Pentest Everything
Ask or search…
K
Links

Hashcat Word lists and Rules

Word List
Link
AllInOne
Rockyou2021
Weakpass_3a
Top2Billion-probable-v2

Specific Word lists

Word List
Use case
Link
Kerberoast_pws
SPN cracking
weakpass_3w
8-24 characters
weakpass_3p
Contains only printable characters

Word list from cracked hashes

Locate pot-file
find / -name hashcat.potfile 2> /dev/null
Place the cracked hash passwords into its own word list.
cat [PotFile] | sed 's/[^:]*://' > CrackedHashesWordlist.txt

Word list from website scraping

cewl [URL] -d 3 -m 5 --with-numbers | tee Wordlists/CewlWordList.txt

NSA Rules

git clone https://github.com/NSAKEY/nsa-rules.git

OneRuleToRuleThemAllStill

An updated and improved variation of the popular OneRuleToRuleThemAll rule set. This updated rule set should provide the same effective crackrate as OneRule with a reduction in total cracking time.
git clone https://github.com/stealthsploit/OneRuleToRuleThemStill.git

Unic0rn28 Hashcat Rules

git clone https://github.com/Unic0rn28/hashcat-rules.git

Brute Force Mask

hashcat -m 13100 -O -a3 ?a?a?a?a?a?a?a?a --increment # Bruteforce all upto 8 characters

Reviewing cracked passwords

Hashcat can display credentials in [Username]:[Password] format. Adjust the command below to match the correct method for the hashfile and the --outfile-format value to whichever looks best. For NTLM and Secretsdump the command below should work fine.
hashcat -m 1000 SecretsDump.txt --show --username --outfile-format 2 | sort
Last modified 1mo ago