Open-Source Security Tools
hashcat: GPU Cracking, Rules, and Reality
hashcat is the GPU cracking engine: hash modes by the hundreds, wordlist and rule pipelines, mask attacks, and --show/--left bookkeeping that makes multi-hundred-GB password work auditable. On engagements with recovered hash sets it produces the policy-impact findings that boardroom slides are made from, and it does so at machine speeds that shaped modern password policy. It is also the tool with the least tolerance for amateur mistakes: wrong hash modes waste GPU-days, and cracked output is live credential material.
Key points
- Learn -m by heart for your common targets: -m 0 (MD5), -m 1000 (NTLM), -m 1800 (sha512crypt), and the right mode is the difference between instant and garbage.
- Attack modes are the real vocabulary: -a 0 dictionary + rule, -a 3 mask, -a 6 hybrid; each answers a different policy question.
- Rules make hashcat sing: wordlist plus rules/rockyou-30000.rule-style sets tests billions of variants without them existing on disk.
- --show (cracked), --left (uncracked), and potfile bookkeeping turn a password audit into an auditable science rather than a smoke test.
- Benchmark first, always: hashcat -b on your actual cards tells you what a mask will actually cost before a client pays GPU-hour rates.
- The performance ceiling is memory-cost hashing: bcrypt and scrypt slow GPUs enormously, and that is the point of those algorithms — plan expectations accordingly.
- Own-hardware lab ethics: crack only hashes you extracted from systems you were authorized to test (client systems under contract, lab VMs, your own accounts) — the GPU is innocent, the engagement scope is not.
- Output discipline: cracked passwords are real people's real credentials; storage is encrypted, retention matches the contract, and nothing goes into a report beyond what the client actually needs.
Field note
Two questions before every run: did I pick the right -m, and did I read what I will do with the cracked list? The first saves GPU-days; the second keeps client passwords out of a referral email — a rule from an early career mistake.
Frequently asked questions
What is the difference between -a 0 and -a 3?
-a 0 runs dictionaries and rules; -a 3 constructs by mask (upper mask, char class) brute force; hybrid (-a 6) combines both.
Do I need a specific GPU?
Any modern card helps, but cracking speed scales with hardware and hash cost; benchmarks before engagements prevent promises no card can keep.
Can hashcat crack WPA handshakes?
Yes (mode 22000 on modern builds with a properly captured handshake file), which is how the wireless cracking chain usually ends.
Local GPUs or cloud GPUs?
Local cards are cheaper for continuous work and keep data in-house; cloud bursts for one-off big runs; client-contract data-handling clauses decide which you are allowed to use.
How Kinetikatech helps with open-source security tools
We've handled this hundreds of times: The testing toolbox professionals actually keep loaded: scanners, sniffers, crackers, and web proxies explained the way they are used on real engagements — commands, flags, outputs, and where each one sits in a methodology. With Penetration Testing and Linux Server Security, you get the full loop, we assess, we implement, we watch it around the clock, and we pick up within 30 minutes when it matters.