#Windows\" title=\"Windows\">Windows<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-8\" href=\"https:\/\/infosecscout.com\/hashcat-tutorial-decrypt-md5\/#Linux\" title=\"Linux\">Linux<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-9\" href=\"https:\/\/infosecscout.com\/hashcat-tutorial-decrypt-md5\/#macOS\" title=\"macOS\">macOS<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-10\" href=\"https:\/\/infosecscout.com\/hashcat-tutorial-decrypt-md5\/#Tests\" title=\"Tests\">Tests<\/a><\/li><\/ul><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-11\" href=\"https:\/\/infosecscout.com\/hashcat-tutorial-decrypt-md5\/#How_to_use_Hashcat\" title=\"How to use Hashcat\">How to use Hashcat<\/a><ul class='ez-toc-list-level-3' ><li class='ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-12\" href=\"https:\/\/infosecscout.com\/hashcat-tutorial-decrypt-md5\/#Create_your_hashes_list\" title=\"Create your  hashes list\">Create your  hashes list<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-13\" href=\"https:\/\/infosecscout.com\/hashcat-tutorial-decrypt-md5\/#Dictionary_attack\" title=\"Dictionary attack\">Dictionary attack<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-14\" href=\"https:\/\/infosecscout.com\/hashcat-tutorial-decrypt-md5\/#Bruteforce_attack\" title=\"Bruteforce attack\">Bruteforce attack<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-15\" href=\"https:\/\/infosecscout.com\/hashcat-tutorial-decrypt-md5\/#Mask_attack\" title=\"Mask attack\">Mask attack<\/a><\/li><\/ul><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-16\" href=\"https:\/\/infosecscout.com\/hashcat-tutorial-decrypt-md5\/#Conclusion\" title=\"Conclusion\">Conclusion<\/a><\/li><\/ul><\/nav><\/div>\n<h2 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"Hashcat_glossary\"><\/span>Hashcat glossary<span class=\"ez-toc-section-end\"><\/span><\/h2>\n\n\n\n<h3 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"What_is_Hashcat\"><\/span>What is Hashcat?<span class=\"ez-toc-section-end\"><\/span><\/h3>\n\n\n\n<p><strong>Hashcat is a free software for password recovery.<br><\/strong>Basically, security companies and hackers are the ones using this tool.<\/p>\n\n\n\n<p>In a database, passwords are generally encrypted with a specific algorithm, for example MD5, SHA1, etc.<br>These poor cryptographic hashing methods are fast to use, so even if they are not reversible, <strong>a powerful computer can attempt several billions words each second<\/strong>, and short passwords can be recovered quickly.<br>If you want to learn more about this, you can check this article: <a rel=\"noreferrer noopener\" href=\"https:\/\/infosecscout.com\/why-md5-is-not-safe\/\" data-type=\"post\" data-id=\"53\" target=\"_blank\">Why MD5 is not secure?<\/a><\/p>\n\n\n\n<p>In this tutorial, you&#8217;ll install &amp; use hashcat on your computer, so you can really understand how it works.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"Hashes\"><\/span>Hashes<span class=\"ez-toc-section-end\"><\/span><\/h3>\n\n\n\n<p>A &#8220;hash&#8221; is a word that you&#8217;ll see many times in this tutorial, so just in case: <strong>a password hash is the result of a hashing function (ex: MD5)<\/strong>.<br>When you encrypt a password with MD5, it gives a hexadecimal string with 32 characters, whatever the word was.<\/p>\n\n\n\n<p>For example,<strong> the corresponding MD5 hash for &#8220;MD5Online&#8221; is &#8220;d49019c7a78cdaac54250ac56d0eda8a&#8221;<\/strong>.<br>You can use this <a rel=\"noreferrer noopener\" href=\"https:\/\/www.md5online.org\/\" target=\"_blank\">MD5 encryption tool<\/a> to try this if you want.<\/p>\n\n\n\n<p>The goal with hashcat will be to give it the hash as an input, and see if it can recover the correct word (MD5Online).<\/p>\n\n\n\n<h3 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"Dictionary\"><\/span>Dictionary<span class=\"ez-toc-section-end\"><\/span><\/h3>\n\n\n\n<p>Even if we know that strong passwords are long and including all cases, numbers and special characters, most people still use some pretty basic words, just to comply with the website requirements.<\/p>\n\n\n\n<p><strong>Currently, passwords like &#8220;123456&#8221;, &#8220;qwerty&#8221; or simply &#8220;password&#8221; are still the most used ones online.<\/strong><br>So, when you have a list of password hashes to recover, a good method is often to start with a list of the most common passwords to save time with hashcat.<\/p>\n\n\n\n<p><strong>This kind of passwords list is named a dictionary.<br><\/strong>You can find some dictionaries files easily on the Internet (we&#8217;ll see a few examples later), or create one based on the information you already have.<\/p>\n\n\n\n<p>So, creating a dictionary file and asking hashcat to compare it to your hashes list is the first method you can try.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"Attack_modes\"><\/span>Attack modes<span class=\"ez-toc-section-end\"><\/span><\/h3>\n\n\n\n<p>But hashcat can do much more of that, many attack modes are supported by this tool, and we&#8217;ll see a few of them today.<br>Here are the three main ones:<\/p>\n\n\n\n<ul><li><strong>Dictionary attack<\/strong>: you already know what it is<\/li><li><strong>Brute-force attack<\/strong>: in brute-force mode, hashcat will try all combinations in a given charset (for example, &#8220;try all combinations of 8 letters words with digits only&#8221;)<\/li><li><strong>Mask attack<\/strong>: almost the same thing as brute-force, but with a dynamic charset (ex: &#8220;all combinations for words between 6 and 10 characters, with lowercase letters, starting with an uppercase)<\/li><\/ul>\n\n\n\n<p>Most of the time, you will try all of them, of combine them in one command.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"Install_Hashcat_on_your_computer\"><\/span>Install Hashcat on your computer<span class=\"ez-toc-section-end\"><\/span><\/h2>\n\n\n\n<p>I hope the theory is a bit clearer for you now, so we can move to the practice, and install Hashcat on your computer.<br>It&#8217;s available for any operating system, so it should not be so complicated.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"Windows\"><\/span>Windows<span class=\"ez-toc-section-end\"><\/span><\/h3>\n\n\n\n<p>For Windows, the easiest way is to download the binary file on the official website:<\/p>\n\n\n\n<ul><li><strong>Go to the Hashcat website<\/strong> <a href=\"https:\/\/hashcat.net\/hashcat\/\" target=\"_blank\" rel=\"noreferrer noopener\">here<\/a><\/li><li><strong>Click on Download<\/strong> in the &#8220;hashcat binaries&#8221; line<br><img loading=\"lazy\" decoding=\"async\" width=\"600\" height=\"121\" class=\"wp-image-197\" style=\"width: 600px;\" src=\"https:\/\/infosecscout.com\/wp-content\/uploads\/2020\/09\/download-hashcat.jpg\" alt=\"\" srcset=\"https:\/\/infosecscout.com\/wp-content\/uploads\/2020\/09\/download-hashcat.jpg 600w, https:\/\/infosecscout.com\/wp-content\/uploads\/2020\/09\/download-hashcat-300x61.jpg 300w\" sizes=\"(max-width: 600px) 100vw, 600px\" \/><\/li><li>You&#8217;ll get a compressed file, probably a .7z<\/li><li><strong>Extract all the files <\/strong>with <a rel=\"noreferrer noopener\" href=\"https:\/\/www.win-rar.com\/\" target=\"_blank\">WinRAR<\/a> or <a rel=\"noreferrer noopener\" href=\"https:\/\/www.7-zip.org\/\" target=\"_blank\">7zip<\/a><\/li><\/ul>\n\n\n\n<p>Remember the files location, we&#8217;ll need it later.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"Linux\"><\/span>Linux<span class=\"ez-toc-section-end\"><\/span><\/h3>\n\n\n\n<p>On Linux, you can follow the same steps as for Windows, but the best way is probably to use your package manager.<br>This way the command will be perfectly integrated, and you&#8217;ll automatically install new updates.<\/p>\n\n\n\n<p>For example,<strong> if you are on a Debian-like system, you can use<\/strong>:<br><code>sudo apt install hashcat<\/code><\/p>\n\n\n\n<p>That&#8217;s it, the hashcat command is now available anywhere in your system.<br>It&#8217;s easy to use on Linux, I like that. The only problem might be to get the correct drivers for your graphic card (Hashcat is more powerful with a good GPU than a high-end CPU).<\/p>\n\n\n\n<p>If you are using Ubuntu, I have a complete guide on <a href=\"https:\/\/infosecscout.com\/install-hashcat-on-ubuntu\/\" data-type=\"post\" data-id=\"558\" target=\"_blank\" rel=\"noreferrer noopener\">how to install Hashcat on Ubuntu<\/a> here.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"macOS\"><\/span>macOS<span class=\"ez-toc-section-end\"><\/span><\/h3>\n\n\n\n<p>On macOS, I think the best way is to use Homebrew to install everything easily:<\/p>\n\n\n\n<ul><li><strong>Install Homebrew <\/strong>if you don&#8217;t have it yet. In a terminal, paste the following command:<br><code>\/bin\/bash -c \"$(curl -fsSL https:\/\/raw.githubusercontent.com\/Homebrew\/install\/master\/install.sh)\"<\/code><\/li><li>Once installed, you can <strong>install hashcat with:<\/strong><br><code>brew install hashcat<\/code><\/li><\/ul>\n\n\n\n<p>That&#8217;s it!<br>More detail here about <a href=\"https:\/\/brew.sh\/\" target=\"_blank\" rel=\"noreferrer noopener\">Homebrew<\/a> if you are not (yet) familiar with it.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"Tests\"><\/span>Tests<span class=\"ez-toc-section-end\"><\/span><\/h3>\n\n\n\n<p>Once installed, you can start a short test to check that everything is ok, before we start to really use it in the next part.<br>Hashcat includes a benchmark mode that you can run with no data:<\/p>\n\n\n\n<ul><li><strong>Windows:<\/strong><ul><li>Open a command prompt<\/li><li>Go to the hashcat extracted folder, probably something like:<br><code>cd Downloads\\hahscat-&lt;version&gt;\\<\/code><\/li><li>Run hashcat:<br><code>hashcat.exe -b<\/code><br>On older versions, you may have the choice between 32 and 64 bits:<br><code>hashcat64.exe -b<\/code><br>The .exe extension is not mandatory, I will skip it in the following part, to make the command work also on Linux \/ macOS.<\/li><\/ul><\/li><li><strong>Linux \/ macOS:<\/strong><ul><li>You can use hashcat anywhere, so just open a terminal and type the same command:<br><code>hashcat -b<\/code><\/li><\/ul><\/li><\/ul>\n\n\n\n<p>You should get something like this for each hash mode you try:<br><img loading=\"lazy\" decoding=\"async\" width=\"600\" height=\"62\" class=\"wp-image-200\" style=\"width: 600px;\" src=\"https:\/\/infosecscout.com\/wp-content\/uploads\/2020\/09\/hashcat-benchmark.jpg\" alt=\"\" srcset=\"https:\/\/infosecscout.com\/wp-content\/uploads\/2020\/09\/hashcat-benchmark.jpg 600w, https:\/\/infosecscout.com\/wp-content\/uploads\/2020\/09\/hashcat-benchmark-300x31.jpg 300w\" sizes=\"(max-width: 600px) 100vw, 600px\" \/><\/p>\n\n\n\n<p>If you have any error, try to fix it now.<br>You can check the <a rel=\"noreferrer noopener\" href=\"https:\/\/hashcat.net\/hashcat\/\" target=\"_blank\">Hashcat wiki and forum<\/a><a href=\"https:\/\/hashcat.net\/hashcat\/\" target=\"_blank\" rel=\"noreferrer noopener\">s<\/a>, or just Google the error \ud83d\ude42<\/p>\n\n\n\n<h2 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"How_to_use_Hashcat\"><\/span>How to use Hashcat<span class=\"ez-toc-section-end\"><\/span><\/h2>\n\n\n\n<p>Let&#8217;s see now how it works with a concrete example.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"Create_your_hashes_list\"><\/span>Create your  hashes list<span class=\"ez-toc-section-end\"><\/span><\/h3>\n\n\n\n<p>The first thing you need to do, is to create a file with all the MD5 hashes inside (or with another hash function, but I will show you with the MD5 algorithm).<\/p>\n\n\n\n<ul><li><strong>Create a folder for hashcat<\/strong>, or use the one created after the download if you took the binaries.<\/li><li><strong>Create a new empty file in it: hashes.txt <\/strong>for example.<\/li><li><strong>Put one hash on each line<\/strong>, no spaces, no separators, nothing.<br>Here is my file content if you want an example:<br><code>d3c8e06e57cc1af7ebdba01427e62bc2<br>ab4f63f9ac65152575886860dde480a1<br>6e090737085c014bafee9f59507310fb<br>225b93df46427d7acad176492d716f7d<\/code><br>And as you can see, I don&#8217;t put anything except the hashes, one per line:<br><img loading=\"lazy\" decoding=\"async\" width=\"558\" height=\"171\" class=\"wp-image-202\" style=\"width: 558px;\" src=\"https:\/\/infosecscout.com\/wp-content\/uploads\/2020\/09\/md5-hashs.jpg\" alt=\"\" srcset=\"https:\/\/infosecscout.com\/wp-content\/uploads\/2020\/09\/md5-hashs.jpg 558w, https:\/\/infosecscout.com\/wp-content\/uploads\/2020\/09\/md5-hashs-300x92.jpg 300w\" sizes=\"(max-width: 558px) 100vw, 558px\" \/><\/li><li><strong>Save the file and exit <\/strong>the editor.<\/li><\/ul>\n\n\n\n<h3 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"Dictionary_attack\"><\/span>Dictionary attack<span class=\"ez-toc-section-end\"><\/span><\/h3>\n\n\n\n<p>The first thing we&#8217;ll try is to use a word list.<br>It&#8217;s the same kind of file, but with one word (not hash) per line.<\/p>\n\n\n\n<p>You can either create a file from scratch with the passwords you think you&#8217;ll find, or download one with the most common passwords in it.<\/p>\n\n\n\n<p><strong>Here are a few links you can try to find good dictionaries:<\/strong><\/p>\n\n\n\n<ul><li><a rel=\"noreferrer noopener\" href=\"https:\/\/github.com\/danielmiessler\/SecLists\/tree\/master\/Passwords\" target=\"_blank\">Daniel Miessler GitHub<\/a><\/li><li><a rel=\"noreferrer noopener\" href=\"https:\/\/crackstation.net\/crackstation-wordlist-password-cracking-dictionary.htm\" target=\"_blank\">Crackstation<\/a><\/li><li>You can also simply pick a list of words, like the most used words in English <a rel=\"noreferrer noopener\" href=\"https:\/\/www.ef.com\/wwen\/english-resources\/english-vocabulary\/top-3000-words\/\" target=\"_blank\">here<\/a><\/li><\/ul>\n\n\n\n<p>Whatever your method, try to have a file with at least the most common password, and ideally have one of them in your hashes list to check that hashcat is working \ud83d\ude42<\/p>\n\n\n\n<p>In my case, <a rel=\"noreferrer noopener\" href=\"https:\/\/github.com\/danielmiessler\/SecLists\/blob\/master\/Passwords\/Common-Credentials\/10-million-password-list-top-100000.txt\" target=\"_blank\">I took this one <\/a>for the test.<br>Once you have downloaded or created the file, use the following command with hashcat:<br><code>hashcat -a 0 -m 0 -O hashes.txt wordlist.txt<br><\/code>Obviously, you need to change the hashes and wordlist name, or add the path if not in the same folder as your prompt.<\/p>\n\n\n\n<p>Here are the options I used:<br><strong>   -a 0 :<\/strong> to tell hashcat to use a dictionary attack<br><strong>   -m 0 : <\/strong>to tell hashcat to use only the MD5 function<br><strong>    -O : <\/strong>use the optimized version<\/p>\n\n\n\n<p>And the log I got:<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">&gt;hashcat.exe -a 0 -m 0 -O hashes.txt wordlist.txt\nhashcat (v6.1.1) starting\u2026\nOpenCL API (OpenCL 2.1 AMD-APP (3004.8)) - Platform #1 [Advanced Micro Devices, Inc.]\nDevice #1: Tahiti, 3008\/3072 MB (2393 MB allocatable), 28MCU\nMinimum password length supported by kernel: 0\nMaximum password length supported by kernel: 31\nHashes: 4 digests; 4 unique digests, 1 unique salts\nBitmaps: 16 bits, 65536 entries, 0x0000ffff mask, 262144 bytes, 5\/13 rotates\nRules: 1\nApplicable optimizers applied:\nOptimized-Kernel\nZero-Byte\nPrecompute-Init\nMeet-In-The-Middle\nEarly-Skip\nNot-Salted\nNot-Iterated\nSingle-Salt\nRaw-Hash\nWatchdog: Temperature abort trigger set to 90c\nHost memory required for this attack: 555 MB\nDictionary cache built:\nFilename..: wordlist.txt\nPasswords.: 100000\nBytes\u2026..: 781896\nKeyspace..: 100000\nRuntime\u2026: 0 secs\nThe wordlist or mask that you are using is too small.\nThis means that hashcat cannot use the full parallel power of your device(s).\nUnless you supply more work, your cracking speed will drop.\nFor tips on supplying more work, see: https:\/\/hashcat.net\/faq\/morework\nApproaching final keyspace - workload adjusted.\n\n<strong>ab4f63f9ac65152575886860dde480a1:azerty<\/strong>\n\nSession\u2026\u2026\u2026.: hashcat\nStatus\u2026\u2026\u2026..: Exhausted\nHash.Name\u2026\u2026..: MD5\nHash.Target\u2026\u2026: hashes.txt\nTime.Started\u2026..: Thu Sep 17 06:04:05 2020 (0 secs)\nTime.Estimated\u2026: Thu Sep 17 06:04:05 2020 (0 secs)\nGuess.Base\u2026\u2026.: File (wordlist.txt)\nGuess.Queue\u2026\u2026: 1\/1 (100.00%)\nSpeed.#1\u2026\u2026\u2026: 5532.1 kH\/s (0.10ms) @ Accel:1024 Loops:1 Thr:64 Vec:1\nRecovered\u2026\u2026..: 1\/4 (25.00%) Digests\nProgress\u2026\u2026\u2026: 100000\/100000 (100.00%)\nRejected\u2026\u2026\u2026: 0\/100000 (0.00%)\nRestore.Point\u2026.: 100000\/100000 (100.00%)\nRestore.Sub.#1\u2026: Salt:0 Amplifier:0-1 Iteration:0-1\nCandidates.#1\u2026.: 123456 -&gt; 070162\nHardware.Mon.#1..: Temp: 34c Fan: 33% Util: 45% Core:1000MHz Mem:1250MHz Bus:16\nStarted: Thu Sep 17 06:03:59 2020\nStopped: Thu Sep 17 06:04:05 2020<\/pre>\n\n\n\n<p><strong>As you can see in the middle, hashcat recover one password in my list (&#8220;azerty&#8221;)<\/strong>, and added it to the hashcat.potfile file (so you can see all recovered passwords in it, even if there are many results).<\/p>\n\n\n\n<p>That&#8217;s it for the dictionary attack, obviously you will use more or less big files depending on your goals, but you already know the important steps.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"Bruteforce_attack\"><\/span>Bruteforce attack<span class=\"ez-toc-section-end\"><\/span><\/h3>\n\n\n\n<p>The next method I want to show you is the brute force method.<br>It&#8217;s the base of the most powerful one you can dream with hashcat (we&#8217;ll see it just after this one).<br>The idea is to try a huge quantity of possible words, in a short period of time.<\/p>\n\n\n\n<p><strong>Basically, hashcat will start from the smallest word and increase the password length gradually.<\/strong><br>As it&#8217;s rarely the better way to find a password, the hashcat developers consider it as outdated,<strong> the mask attack we&#8217;ll see after that replaces it<\/strong>.<\/p>\n\n\n\n<p>But if you want to give a try for the exercise, here is how to do this:<br><code>hashcat -a 3 -m 0 hashes.txt<\/code><br>You should already know most of the options here. <br>Just &#8220;-a 3&#8221; is the brute force attack mode (the dictionary mode was 0).<\/p>\n\n\n\n<p>When you run this command, hashcat will display the status regularly in your console, so you can see what it&#8217;s checking at the moment, for example:<br><code>Candidates.#1\u2026.: 0qw6bx -&gt; Xqqfqx<\/code><br>Here I know it&#8217;s already testing 6 characters passwords after a few seconds run on a standard computer.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"Mask_attack\"><\/span>Mask attack<span class=\"ez-toc-section-end\"><\/span><\/h3>\n\n\n\n<p>In this method, rather than trying every possible word, we&#8217;ll limit the attempts in a predefined charset and password length.<\/p>\n\n\n\n<p><strong>A charset is defined by the characters allowed in your password.<br><\/strong>By default, you can already use these possibilities:<\/p>\n\n\n\n<ul><li><strong>?l =<\/strong> abcdefghijklmnopqrstuvwxyz<\/li><li><strong>?u =<\/strong> ABCDEFGHIJKLMNOPQRSTUVWXYZ<\/li><li><strong>?d =<\/strong> 0123456789<\/li><li><strong>?h =<\/strong> 0123456789abcdef<\/li><li><strong>?H =<\/strong> 0123456789ABCDEF<\/li><li><strong>?s =<\/strong> \u00abspace\u00bb!&#8221;#$%&amp;'()*+,-.\/:;&lt;=&gt;?@[\\]^_`{|}~<\/li><li><strong>?a =<\/strong> ?l?u?d?s<\/li><li><strong>?b =<\/strong> 0x00 &#8211; 0xff<\/li><\/ul>\n\n\n\n<p>The other thing you can play with, is the password length.<br>To indicates the password length option, you&#8217;ll generally repeat the charset character. Here are a few examples :<\/p>\n\n\n\n<ul><li><strong>?l?l?l?l?l?l?l?l: <\/strong>passwords between &#8220;aaaaaaaa&#8221; and &#8220;zzzzzzzz&#8221;<\/li><li><strong>password?d: <\/strong>passwords between &#8220;password0&#8221; and &#8220;password9&#8221;<\/li><li><strong>?u?l?l:<\/strong> passwords between &#8220;Aaa&#8221; and &#8220;Zzz&#8221;<\/li><\/ul>\n\n\n\n<p>I think you understood the idea here \ud83d\ude42<\/p>\n\n\n\n<p>It&#8217;s awesome. That&#8217;s why, we don&#8217;t use a simple brute force method anymore, as most of the time, you already have an idea of the passwords format.<br>If your passwords come from a list, where passwords shorter than 8 characters are forbidden, why would you try them?<\/p>\n\n\n\n<p>Once you know these rules, <strong>here is the command to use, it&#8217;s almost the same as seen previously, with the password format added:<\/strong><br><code>hashcat -a 3 -m 0 hashes.txt ?l?l?d?l?l?l?l?l?l?<\/code><\/p>\n\n\n\n<p>This command is trying all passwords with 9 characters, lower case, with a digit in third position (I&#8217;m just cheating to find one of my other word quickly ^^).<br><strong>And here is the result I expected:<br><\/strong><code>d3c8e06e57cc1af7ebdba01427e62bc2:md5online<\/code><\/p>\n\n\n\n<p>You can now play with this attack as you want.<br>You can go further and create files with several masks in it, you can see some examples in the &#8220;masks&#8221; subfolder, and replace the password format by the filename in the command, for example:<br><code>hashcat -a 3 -m 0 hashes.txt masks\\rockyou-1-60.hcmask<\/code><br>This file is inspired from the cracked passwords formats from RockYou.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"Conclusion\"><\/span>Conclusion<span class=\"ez-toc-section-end\"><\/span><\/h2>\n\n\n\n<p>That&#8217;s it, you now know the basics of password decryption with hashcat.<br>Hashcat is a compelling tool, with many options to do exactly what you want.<br>Now that you understand the basic, you can start playing with it, and check the <a href=\"https:\/\/hashcat.net\/wiki\/\" target=\"_blank\" rel=\"noreferrer noopener\">official documentation<\/a> if you need something more specific.<\/p>\n\n\n\n<p>In any case, I hope this tutorial was useful for you. If it&#8217;s the case, please share it on your favorite social network or forum, it helps me a lot \ud83d\ude42<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Decrypting MD5 hashes is probably a goal for most of you on this website, and hashcat seems a pretty good tool to help you in this task.The problem is that it&#8217;s not the easier software to understand and use, whatever your operating system is.In this tutorial, I will explain everything and show you effective ways&#8230;<\/p>\n","protected":false},"author":1,"featured_media":206,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_kad_blocks_custom_css":"","_kad_blocks_head_custom_js":"","_kad_blocks_body_custom_js":"","_kad_blocks_footer_custom_js":"","_kad_post_transparent":"","_kad_post_title":"","_kad_post_layout":"","_kad_post_sidebar_id":"","_kad_post_content_style":"","_kad_post_vertical_padding":"","_kad_post_feature":"","_kad_post_feature_position":"","_kad_post_header":false,"_kad_post_footer":false,"footnotes":""},"categories":[15],"tags":[],"taxonomy_info":{"category":[{"value":15,"label":"Hacking"}]},"featured_image_src_large":["https:\/\/infosecscout.com\/wp-content\/uploads\/2020\/09\/how-to-use-hashcat-md5-1024x683.jpg",1024,683,true],"author_info":{"display_name":"Patrick Fromaget","author_link":"https:\/\/infosecscout.com\/about\/"},"comment_info":0,"category_info":[{"term_id":15,"name":"Hacking","slug":"hacking","term_group":0,"term_taxonomy_id":15,"taxonomy":"category","description":"Ready to level up? Our Hacking Guides have you covered with step-by-step instructions on using tools like Hashcat. It's hacking made simple and fun!","parent":0,"count":15,"filter":"raw","cat_ID":15,"category_count":15,"category_description":"Ready to level up? Our Hacking Guides have you covered with step-by-step instructions on using tools like Hashcat. It's hacking made simple and fun!","cat_name":"Hacking","category_nicename":"hacking","category_parent":0}],"tag_info":false,"_links":{"self":[{"href":"https:\/\/infosecscout.com\/wp-json\/wp\/v2\/posts\/193"}],"collection":[{"href":"https:\/\/infosecscout.com\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/infosecscout.com\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/infosecscout.com\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/infosecscout.com\/wp-json\/wp\/v2\/comments?post=193"}],"version-history":[{"count":11,"href":"https:\/\/infosecscout.com\/wp-json\/wp\/v2\/posts\/193\/revisions"}],"predecessor-version":[{"id":568,"href":"https:\/\/infosecscout.com\/wp-json\/wp\/v2\/posts\/193\/revisions\/568"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/infosecscout.com\/wp-json\/wp\/v2\/media\/206"}],"wp:attachment":[{"href":"https:\/\/infosecscout.com\/wp-json\/wp\/v2\/media?parent=193"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/infosecscout.com\/wp-json\/wp\/v2\/categories?post=193"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/infosecscout.com\/wp-json\/wp\/v2\/tags?post=193"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}