Hashcat Cheat Sheet

Hashcat cracks hashes the same way John does — but using your GPU instead of CPU, which makes it dramatically faster for cracking at real scale.

Red Team / Offensive Use

Reach for hashcat over John when you have serious cracking to do and GPU hardware available: a large dump of NTLM hashes from a domain controller, or a hash type slow enough (bcrypt, for example) that CPU cracking would take unreasonably long. For quick, small jobs on a laptop without a discrete GPU, John is often simpler; hashcat is where you go once volume or hash complexity actually demands the speed.

Established Cheatsheet

Official hashcat wiki — the authoritative reference for hash-mode numbers, attack modes, and current syntax, maintained by the project itself.

PWNMI's Top 5 Use Cases

• hashcat -m 1000 -a 0 hashes.txt rockyou.txt — dictionary attack against NTLM hashes (-m 1000); -a 0 is straight/dictionary mode
• hashcat -m 1000 -a 0 hashes.txt rockyou.txt -r rules/best64.rule — same, with a rule file applied to each wordlist entry — often the single biggest improvement over a plain dictionary run
• hashcat -m 1000 -a 3 hashes.txt ?a?a?a?a?a?a — brute-force/mask mode, trying all combinations of a defined character set at a fixed length; a last resort once wordlists are exhausted
• hashcat --show hashes.txt — display already-cracked results from a prior session without re-running the attack
• hashcat -m 1800 -a 0 hashes.txt rockyou.txt — dictionary attack against a slow hash type (SHA-512 crypt, mode 1800); worth knowing that mode number matters as much as the attack strategy here

Next step

Correctly identifying the hash type (the -m value) before running anything is the step people skip and regret — see the John the Ripper cheat sheet for the CPU-based alternative when a GPU isn't available.