hashcat Forum - All Forums

I hit what looks like a Hashcat/ ssh2john format mismatch in the SSH key passphrase l

Thu, 09 Apr 2026 18:15:54 +0000

I hit what looks like a Hashcat/
ssh2john
format mismatch in the SSH key passphrase lab.
id_rsa
is valid now —
ssh-keygen -y -f id_rsa
prompts for the passphrase.
I extracted with:

ssh2john id_rsa > ssh.hash

ssh.hash
is one clean line starting with:

id_rsa:$sshng$6$16$...

But Hashcat
v7.1.2
rejects it:

hashcat -m 22921 ssh.hash ssh.passwords -r ssh.rule

Error:

Token length exception
No hashes loaded

And:

hashcat --identify ssh.hash

returns:

No hash-mode matches the structure of the input hash.

Has anyone seen this with newer OpenSSH
$sshng$6$16$...
hashes? Is mode
22921
currently incompatible with
ssh2john
output here, or is there a different extractor/workflow I should be using?

noob needs help

Thu, 09 Apr 2026 07:07:49 +0000

help this keeps showing

Please Help !

Mon, 06 Apr 2026 14:41:36 +0000

Hi,

I actually have a Crucial X10 Pro SSD, which I locked with a password using the "Crucial Portable SSD Utility" software. I believe this software from Crucial use a 256-bit encryption to lock the SSD.

I know a couple of password options, is there any way you can help my use Hashcat for this software ?

I have lot all my collection of pictures and vidoes of my dead grandfather who I was extremely close too, I was his only grandson.

Grateful if anyone can help me !

Thanking you,
Best regards,
Ajay Shriram

I can't get it to work

Thu, 02 Apr 2026 06:25:50 +0000

I've been trying many methods to get it working since it all started when I first installed it on my Windows 10 machine with a 5050. When I try to use Hashcat, it tells me I need compatible drivers and that I need to change them. I followed the entire process to change the drivers on the website, and when I finally manage to install them, it starts giving this error and I can't get past it.

noob can anyone help

Mon, 23 Mar 2026 16:00:45 +0000

this is what message i get when i try to run an attack

C:\hashcat-7.1.2>hashcat.exe -m 22000 output_hash.hc22000 -a 3 ?a?a?a?a?a?a?a?a?a?a
hashcat (v7.1.2) starting

OpenCL API (OpenCL 3.0 ) - Platform #1 [Intel(R) Corporation]
=============================================================
* Device #01: Intel(R) Graphics, 3543/7086 MB (1771 MB allocatable), 8MCU

Minimum password length supported by kernel: 8
Maximum password length supported by kernel: 63
Minimum salt length supported by kernel: 0
Maximum salt length supported by kernel: 256

Hash 'output_hash.hc22000': Separator unmatched
No hashes loaded.

A question on logic and approaches to cracking

Sat, 21 Mar 2026 22:52:51 +0000

Hi all,
I am pretty new to hashcat, so please forgive me if I am missing the obvious.

I am working on a 64 bit hash. I have a well tuned 8 GPU rig. First of all since cracking sessions may extend for days or weeks (or until the next big-bang) devising the right approach seems key before starting.

I have tried:

./hashcat -a 3 -m 1400 password.hash ./wordlists/* ?a?a?a?a?a?a?a?a <- this seems to be wrong as it is masking every-word in the list and switching it for every character available. Long run and no results.

With no luck. I tried just finding out the first two characters alone:

./hashcat -a 3 -m 1400 password.hash ./wordlists/* ?a?a also no results.

But got some warning about now giving hashcat enough work, however it found nothing...
Maybe I am missing something obvious?

Now, I am starting from the point of view of the worse case scenario, where the hashed password is a fully random mixture of letters,digits and symbols (including blank spaces) in no order, which would suggest that using dictionaries is useless and that that for this scenario only a full brute-force attack is the only way forward.

Is that logic correct in your experience?

Thank you.

Help with code

Sat, 21 Mar 2026 15:17:07 +0000

Hello!
I'm new here and I was just trying to use Hashcat to get my password back.
It is a rar file and I know part of the password.
This line bellow is from the code I was trying to run with CMD (I already have the hash):

hashcat.exe -m 13000 -a3 hash 321654?s?s?s

The point is, I know it starts with "321654," and the last three characters are somewhere in this sequence: /?1!2@3#.

Can anybody help me please?

Cracking Protected Text HTML

Thu, 19 Mar 2026 22:25:56 +0000

Hi

Firsly, I am a complete Hashcat newbie so I know nothing about how to use it.

A while ago, I copied to my hard drive the HTML page for a Protected Text page from protectedtext.com. Unfortunately, I have forgotten the password for it.

Please can you give me step-by-step instructions for using Hashcat to crack the HTML page that I downloaded.

I am halfway proficient at Javascript so I may or may not be able to make alterations to the Protected Text Javascript if necessary.

Thank you very much

Configuring checkpoint timer to save progress

Tue, 17 Mar 2026 16:45:15 +0000

Can someone please help me understand how to use checkpoint timers to save progress so that i can continue to run from the previous checkpoint after closing the program.
I am new to using Hashcat and I tried to find something like a syntax or keywords guide, but couldn't find anything helpful. Thank you for reading this.

Bitwarden hash format(s)

Tue, 17 Mar 2026 07:49:16 +0000

Hi all,

A friend's forgotten their Bitwarden password (remembers the parts of the password but not which parts they used/what order...) so I'm going to run a custom wordlist of permutations of those fragments.

However the hash they got out of Bitwarden doesn't match the format in the examples (waiting on them to get back to me with the tool they used to extract it in case it's just a dumb tool issue), the example hash from the wiki is;
$bitwarden$2*100000*2*bmXXXXXXXXXXXXXXXXXXXXXXdA==*+v5XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXfg=

But their extracted hash is;
$bitwarden$1*700000*YnXXXXXXXXXXXXXXXXXXXXXXX20=*jxXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX3o=

The $1 vs $2 and lack of the extra field after the iterations count would tend to make me think this is a different mode (but I'd typically assume $2 to be newer so it would surprise me if hashcat supported the newer hash format but not the older one)?

Has anybody run into this?

Thanks

large cipher on krb5pa hash

Mon, 23 Feb 2026 15:05:06 +0000

Hi,
Im kinda new to all of this so im sorry in advance if i do any mistake/misteps while asking my question here.

Anyway, im trying to finish a Root-Me challenge that ask me to find the password of a user linked to a suspicious kerberos connection in a PCAP file. I extracted manually a krb5 pre-authentication hash from this file (i extracted the "CNameString", the "Realm", the "etype" and the "cipher") from one AS-REP request. In my case, the etype is 18.
I assembled thoses informations like the following in a file "krb_hash.txt" :
$krb5pa$18$$$.

My problem is that the cipher i have in the AS-REP in the pcap file is waaaaaay longer than the cipher length that i see in the https://hashcat.net/wiki/doku.php?id=example_hashes.
To be more precise, in the examples hashes i see that the cipher corresponding to my etype is supposed to 112 characters long, while the cipher i have in the pcap file is 548 characters long...
When i try to launch a hascat on my file i get the following error :
"Hashfile 'krb_hash.txt' on line 1 ($krb5p...f4320028a648c94d209d772d88a161e0): Token length exception"

I tried to cut the cipher to make it exactly 112 characters long (in which case the hashcat launches correctly) but obviously i get no result from this.

What should i do?

Verizon Fios - wordlists

Mon, 23 Feb 2026 12:17:14 +0000

Hi,
I case anyone is interested. I have the most updated 3 - 7 letter wordlists for Verizon Fios routers.
And 8 - 9 in next post.
Here they are.

  5lista.txt (Size: 21.32 KB / Downloads: 14)

  4lista.txt (Size: 28.89 KB / Downloads: 7)

  6lista.txt (Size: 23.26 KB / Downloads: 7)

  3lista.txt (Size: 7.23 KB / Downloads: 7)

  7lista.txt (Size: 7.29 KB / Downloads: 6)

SNMPv3 engineID minimum length, am I missing something?

Sat, 21 Feb 2026 17:45:28 +0000

Regarding hashcat -m 25000 specifically but probably others too. So the question is about the

Code:
totoken.len_min[3] = 26

in module_25000.c (and its siblings). RFC 3411 says engineID is 5-32 bytes, so the minimum should be 10 hex chars, not 26. IPv4-based engine IDs are 9 bytes (18 hex) and MAC-based are 11 bytes (22 hex). Well both of these appear to be under the floor.

Also noticed m25000.pm uses

Code:
random_hex_string(26, 34)

so the test suite never generates a short enough engineID to catch it. Is this a known limitation or an actual bug? Seems like a one-line fix across the all the sibling modules. Will someone knowledgeable please come to the rescue here and tell me if I'm looking at this wrong?

Dictionary words are rejected before rules are applied for WPA2

Fri, 20 Feb 2026 01:02:43 +0000

I'm looking into developing an attack for WPA2 hashes, and would love to get some pointers or suggestions for things I may have missed.

My thinking is this so far, to use a small wordlist (hashmob-small) ~20MB, combined with a local to my country dictionary ~3MB with the "one rule to rule them all" rule set.

However in testing I noticed a slight issue. Lets say the password we are trying to recover is "timmy666", and I have "timmy" in my wordlist, the ruleset will generate "timmy666", but the dictionary attack will skip over "timmy" as it is shorter than 8 characters, the minimum for WPA2.

With this example we can see a word list with one word (timmy) in that generates 51995 guesses with the ruleset, but 100% rejected:

Quote:today (master) λ cat wordlist.txt
timmy
today (master) λ hashcat -a 0 -m 22000 -r rules.rule hash.txt wordlist.txt
hashcat (v7.1.2) starting

OpenCL API (OpenCL 3.0 PoCL 7.1 Linux, Release, RELOC, LLVM 20.1.8, SLEEF, DISTRO, CUDA, POCL_DEBUG) - Platform #1 [The pocl project]
======================================================================================================================================
* Device #01: cpu-haswell-Intel(R) Core(TM) i7-8650U CPU @ 1.90GHz, 5794/11588 MB (5794 MB allocatable), 8MCU

Minimum password length supported by kernel: 8
Maximum password length supported by kernel: 63
Minimum salt length supported by kernel: 0
Maximum salt length supported by kernel: 256

Hashes: 1 digests; 1 unique digests, 1 unique salts
Bitmaps: 16 bits, 65536 entries, 0x0000ffff mask, 262144 bytes, 5/13 rotates
Rules: 51995

Optimizers applied:
* Zero-Byte
* Single-Hash
* Single-Salt
* Slow-Hash-SIMD-LOOP

Watchdog: Temperature abort trigger set to 90c

Host memory allocated for this attack: 514 MB (10083 MB free)

Dictionary cache built:
* Filename..: wordlist.txt
* Passwords.: 1
* Bytes.....: 6
* Keyspace..: 51995
* Runtime...: 0 secs

Session..........: hashcat
Status...........: Exhausted
Hash.Mode........: 22000 (WPA-PBKDF2-PMKID+EAPOL)
Hash.Target......: hash.txt
Time.Started.....: Fri Feb 20 01:54:34 2026 (0 secs)
Time.Estimated...: Fri Feb 20 01:54:34 2026 (0 secs)
Kernel.Feature...: Pure Kernel (password length 8-63 bytes)
Guess.Base.......: File (wordlist.txt)
Guess.Mod........: Rules (rules.rule)
Guess.Queue......: 1/1 (100.00%)
Speed.#01........: 0 H/s (0.00ms) @ Accel:72 Loops:1024 Thr:1 Vec:8
Recovered........: 0/1 (0.00%) Digests (total), 0/1 (0.00%) Digests (new)
Progress.........: 51995/51995 (100.00%)
Rejected.........: 51995/51995 (100.00%)
Restore.Point....: 1/1 (100.00%)
Restore.Sub.#01..: Salt:0 Amplifier:0-0 Iteration:0-1024
Candidate.Engine.: Device Generator
Candidates.#01...: [Copying]
Hardware.Mon.#01.: Temp: 67c Util: 21%

I believe this is due to the word being less than 8 characters long and the mode being WPA2, as when I do the same thing with an MD5 hash I get 0% rejected.

I did think of two work arounds. One would be to generate the dictionary file prior to running, but I don't know how large it would be, and storage is expensive and large dictionaries are a pain to deal with.

The other would be to generate them and process in a pipe like so:

Quote:hashcat --stdout -r OneRule.rule combined.txt | grep -E '^.{8,}$' | uniq | hashcat -a 1 -m 22000 -w 4 hash.txt

But that seems slow and doesn't scale well. I'm hoping there is a better solution.

Also if this is the wrong way to go about attacking WPA2 please do let me know!

Thanks!

Problem Extracting Hash from Captured WPA2 Handshake (M1-M2)

Thu, 19 Feb 2026 20:31:18 +0000

Hi,

I have a problem extracting Hashes from a WPA2 Handshake captured using Wireshark/TShark (not at the same time) by monitoring interface that was acting as an AP. I am using hcxpcapngtool but it does not seem to extract any hashes even though it seems to me that valid M1 and M2 from the 4-Way Handshake were captured.

The Tool is giving me the following output:

Code:
hcxpcapngtool 6.3.5 reading from tshark.pcapng...

summary capture file

--------------------

file name................................: tshark.pcapng

version (pcapng).........................: 1.0

operating system.........................: Linux 6.16.8+The-Distribution-Which-Does-Not-Handle-OpenCL-Well (Kali)-amd64

application..............................: Dumpcap (Wireshark) 4.6.3

interface name...........................: wlan1

interface vendor.........................: 000000

openSSL version..........................: 1.1

weak candidate...........................: N/A

MAC ACCESS POINT.........................: 000000000000 (incremented on every new client)

MAC CLIENT...............................: 000000000000

REPLAYCOUNT..............................: 0

ANONCE...................................: 0000000000000000000000000000000000000000000000000000000000000000

SNONCE...................................: 0000000000000000000000000000000000000000000000000000000000000000

timestamp minimum (timestamp)............: 19.02.2026 16:36:20 (1771518980)

timestamp maximum (timestamp)............: 19.02.2026 16:36:23 (1771518983)

duration of the dump tool (seconds)......: 3

used capture interfaces..................: 1

link layer header type...................: DLT_EN10MB (1)

endianness (capture system)..............: little endian

packets inside...........................: 8

EAPOL ANONCE error corrections (NC)......: not detected

session summary

---------------

processed pcapng files................: 1

When looking in my capture I can see Message 1 and Message 2 Packets that belong together and have the Nonces set to valid values. I am attaching the capture because this was just a test not using real values (the password is password).

Do you have any idea on what might be the problem?

tshark.zip (Size: 873 bytes / Downloads: 1)