The most practical and widely-used hashcat attack modes. Dictionary attacks leverage real-world wordlists, while combinator attacks multiply their power by joining words from two lists.
-a 0) using popular wordlists-a 1) joining two dictionaries-a 0)The dictionary (or "straight") attack tries every word in a wordlist file against the target hashes. It is attack mode 0 and is hashcat's default.
# Basic dictionary attack against MD5 hashes
hashcat -m 0 -a 0 -o results.txt hashes.txt rockyou.txt-m 0 — hash type: MD5-a 0 — attack mode: dictionary (straight)-o results.txt — output cracked results to filehashes.txt — file containing target hashesrockyou.txt — the wordlist to useSpeed: Dictionary attacks are fast because they only check words that real humans actually use as passwords. With a GPU, hashcat can check billions of MD5 candidates per second.
Rules transform each dictionary word into multiple candidates — capitalizing, appending numbers, substituting characters, reversing, and more. This dramatically increases coverage without a larger wordlist.
# Dictionary attack with rule file
hashcat -m 0 -a 0 -r rules/best64.rule hashes.txt rockyou.txtFor each word in the dictionary, hashcat applies every rule in the file. If rockyou.txt has 14 million words and best64.rule has 64 rules, hashcat generates ~900 million candidates.
password → Password (capitalize)password → password1 (append digit)password → p@ssword (leet-speak)password → drowssap (reverse)best64.rule — 64 high-yield rulesd3ad0ne.rule — ~35K rulesdive.rule — ~99K rules-a 1)The combinator attack concatenates every word from the first dictionary with every word from the second dictionary. This catches multi-word passwords like solarwind or bluedragon.
# Combinator attack: dict1 x dict2
hashcat -m 0 -a 1 hashes.txt dict1.txt dict2.txt| dict1.txt | dict2.txt | Candidates Generated |
|---|---|---|
| sun | flower | sunflower |
| sun | light | sunlight |
| blue | flower | blueflower |
| blue | light | bluelight |
Candidate count: If dict1 has N words and dict2 has M words, the combinator produces N × M candidates. 10,000 × 10,000 = 100 million candidates.
The quality of a dictionary attack depends entirely on the wordlist. These are the most widely used in the security community.
| Wordlist | Size | Source | Notes |
|---|---|---|---|
| rockyou.txt | ~14M passwords | 2009 RockYou breach | De facto standard; ships with Kali Linux |
| SecLists | Varies | Daniel Miessler (GitHub) | Curated collection of many wordlists |
| CrackStation | ~1.5B entries | crackstation.net | Massive; 15 GB uncompressed |
| Custom lists | Varies | You create them | Target-specific: company names, keywords |
Tip: Always start with rockyou.txt + best64.rule. This combination cracks a surprising percentage of weak passwords in minutes.
Choose your attack mode based on what you know about the target passwords.
rockyou.txt (-a 0)-r rules/best64.rule-a 1) with themed word listsd3ad0ne.rule or dive.rule for deeper coverageReal-world stat: Dictionary attacks with rules typically crack 60-80% of password hashes from typical database breaches. Most users pick common words with predictable modifications.
Cracking two well-known MD5 hashes with a dictionary attack.
hashes.txt with two MD5 hashes:
5f4dcc3b5aa765d61d8327deb882cf99
e10adc3949ba59abbe56e057f20f883ehashcat -m 0 -a 0 -o results.txt hashes.txt rockyou.txtresults.txt — should find "password" and "123456"hashcat -m 0 -a 0 -r rules/best64.rule hashes.txt rockyou.txtrockyou.txt wordlisthashes.txt with two known MD5 hashesbest64.rule and compare performance