Hashcat: GPU Password Cracking for Penetration Testers" subtitle: "From NTLM hashes to bcrypt — a practical guide

Hackita — Wed, 13 May 2026 13:28:10 GMT

https://hackita.it/articoli/hashcat

When you capture a hash during a pentest, cracking it quickly can make the difference between a dead end and full domain compromise. Hashcat is the go-to tool for this — GPU-accelerated, flexible, and brutally fast.

Why Hashcat

Hashcat leverages the GPU instead of the CPU. On an RTX 3060, NTLM hashes run at around 15 GH/s — that's 15 billion attempts per second. The entire RockYou wordlist (14.3 million passwords) is exhausted in under one second.

Core Attack Modes

Mode	Flag	Description
Dictionary	`-a 0`	Wordlist attack
Combinator	`-a 1`	Combines two wordlists
Brute-force	`-a 3`	Mask-based exhaustive search
Rule-based	`-a 0 -r`	Applies mutation rules to wordlist

Common Hash Types

# NTLM (Windows)
hashcat -m 1000 -a 0 hashes.txt rockyou.txt

# NTLMv2 (captured with Responder)
hashcat -m 5600 -a 0 hashes.txt rockyou.txt

# SHA-256
hashcat -m 1400 -a 0 hashes.txt rockyou.txt

# bcrypt
hashcat -m 3200 -a 0 hashes.txt rockyou.txt

Real Scenario: NTLM from Responder

You're on an internal network. You run Responder, intercept an NTLMv2 challenge, and save it to a file. Then:

hashcat -m 5600 -a 0 captured.txt /opt/SecLists/Passwords/Leaked-Databases/rockyou.txt -r /usr/share/hashcat/rules/best64.rule

The -r best64.rule applies 64 common mutations (capitalization, number appending, symbol substitution) — significantly increasing hit rate without blowing up the keyspace.

Checking Results

hashcat -m 1000 hashes.txt rockyou.txt --show

Common Errors

Token length exception — hash format doesn't match the selected mode. Fix:

hashcat --example-hashes | grep -i ntlm

No devices found — GPU drivers not installed or OpenCL missing. On Kali:

sudo apt install nvidia-driver-525 nvidia-cuda-toolkit

Hackita