Using hashcat for Password Recovery

If you have ever captured a WPA handshake with your BLEShark Nano and wondered what to do with that .pcap file, the answer is almost always hashcat. It is the fastest password recovery tool available, and it runs on your GPU - which means cracking speeds that CPU-based tools simply cannot match.

This guide covers everything you need to get started: installation, attack modes, hash types, and the practical realities of how long cracking actually takes.

What Is hashcat?

hashcat is an open-source password recovery tool. It takes a hash - a one-way cryptographic representation of a password - and tries to find the original plaintext by computing millions (or billions) of candidate hashes per second using your GPU.

It supports over 350 hash types, from simple MD5 to bcrypt to WPA2. It runs on Windows, Linux, and macOS, and supports NVIDIA (CUDA), AMD (OpenCL), and Intel GPUs.

The key thing to understand: hashcat does not "decrypt" passwords. Hashes are one-way functions. What hashcat does is generate candidate passwords, hash them with the same algorithm, and compare the result to the target hash. When there is a match, you have found the password.

How Hashing Works (And Why It Matters)

graph TD
    subgraph "Password Hashing Process"
        A["Plaintext Password\n'MyP@ss2024'"] --> B["Hash Function\n(e.g., SHA-256)"]
        B --> C["Hash Output\na3f2b8c9d1..."]
    end
    subgraph "hashcat Recovery Process"
        D["Candidate Password\n'password123'"] --> E["Same Hash Function\nSHA-256"]
        E --> F["Computed Hash\n5e884898da..."]
        F --> G{"Match Target?"}
        G -->|No| H["Try Next\nCandidate"]
        H --> D
        G -->|Yes| I["Password Found"]
    end
    subgraph "Hash Properties"
        J["One-Way"] --> K["Cannot Reverse"]
        L["Deterministic"] --> M["Same Input =\nSame Output"]
        N["Fixed Length"] --> O["Any Input Size\n= Same Hash Size"]
    end

How hashcat recovers passwords - computing candidate hashes and comparing against the target

Different hash algorithms have very different computational costs. MD5 is cheap - a modern GPU can compute billions per second. bcrypt is deliberately slow - maybe a few thousand per second on the same hardware. This difference in cost is the single most important factor in whether a cracking attempt will succeed.

Salted hashes add another layer. A salt is a random value mixed into the password before hashing, which means two users with the same password produce different hashes. WPA2 uses the SSID as the salt, which is why you need to specify the network name during cracking.

Installation and GPU Setup

On Linux (Debian/Ubuntu):

sudo apt install hashcat
hashcat --benchmark

On Windows, download the binary from the hashcat website and extract it. You will need up-to-date GPU drivers - NVIDIA users need the latest CUDA toolkit, AMD users need ROCm or the OpenCL runtime.

The benchmark command (hashcat -b) is critical. Run it first. It tells you your cracking speed for every supported hash type and confirms your GPU is working correctly. If benchmark speeds are unusually low, your GPU drivers are probably wrong.

Some important flags to know from the start:

-m [number]    # Hash mode (algorithm type)
-a [number]    # Attack mode
-o output.txt  # Output file for cracked passwords
--potfile-path # Custom potfile location
-w 3           # Workload profile (1=low, 3=high, 4=insane)
--force        # Override warnings (use carefully)

Hash Modes - Picking the Right One

Every hash algorithm has a mode number in hashcat. Get the wrong mode and you will crack nothing - even if the password is in your wordlist. Here are the modes you will encounter most often:

If you are not sure what hash type you are looking at, the tool hashid or hash-identifier can help narrow it down. For WPA captures from the BLEShark Nano, you will typically convert the .pcap to .hc22000 format using hcxpcapngtool and use mode 22000.

Attack Types

graph TD
    subgraph "Attack Mode 0 - Straight/Dictionary"
        A["Wordlist File"] --> B["password\n123456\nletmein\n..."]
        B --> C["Hash Each Word"]
        C --> D["Compare to Target"]
    end
    subgraph "Attack Mode 1 - Combination"
        E["Wordlist 1\nhello\nworld"] --> G["Combine Pairs"]
        F["Wordlist 2\n123\n456"] --> G
        G --> H["hello123\nhello456\nworld123\nworld456"]
    end
    subgraph "Attack Mode 3 - Brute Force/Mask"
        I["Mask: ?u?l?l?l?d?d"] --> J["Abcd12\nZxyw99\nPass42\n..."]
        J --> K["All Combinations\nWithin Pattern"]
    end
    subgraph "Attack Mode 6 - Hybrid"
        L["Wordlist + Mask"] --> M["password1\npassword2\n...password99"]
    end

The four primary hashcat attack modes and how they generate candidates

Straight/Dictionary Attack (mode 0): The simplest and most effective starting point. You feed hashcat a wordlist, and it tries every entry. The quality of your wordlist determines your success rate.

hashcat -m 0 -a 0 hashes.txt rockyou.txt

The rockyou.txt wordlist contains about 14 million passwords from a real breach and is a solid starting point. For more comprehensive lists, SecLists on GitHub has dozens of curated wordlists organized by category.

Combination Attack (mode 1): Takes two wordlists and combines every entry from the first with every entry from the second. Useful when you suspect passwords are built from two common words.

hashcat -m 0 -a 1 hashes.txt words1.txt words2.txt

Brute Force/Mask Attack (mode 3): Tries every possible combination within a defined pattern. This is where mask syntax comes in:

?l = lowercase letter (a-z)
?u = uppercase letter (A-Z)
?d = digit (0-9)
?s = special character
?a = all printable characters

Example - all 8-character passwords starting with an uppercase letter followed by 5 lowercase and 2 digits:

hashcat -m 0 -a 3 hashes.txt ?u?l?l?l?l?l?d?d

Rule-Based Attack: This is where hashcat really shines. Rules modify each wordlist entry according to transformation rules - capitalize, append numbers, substitute characters, reverse, and dozens more.

hashcat -m 0 -a 0 hashes.txt rockyou.txt -r rules/best64.rule

The best64.rule file ships with hashcat and applies 64 common transformations to each wordlist entry. The dive.rule file is more aggressive with over 99,000 rules. You can also write custom rules.

Practical Examples

Cracking NTLM hashes from a Windows SAM dump:

hashcat -m 1000 -a 0 ntlm_hashes.txt rockyou.txt -r rules/best64.rule -o cracked.txt

NTLM is fast to crack. An RTX 4090 does roughly 160 billion NTLM hashes per second. Most passwords under 8 characters will fall to a dictionary plus rules attack within minutes.

Cracking a Linux shadow file hash (sha512crypt):

hashcat -m 1800 -a 0 shadow_hash.txt rockyou.txt -o cracked.txt

sha512crypt is deliberately slow - about 1.5 million hashes per second on a 4090. Brute force is impractical here. You need good wordlists and rules.

Cracking NetNTLMv2 from a Responder capture:

hashcat -m 5600 -a 0 net_ntlmv2.txt rockyou.txt -r rules/best64.rule

Performance and Realistic Expectations

This is where most people get disappointed. Cracking is fast for weak hashes and weak passwords. For everything else, it is a game of patience and strategy.

Approximate speeds on an NVIDIA RTX 4090:

For WPA2, brute-forcing a truly random 8-character password is not feasible. But most people do not use truly random passwords for their WiFi. Common patterns like a word followed by numbers, a phone number, or a name with a year are very crackable with the right wordlist and rules.

Multiple GPUs scale linearly. Two 4090s give you roughly double the speed. Cloud GPU instances (AWS, Google Cloud, vast.ai) are an option for one-off jobs where buying hardware does not make sense.

Rules and Masks - The Real Power

Understanding rule syntax separates effective cracking from wasting electricity. Here are the most useful rules:

:     # Do nothing (use word as-is)
c     # Capitalize first letter
u     # Uppercase all
l     # Lowercase all
$1    # Append '1'
^!    # Prepend '!'
sa@   # Substitute 'a' with '@'
se3   # Substitute 'e' with '3'
d     # Duplicate word (passwordpassword)
r     # Reverse word

A custom rule file is just a text file with one rule per line:

# my_rules.rule
:
c
c$1
c$1$2$3
sa@se3
c$!
u
$2$0$2$4
$2$0$2$5

You can chain rules. csa@$1 capitalizes the first letter, substitutes a with @, and appends 1. So "password" becomes "P@ssword1".

For masks, the --increment flag is invaluable. It tries all lengths from the minimum to the mask length:

hashcat -m 0 -a 3 hashes.txt ?a?a?a?a?a?a?a?a --increment --increment-min=4

This tries all 4-character through 8-character combinations. For large keyspaces, use -w 3 to push your GPU harder, but be aware of thermal throttling.

Cracking WPA/WPA2 Handshakes

This is the workflow most relevant to BLEShark Nano users. You have captured a handshake in .pcap format. Here is the full process:

Step 1: Convert the capture

hcxpcapngtool -o hash.hc22000 capture.pcap

If you captured a PMKID (which does not require a client to be connected), it will also be included in the .hc22000 file.

Step 2: Start with a dictionary attack

hashcat -m 22000 -a 0 hash.hc22000 rockyou.txt

Step 3: Try rules

hashcat -m 22000 -a 0 hash.hc22000 rockyou.txt -r rules/best64.rule

Step 4: Try common WiFi patterns

Many home WiFi passwords are 8 digits (default on many ISP routers):

hashcat -m 22000 -a 3 hash.hc22000 ?d?d?d?d?d?d?d?d

Or a common word followed by digits:

hashcat -m 22000 -a 6 hash.hc22000 common_words.txt ?d?d?d?d

Step 5: Check results

hashcat -m 22000 hash.hc22000 --show

WPA2 cracking is slow at about 1.6 million hashes per second on a 4090. An 8-digit numeric password has 100 million combinations and will crack in about a minute. An 8-character alphanumeric password has over 2 trillion combinations and would take weeks.

Tips for Effective Cracking

Build targeted wordlists. If you know anything about the target (company name, location, common terms), create a custom wordlist. Tools like CeWL can scrape websites to generate wordlists from their content.

Use the potfile. hashcat maintains a potfile of all previously cracked hashes. It automatically skips already-cracked hashes, saving time on repeated runs.

Session management. Long-running attacks should use sessions:

hashcat -m 22000 hash.hc22000 rockyou.txt --session=wpa_crack
# Resume later:
hashcat --session=wpa_crack --restore

Temperature monitoring. GPUs under sustained load will thermal throttle. Use --hwmon-temp-abort=90 to kill the process before damage occurs. Keep your case well-ventilated.

Try the obvious first. Before running a 48-hour brute force, try the most likely patterns. Most WiFi passwords cracked in real engagements fall to a wordlist with basic rules within the first hour.

Distributed cracking. hashcat supports splitting keyspaces across multiple machines using --skip and --limit. For team environments, Hashtopolis provides a web interface for distributed cracking jobs.

This article is for educational and authorized security testing purposes only. Only test passwords on systems you own or have explicit written permission to test. Unauthorized password cracking is illegal in most jurisdictions.