22.4 Hashcat: Fast GPU Cracking
Hashcat is the fastest cracker; it uses the GPU, so it tries far more guesses per second than John. You must tell it the hash type with -m and the attack mode with -a.
hashcat --help | less # list hash modes (-m) and attack modes (-a)
# wordlist attack (mode 0) on MD5 hashes (mode 0 = MD5)
hashcat -m 0 -a 0 hashes.txt /usr/share/wordlists/rockyou.txt
# wordlist + rules
hashcat -m 0 -a 0 hashes.txt rockyou.txt -r /usr/share/hashcat/rules/best64.rule
# SHA-512 Linux crypt (mode 1800)
hashcat -m 1800 -a 0 shadow_hashes.txt rockyou.txt
# brute force (mode 3): 6 lowercase letters
hashcat -m 0 -a 3 hashes.txt ?l?l?l?l?l?l
# see results
hashcat -m 0 hashes.txt --show
Common -m modes: 0 MD5, 100 SHA1, 1800 sha512crypt, 3200 bcrypt, 1000 NTLM. Mask symbols: ?l lowercase, ?u uppercase, ?d digit, ?s symbol, ?a all.
Notice bcrypt (3200): it is so slow that Hashcat manages only a few thousand guesses a second instead of billions – proof of why you store passwords with bcrypt.
Ravindra Bagale's Tip
Box (kiwa VM) madhe khara GPU nasel tar Hashcat halу chalto – to normal aahe, concept shikaycha aahe. Chukicha -m number dila tar "line-length exception" yeta; hash type barobar olakhun -m dya. hashcat --example-hashes ne pratyek mode cha namuna disto.
Lab
Make an MD5 hash of a short word (echo -n hello | md5sum), put it in a file, and crack it with hashcat -m 0 -a 0. Then hash the same word with bcrypt in PHP (password_hash) and try -m 3200; note how much slower it is – that is your defence working.