Hashcat
tips & tricks.

Attack modes

Every Hashcat run takes an -a attack mode:

• -a 0 — straight wordlist
• -a 1 — combination (word1 + word2)
• -a 3 — mask attack (templated brute-force)
• -a 6 — wordlist + mask (hybrid)
• -a 7 — mask + wordlist (hybrid, reversed)

Common mode numbers

Hashcat identifies hash formats by number (-m). A few of the most useful:

Example: wordlist + rules

hashcat -a 0 -m 0 hash.txt rockyou.txt -r rules/best64.rule

The best64.rule file ships with Hashcat and applies a curated 64 common transformations to every candidate.

Example: mask attack

Mask attacks are brute-force with a template. Charset tokens: ?l lowercase, ?u upper, ?d digit, ?s symbol, ?a all.

hashcat -a 3 -m 1400 hash.txt ?u?l?l?l?l?l?d?d

That searches Passwo12, Summer25, and 2.6 billion similar candidates.

Status and resume

Press s during a run for status. Press p to pause, r to resume, q to quit. Hashcat writes a .restore file to resume later:

hashcat --session=run1 -a 0 -m 0 hash.txt rockyou.txt
# interrupt, then:
hashcat --session=run1 --restore