Hashcat Word lists and Rules

Specific Word lists

Word ListUse caseLink

Kerberoast_pws

SPN cracking

weakpass_3w

8-24 characters

weakpass_3p

Contains only printable characters

Word list from cracked hashes

Locate pot-file

find / -name hashcat.potfile 2> /dev/null

Place the cracked hash passwords into its own word list.

cat [PotFile] | sed 's/[^:]*://' > CrackedHashesWordlist.txt

Word list from website scraping

cewl [URL] -d 3 -m 5 --with-numbers | tee Wordlists/CewlWordList.txt

NSA Rules

Github: https://github.com/NSAKEY/nsa-rules

git clone https://github.com/NSAKEY/nsa-rules.git

OneRuleToRuleThemAllStill

An updated and improved variation of the popular OneRuleToRuleThemAll rule set. This updated rule set should provide the same effective crackrate as OneRule with a reduction in total cracking time.

Blog Post: https://in.security/2023/01/10/oneruletorulethemstill-new-and-improved/

Github: https://github.com/stealthsploit/OneRuleToRuleThemStill

git clone https://github.com/stealthsploit/OneRuleToRuleThemStill.git

Unic0rn28 Hashcat Rules

Github: https://github.com/Unic0rn28/hashcat-rules

git clone https://github.com/Unic0rn28/hashcat-rules.git

Brute Force Mask

hashcat -m 13100 -O -a3 ?a?a?a?a?a?a?a?a --increment # Bruteforce all upto 8 characters

Reviewing cracked passwords

Hashcat can display credentials in [Username]:[Password] format. Adjust the command below to match the correct method for the hashfile and the --outfile-format value to whichever looks best. For NTLM and Secretsdump the command below should work fine.

hashcat -m 1000 SecretsDump.txt --show --username --outfile-format 2 | sort

Last updated