Dictionaries

See also SecLists and crackstation.

Good with unsalted fast hashes like NTLM, SHA1, MD5, SHA256, etc.

dictionaries

Google Books 1-gram corpus, cleaned. Base words list, can't remember where this was culled from.

Rules

L33t substitution rules for hashscat - 1,576 rules

Case permutations up to 14 chars, useful if you have LM cracks and want to apply to NTLM.

All possible case permutations up to 16 chars l33tified InsidePro-PasswordsPro.rule

Examples

-O exists on hashcat-4.x - remove if you have an earlier version.

Try your cracked LM hashes against NTLM

hashcat64.exe -O -m 1000 ntlmhashes.txt lm-cracks.txt -r rules/allcase.rule

Decent dictionary plus rules - will also do for md5 (-m 0) or sha1 (-m 100):

hashcat64.exe -O -m 1000 ntlmhashes.txt troyhunt.txt -r rules/InsidePro-PasswordsPro.rule --loopback

hashcat64.exe -O -m 1000 ntlmhashes.txt crackstation.txt -r rules/InsidePro-PasswordsPro.rule --loopback

hashcat64.exe -O -m 1000 ntlmhashes.txt phrases.txt -r rules/InsidePro-PasswordsPro.rule --loopback

Mask attack using /usr/share/dict/words - hoping to pickup Foobar123, Foobar123! for example

hashcat64.exe -O -m 1000 -a6 ntlmhashes.txt dict/words.txt ?a?a?a -i

hashcat64.exe -O -m 1000 -a6 ntlmhashes.txt dict/words.txt -1 ?d?s ?1?1?1?1 -i

More examples

Attacking Troy Hunt's SHA1 list, once you've tried -a3 (mask) and -a0 (dict+rules)

hashcat-4.0.1\hashcat64.exe -m 100 uncracked-sha1.txt -a1 dict\openwall_all.txt dict\last3.txt -O
hashcat-4.0.1\hashcat64.exe -m 100 uncracked-sha1.txt -a1 dict\openwall_all.txt dict\last4.txt -O 
hashcat-4.0.1\hashcat64.exe -m 100 uncracked-sha1.txt -a1 dict\found.txt dict\last3.txt -O 
hashcat-4.0.1\hashcat64.exe -m 100 uncracked-sha1.txt -a1 dict\words.txt dict\last3.txt -O 
hashcat-4.0.1\hashcat64.exe -m 100 uncracked-sha1.txt -a1 dict\found.txt dict\last3.txt -O 
hashcat-4.0.1\hashcat64.exe -m 100 uncracked-sha1.txt -a1 dict\uniqb.txt dict\last3.txt -O


hashcat-4.0.1\hashcat64.exe -m 100 uncracked-sha1.txt -a1 dict\words.txt dict\first3.txt -O 
hashcat-4.0.1\hashcat64.exe -m 100 uncracked-sha1.txt -a1 dict\words.txt dict\first4.txt -O 

hashcat-4.0.1\hashcat64.exe -m 100 uncracked-sha1.txt -a1 dict\ucwords.txt dict\last4.txt -O 
hashcat-4.0.1\hashcat64.exe -m 100 uncracked-sha1.txt -a1 dict\words.txt dict\last5.txt -O 

hashcat-4.0.1\hashcat64.exe -m 100 uncracked-sha1.txt -a1 dict\rockyou.txt dict\last3.txt -O 
hashcat-4.0.1\hashcat64.exe -m 100 uncracked-sha1.txt -a1 dict\rockyou.txt dict\last4.txt -O 

hashcat-4.0.1\hashcat64.exe -m 100 uncracked-sha1.txt -a1 dict\words.txt dict\last5.txt -O 
hashcat-4.0.1\hashcat64.exe -m 100 uncracked-sha1.txt -a1 dict\words.txt dict\last6.txt -O 
hashcat-4.0.1\hashcat64.exe -m 100 uncracked-sha1.txt -a1 dict\words.txt dict\last7.txt -O 
hashcat-4.0.1\hashcat64.exe -m 100 uncracked-sha1.txt -a1 dict\words.txt dict\last8.txt -O 

hashcat-4.0.1\hashcat64.exe -m 100 uncracked-sha1.txt -a1 dict\found.txt dict\last4.txt -O 

hashcat-4.0.1\hashcat64.exe -m 100 uncracked-sha1.txt -a1 dict\uniqb.txt dict\last4.txt -O 

hashcat-4.0.1\hashcat64.exe -m 100 uncracked-sha1.txt -a1 dict\uniqb-nospace.txt dict\last4.txt -O 

hashcat-4.0.1\hashcat64.exe -m 100 uncracked-sha1.txt -a1 dict\Top102Million-probable-WPA.txt dict\last3.txt -O 

hashcat-4.0.1\hashcat64.exe -m 100 uncracked-sha1.txt -a1 dict\dicts.txt dict\last3.txt -O 

hashcat-4.0.1\hashcat64.exe -m 100 uncracked-sha1.txt -a7 -1 ?u?l -2 ?u?l?d ?1?2 dict\crackstation.txt -O  

hashcat-4.0.1\hashcat64.exe -m 100 uncracked-sha1.txt -a7 -1 ?u?l -2 ?u?l?d ?1?2 dict\crackstation.txt -O  

hashcat-4.0.1\hashcat64.exe -m 100 uncracked-sha1.txt -a7 ?a?a -i dict\last5.txt -O 
hashcat-4.0.1\hashcat64.exe -m 100 uncracked-sha1.txt -a7 ?a?a -i dict\last6.txt -O 
hashcat-4.0.1\hashcat64.exe -m 100 uncracked-sha1.txt -a7 ?a?a -i dict\last7.txt -O