Every hashcat command follows the same pattern: the binary, the flags, and the arguments. Master the structure once and every attack type becomes a variation of the same template.
-m, -a, -o, -r, -w, -DThe hashcat binary name depends on your platform, but the structure is always the same.
hashcat [options] hash_file [dict|mask]Or explicitly: ./hashcat.bin
hashcat.exe [options] hash_file [dict|mask]hashcat -m 0 -a 0 -o results.txt hashes.txt rockyou.txt
# │ │ │ │ └── dictionary (argument)
# │ │ │ └── hash file (argument)
# │ │ └── output file (flag + value)
# │ └── attack mode (flag + value)
# └── hash type (flag + value)-mThe -m flag tells hashcat what hash algorithm to crack. Choosing the wrong mode means zero results.
| Value | Algorithm | Example Use Case |
|---|---|---|
| 0 | MD5 | Web app databases, legacy systems |
| 100 | SHA-1 | Older web applications |
| 1000 | NTLM | Windows password hashes |
| 1800 | SHA-512 (Unix) | Linux /etc/shadow |
| 3200 | bcrypt | Modern web apps |
| 22000 | WPA-PBKDF2-PMKID+EAPOL | Wi-Fi auditing |
Full list: hashcat --help or hashcat --example-hashes
hashcat --example-hashes | head -60 live to show how many modes exist (~350+). Students should bookmark the wiki page.-aThe -a flag selects the attack strategy. Each mode determines what arguments follow the hash file.
| Value | Mode | Arguments | Description |
|---|---|---|---|
| 0 | Dictionary | wordlist | Tries every word in a wordlist |
| 1 | Combinator | wordlist1 wordlist2 | Concatenates words from two lists |
| 3 | Mask / Brute-force | mask pattern | Generates candidates from a character mask |
| 6 | Hybrid: dict + mask | wordlist mask | Appends mask patterns to dictionary words |
| 7 | Hybrid: mask + dict | mask wordlist | Prepends mask patterns to dictionary words |
Key insight: The attack mode dictates the arguments. -a 0 needs a wordlist. -a 3 needs a mask. -a 6 needs both. Get these wrong and hashcat will throw an error.
Control where results go and how candidates are mutated.
-o & --outfile-format-o results.txt — save cracked hashes to file--outfile-format 1 — hash only--outfile-format 2 — plain password only--outfile-format 3 — hash:password (default)--outfile-format 5 — hash:password:hex-r-r rules/best64.rule — apply rule file-r flags = chained rules# Dictionary attack with rules, saving hash:password pairs
hashcat -m 0 -a 0 -o cracked.txt --outfile-format 3 -r rules/best64.rule hashes.txt rockyou.txtLong-running cracks need workload tuning and the ability to pause/resume.
-w-w 1 — Low (desktop responsive)-w 2 — Default-w 3 — High (recommended for dedicated rigs)-w 4 — Nightmare (may freeze UI)-D-D 1 — CPU only-D 2 — GPU only-D 1,2 — Both--session / --restore# Start a named session
hashcat --session mysession -m 0 ...
# Resume later
hashcat --session mysession --restoreSessions save progress to disk. Essential for multi-hour cracks.
-iWhen using mask attacks, incremental mode tries all lengths from --increment-min to --increment-max instead of only the exact mask length.
# Only tries exactly 8-character combinations
hashcat -m 1000 -a 3 hashes.txt ?a?a?a?a?a?a?a?a# Tries 4-char, 5-char, 6-char, 7-char, then 8-char
hashcat -m 1000 -a 3 --increment --increment-min 4 --increment-max 8 hashes.txt ?a?a?a?a?a?a?a?aThis is powerful but dramatically increases the total keyspace. Use --increment-min to skip trivially short passwords and save time.
A full-featured command combining multiple parameters for an NTLM mask attack.
hashcat -m 1000 -a 3 -o results.txt --session mysession \
--increment --increment-min 4 --increment-max 8 \
-w 3 hashes.txt ?a?a?a?a?a?a?a?a-m 1000 — NTLM hashes-a 3 — Mask attack-o results.txt — Output cracked hashes to file--session mysession — Named session for pause/resume--increment --increment-min 4 --increment-max 8 — Try lengths 4 through 8-w 3 — High-performance workloadhashes.txt — Input hash file?a?a?a?a?a?a?a?a — Mask: all printable characters, up to 8 positions