3

Let's say I have a couple of hashes that I need to bruteforce as dictionary attack didn't work. Is there a way I can tell hashcat to start from a specific password length so it won't waste resources on looking for results that won't work?

Improve this question
2
  • 1
    You mean --pw-min? If so, you will find this option in the command line help, in the manual, and in various places online.
    – schroeder ♦
    Jun 11, 2018 at 20:37
  • 1
    --pw-min and --pw-max were replaced some time ago with --increment-min and --increment-max. But this information is indeed readily available.
    – Royce Williams
    Jun 13, 2018 at 5:05

1 Answer 1

Reset to default
9

Sounds like you're looking for --increment-min. This will start a bruteforce/mask attack at a minimum length.

For example, this will try digits-only candidates, starting with length 7:

hashcat -a 3 -m [hashtype] -i --increment-min=7 targethashes.list ?d?d?d?d?d?d?d?d?d?d

You didn't directly ask this, but the deeper intent of your question appears to be "what can I do beyond a dictionary attack?"

There are many other options to try before you go full bruteforce - combinator, hybrid, masks. See hashcat's core attack modes for some introductory materials.

Improve this answer
2
  • I know that there are more, however none of them work - apparently a random password generator has been used.
    – Dariusz G. Jagielski
    Jun 14, 2018 at 10:38
  • You'd have to do a lot of work to rule out many other methods before you can even tentatively start to conclude that. The more methods you try, the more likely you are to be right, though. :)
    – Royce Williams
    Jun 14, 2018 at 13:56

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.