Selecting and using hashcat rules

Hashcat rules use a similar construction format to John rules and are called from the command line, just like John rules are. However, hashcat rules are often standalone as a separate file, and hashcat rules are more readily able to be contributed to the community, as opposed to us having to integrate the changes into the john.conf file in John.

With its focus on GPU-accelerated cracking, hashcat expects a constant stream of input to ensure the GPU is fully utilized for maximum efficiency. As such, hashcat rules tend to be a bit more aggressive than some of the John rules we have seen.

Hashcat rule construction is well defined on the following web page at the time of writing: https://hashcat.net/wiki/doku.php?id=rule_based_attack.

Common readily available hashcat rules are included with the hashcat repository and can be cloned from the hashcat GitHub repository at https://github.com/hashcat/hashcat.

Choosing which hashcat rules you should...