Hashcat

Dictionary

hashcat -m 1000 hashes_dump ../wordlists/rockyou.txt -r ../rules/OneRuleToRuleThemAll.rule
hashcat -m 1000 hashes_dump ../wordlists/dutch* -r ../rules/OneRuleToRuleThemAll.rule
hashcat -m 1000 hashes_dump ../wordlists/xato-net-10-million-passwords.txt -r ../rules/OneRuleToRuleThemAll.rule

Seasons/months (Dutch / English)

python3 exrex.py -v "((W|w)inter|(Z|z)omer|(H|h)erfst|(L|l)ente)20(16|17|18|19|20|21|22|23|24)" > seasons_months.txt
python3 exrex.py -v "((J|j)anuari|(F|f)ebruari|(M|m)aart|(A|a)pril|(M|m)ei|(J|j)uni|(J|j)uli|(A|a)ugustus|(S|s)eptember|(O|o)ktober|(N|n)ovember|(D|d)ecember)20(16|17|18|19|20|21|22|23|24)" >> seasons_months.txt

python3 exrex.py -v "((W|w)inter|(S|s)ummer|(F|f)all|(A|a)utumn|(S|s)pring)20(16|17|18|19|20|21|22|23|24)" > seasons_months.txt
python3 exrex.py -v "((J|j)anuary|(F|f)ebruary|(M|m)arch|(A|a)pril|(M|m)ay|(J|j)une|(J|j)uly|(A|a)ugust|(S|s)eptember|(O|o)ctober|(N|n)ovember|(D|d)ecember)20(16|17|18|19|20|21|22|23|24)" >> seasons_months.txt

hashcat -m 1000 hashes_dump seasons_months.txt -r ../rules/OneRuleToRuleThemAll.rule

Custom (pre-owned passwords)

hashcat -m 1000 hashes_dump pass.txt -r ../rules/OneRuleToRuleThemAll.rule

Full Brute

predefined charsets

?l = abcdefghijklmnopqrstuvwxyz
?u = ABCDEFGHIJKLMNOPQRSTUVWXYZ
?d = 0123456789
?s = «space»!"#$%&'()*+,-./:;<=>?@[\]^_`{|}~
?a = ?l?u?d?s
?b = 0x00 - 0xff

Brute force all passwords length 1-8 with possible characters A-Z a-z 0-9 «space»-~

hashcat -m 1000 hashes_dump -a 3 \?a\?a\?a\?a\?a\?a\?a\?a --increment

Hashcat's default mask (will auto-select)

hashcat -m 1000 hashes_dump -a 3

Keywalk

./kwp -z basechars/full.base keymaps/en-us.keymap routes/2-to-16-max-3-direction-changes.route > keymap.txt

hashcat -m 1000 hashes_dump ../wordlists/keymap.txt -r ../rules/OneRuleToRuleThemAll.rule

Website scraping

cewl https://www.example.com -m 4 -w example-cewl.txt

hashcat -m 1000 hashes_dump example-cewl.txt -r ../rules/OneRuleToRuleThemAll.rule

AD info (samaccountname / desc / titles)

$temp = Get-NetUser -UACFilter NOT_ACCOUNTDISABLE
$temp | ForEach-Object -Process {$_.samaccountname} > samaccountnames.txt

$temp = Get-NetUser -UACFilter NOT_ACCOUNTDISABLE
$temp | ForEach-Object -Process {$_.userprincipalname} > userprincipalnames.txt

hashcat -m 1000 hashes_dump users.txt -r ../rules/OneRuleToRuleThemAll.rule

Show cracked

hashcat -m 1000 hashes_dump --show --username

--username is optional