# Hashcat Word lists and Rules ## Recommended General Large Word lists
Word ListLink
AllInOnehttps://weakpass.com/all-in-one
Rockyou2021https://weakpass.com/wordlist/1943
Weakpass_3ahttps://weakpass.com/wordlist/1948
Top2Billion-probable-v2https://weakpass.com/wordlist/1858
## Recommended General Medium Word lists
Word ListLink
hk_hlm_foundshttps://weakpass.com/wordlist/1256
RP4https://weakpass.com/wordlist/914
Ignishttps://weakpass.com/wordlist/1935
Top29Million-probable-v2https://weakpass.com/wordlist/1857
SkullSecurityComphttps://weakpass.com/wordlist/671
## Specific Word lists
Word ListUse caseLink
Kerberoast_pwsSPN crackinghttps://gist.github.com/The-Viper-One/a1ee60d8b3607807cc387d794e809f0b
weakpass_3w8-24 charactershttps://weakpass.com/wordlist/1950
weakpass_3pContains only printable charactershttps://weakpass.com/wordlist/1949
## Word list from cracked hashes Locate pot-file ``` find / -name hashcat.potfile 2> /dev/null ``` Place the cracked hash passwords into its own word list. ``` cat [PotFile] | sed 's/[^:]*://' > CrackedHashesWordlist.txt ``` ## Word list from website scraping ``` cewl [URL] -d 3 -m 5 --with-numbers | tee Wordlists/CewlWordList.txt ``` ## Recommended Rules #### NSA Rules Github: ``` git clone https://github.com/NSAKEY/nsa-rules.git ``` #### OneRuleToRuleThemAllStill An updated and improved variation of the popular OneRuleToRuleThemAll rule set. This updated rule set should provide the same effective crackrate as OneRule with a reduction in total cracking time. Blog Post: Github: ``` git clone https://github.com/stealthsploit/OneRuleToRuleThemStill.git ``` #### Unic0rn28 Hashcat Rules Github: 
git clone https://github.com/Unic0rn28/hashcat-rules.git
## Brute Force Mask ```bash hashcat -m 13100 -O -a3 ?a?a?a?a?a?a?a?a --increment # Bruteforce all upto 8 characters ``` ## Reviewing cracked passwords Hashcat can display credentials in \[Username]:\[Password] format. Adjust the command below to match the correct method for the hashfile and the --outfile-format value to whichever looks best. For NTLM and Secretsdump the command below should work fine. ``` hashcat -m 1000 SecretsDump.txt --show --username --outfile-format 2 | sort ```