Combine with rule: hashcat -m [MODE] hash.txt rockyou.txt -r best64.rule
John rules: john --rules=Jumbo --wordlist=rockyou.txt hash.txt
Cupp for personalised wordlist (social engineering context)
Known policy/pattern? Mask attack: hashcat -a 3 -m [MODE] hash.txt ?u?l?l?l?l?d?d?s (or crunch to a file)
SecLists password lists for specific services
Try top 10 most common passwords before full wordlist
🎯 Operational Context
Use when: Basic rockyou wordlist exhausted — apply Hashcat rules to generate mutations (capitalizations, substitutions, appended numbers) from base wordlists.
Think Dumber First:hashcat -a 0 -m [MODE] hash.txt rockyou.txt -r /usr/share/hashcat/rules/best64.rule generates 64 mutations per word = 900M+ candidates from rockyou. This covers most corporate passwords. Use dive.rule for deeper coverage.
Skip when: Hash is bcrypt with high cost factor — rule expansion makes an already slow attack exponentially worse.
hashcat -a 0 -m 1000 hash.txt company.wordlist -r /usr/share/hashcat/rules/best64.rule
Targeted Profiling Attack — Full Workflow
Scenario: crack hash for a specific user from OSINT data.
# 1. Build base wordlist from OSINT (name, company, city, pets, dates)cat > passlist.txt << EOFSanFranciscoAugust1998NexuraBellaMariabaseballEOF# 2. Check minimum length requirement (e.g., policy = 12 chars)# Single keywords like "Bella" = 5 chars → fail# Need combinator: "baseball" + "1998" = 12 chars → try# 3. Generate combined candidateshashcat -a 1 passlist.txt passlist.txt --stdout > combined.txt# "baseball1998", "NexuraBella", "MariaAugust", etc.# 4. Apply complexity ruleshashcat -a 0 -m 1000 hash.txt combined.txt -r custom.rule
Mask & Pattern Attacks — When You Know the Shape
When you know the password policy or a likely pattern (e.g. “capital word + 4 digits + symbol”, or “Season+Year”), don’t grind a dictionary — generate exactly those candidates. Much smaller keyspace, much faster.
# 8 chars: 1 upper, 5 lower, 2 digits → "Summer12"-shapedhashcat -a 3 -m [MODE] hash.txt ?u?l?l?l?l?l?d?d# Known prefix + variable suffix (corporate "Welcome"/company name + year/symbol)hashcat -a 3 -m [MODE] hash.txt Welcome?d?d?d?dhashcat -a 3 -m [MODE] hash.txt [COMPANY]@?d?d?d?d# Custom charset (-1 = upper+lower) with length incrementhashcat -a 3 -m [MODE] hash.txt -1 ?u?l --increment ?1?1?1?1?1?1?1?1
Hybrid attacks — bolt a mask onto dictionary words (the classic Password2025! shape):
hashcat -a 6 -m [MODE] hash.txt rockyou.txt ?d?d?d?d # word + 4 trailing digitshashcat -a 7 -m [MODE] hash.txt ?d?d?d?d rockyou.txt # 4 leading digits + word
crunch — write a pattern/charset wordlist to a file (for tools that need a list: hydra, john, nxc spraying). Placeholders: @=lower, ,=upper, %=digit, ^=symbol.
maskprocessor (mp64) — crunch-like, but with hashcat mask syntax, straight to a file:
mp64 'Welcome?d?d?d?d' > welcome_years.txt
Derive the mask from the policy. If the policy is “≥8 chars, 1 upper, 1 digit, 1 symbol,” most users do the minimum: Word123! → mask ?u?l?l?l?d?d?d?s. Match the mask to the policy and you catch the compliant-but-lazy majority that rockyou misses. Mask keyspace grows fast — keep masks tight and prefer hybrid (-a 6/7) over pure -a 3 past ~8 chars.
Worked Example — “Season + Year” (the most common corporate pattern)
Seasons are a tiny fixed set, so this is a hybrid attack, not a pure mask: a seasons wordlist + a mask for the year and symbol.
# 1. Seasons base (both cases)printf 'Spring\nSummer\nAutumn\nFall\nWinter\nspring\nsummer\nautumn\nfall\nwinter\n' > seasons.txt# 2. Hybrid: season + 4-digit year + symbol → Summer2024!, Winter2023@, ...hashcat -a 6 -m [MODE] hash.txt seasons.txt ?d?d?d?d?s# also worth a run without the trailing symbol:hashcat -a 6 -m [MODE] hash.txt seasons.txt ?d?d?d?d
Tighten to realistic years — ?d?d?d?d tries 0000–9999; a recent calendar range is far smaller and near-instant. Generate to a file:
for s in Spring Summer Autumn Fall Winter; do for y in $(seq 2018 2025); do printf '%s%s\n%s%s!\n' "$s" "$y" "$s" "$y"; done; done > season_year.txt
KeePass / finicky hashes: if hashcat balks (e.g. the 13400 Salt-value exception — see Attacking_KeePass), generate the list with hashcat and crack with John:
hashcat -a 6 seasons.txt ?d?d?d?d?s --stdout > season_year.txtjohn --wordlist=season_year.txt kp.hash && john --show kp.hash
Built-In Rulesets Priority
best64.rule — start here, covers most real-world patterns
dive.rule — larger, more aggressive (slower)
rockyou-30000.rule — designed to pair with rockyou wordlist
Custom rules — when you have OSINT on the specific target
🛠️ Troubleshooting & Edge Cases
Problem
Cause
Fix
Rules not improving crack rate
Wrong rules for target
For corporate: OneRuleToRuleThemAll.rule; for personal: best64 + Clem9669; for AD: corporate.rule
Rule file not found
Default hashcat rules path
Check: /usr/share/hashcat/rules/ on Kali; download from hashcat GitHub if missing
Combination of wordlist + rules too large
Memory exhausted
Use -S (slow candidates mode) or pipe through hashcat stdin for streaming
Hashcat mask attack syntax wrong
Character set format
Example 8-char: hashcat -a 3 -m [MODE] hash.txt ?u?l?l?l?l?l?d?d for one upper, 5 lower, 2 digits
Prince attack not available
PRINCE rule not in hashcat
Use princeprocessor separately: pp.bin wordlist.txt | hashcat -a 0 -m [MODE] hash.txt -
📝 Reporting Trigger
Finding Title: Password Mutation Rules Crack Complexity-Compliant Passwords
Impact: Hashcat rule-based attacks crack passwords that technically meet complexity requirements (uppercase, number, special char) but follow predictable mutation patterns (e.g., Password1!, Welcome@1), rendering complexity policies ineffective without passphrase enforcement.
Root Cause: Password policy enforces complexity without prohibiting predictable mutation patterns. Users systematically apply minimal complexity to memorable base words.
Recommendation: Implement passphrase-based password policy (4+ random words, 20+ chars) over traditional complexity rules. Deploy password breach checking that detects rule-predictable patterns. Consider hardware MFA tokens to reduce password-only authentication risk.