{"id":2995,"date":"2020-02-17T11:25:32","date_gmt":"2020-02-17T17:25:32","guid":{"rendered":"http:\/\/www.incredigeek.com\/home\/?p=2995"},"modified":"2020-02-17T11:26:07","modified_gmt":"2020-02-17T17:26:07","slug":"hashcat-examples","status":"publish","type":"post","link":"https:\/\/www.incredigeek.com\/home\/hashcat-examples\/","title":{"rendered":"Hashcat examples"},"content":{"rendered":"\n

Rule based attack<\/h2>\n\n\n\n

Use a wordlist and best64 rules to try and crack a wordpress hash. Using rockyou.txt as an example.<\/p>\n\n\n\n

-m Specifies the hash type<\/p>\n\n\n\n

hashcat -m 400 wordpress.hash -r rules\/best64.rule wordlist\/rockyou.txt<\/pre>\n\n\n\n
wordpress.hash is a text file that contains the password hash.  You can list multiple hashes in the file<\/p>\n\n\n\n
Example contents of file<\/p>\n\n\n\n
bob@localhost:~$ cat wordpress.hash 
$P$BeJ2ZWVgSx\/rR8ifcTFyjq1ouCCWwu0
bob@localhost:~$ <\/pre>\n\n\n\n
Brute force<\/h2>\n\n\n\n
Attempt every 8 numeric combination for a WPA2 key.  <\/p>\n\n\n\n
hashcat -m 2500 -a3 capture.hccapx ?d?d?d?d?d?d?d?d<\/pre>\n\n\n\n
Hashcat built in Charsets<\/h2>\n\n\n\n
You can swap out the ?d from the above command with any of the built in character sets below.<\/p>\n\n\n\n
  ? | Charset\n ===+=========\n  l | abcdefghijklmnopqrstuvwxyz\n  u | ABCDEFGHIJKLMNOPQRSTUVWXYZ\n  d | 0123456789\n  h | 0123456789abcdef\n  H | 0123456789ABCDEF\n  s |  !\"#$%&'()*+,-.\/:;<=>?@[\\]^_`{|}~\n  a | ?l?u?d?s\n  b | 0x00 - 0xff<\/pre>\n\n\n\n
More information
https:\/\/hashcat.net\/wiki\/doku.php?id=cracking_wpawpa2<\/a>
Rule based attacks are recommended
https:\/\/hashcat.net\/wiki\/doku.php?id=rule_based_attack<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"
Rule based attack Use a wordlist and best64 rules to try and crack a wordpress hash. Using rockyou.txt as an example. -m Specifies the hash type hashcat -m 400 wordpress.hash -r rules\/best64.rule wordlist\/rockyou.txt wordpress.hash is a text file that contains … Continue reading →<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[420,573],"tags":[904,903,905,901,900,902,421,414,827,200,12,503,728,692],"class_list":["post-2995","post","type-post","status-publish","format-standard","hentry","category-hacking","category-security","tag-d","tag-l","tag-u","tag-best64","tag-brute-force","tag-charsets","tag-hacking","tag-hashcat","tag-key","tag-password","tag-passwords","tag-security","tag-wordlist","tag-wpa2"],"_links":{"self":[{"href":"https:\/\/www.incredigeek.com\/home\/wp-json\/wp\/v2\/posts\/2995","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.incredigeek.com\/home\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.incredigeek.com\/home\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.incredigeek.com\/home\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.incredigeek.com\/home\/wp-json\/wp\/v2\/comments?post=2995"}],"version-history":[{"count":2,"href":"https:\/\/www.incredigeek.com\/home\/wp-json\/wp\/v2\/posts\/2995\/revisions"}],"predecessor-version":[{"id":3018,"href":"https:\/\/www.incredigeek.com\/home\/wp-json\/wp\/v2\/posts\/2995\/revisions\/3018"}],"wp:attachment":[{"href":"https:\/\/www.incredigeek.com\/home\/wp-json\/wp\/v2\/media?parent=2995"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.incredigeek.com\/home\/wp-json\/wp\/v2\/categories?post=2995"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.incredigeek.com\/home\/wp-json\/wp\/v2\/tags?post=2995"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}