A hybrid attack glues a word from a dictionary together with characters from a mask. The word supplies the part a human chose, the mask supplies the part a human tacked on, like a year or a couple of digits.
There are three attack modes that do this. -a 12 is the general one and can do everything the other two can, so if you are learning only one, learn that one.
-a 12 - you write a mask and say inside it where the word goes-a 6 - word first, then the mask-a 7 - mask first, then the word
Applies to master. Attack mode 12 is in hashcat's master branch and is not in the 7.1.2 release, which answers Invalid attack mode if you try it. Build from master, or take a precompiled build from hashcat.net/beta. Modes -a 6 and -a 7 below are in the release and need nothing special.
In -a 12 you write one mask for the whole candidate. Inside that mask, ?w stands for the word from your dictionary. Everything else in the mask works exactly as it does in a normal mask attack.
Because you place ?w yourself, the word does not have to sit at the start or the end. It can sit in the middle:
$ ... -a 12 ?d?w?d?d example.dict
With password in the dictionary, that gives 0password00 through 9password99.
You can also put fixed characters in the mask. They are simply typed out:
$ ... -a 12 ?w2024! example.dict
That appends 2024! to every word, and no other candidate is tried.
?w is required, and you use it exactly once.?l ?u ?d ?s ?a ?h ?H ?b all work, and so do custom charsets from -1 to -4.
?q stands for a word from a second dictionary. It is optional, and it has to come after ?w. When you use it, you name two dictionaries on the command line, the one for ?w first:
$ ... -a 12 ?w-?q! left.dict right.dict
If left.dict holds alice and right.dict holds bob, that produces alice-bob!.
This makes -a 12 a superset of the Combinator attack as well: -a 12 ?w?q joins two dictionaries the same way -a 1 does, except that now you may also put characters between them and around them.
If your example.dict contains:
password hello
The configuration:
$ ... -a 6 example.dict ?d?d?d?d
generates the following password candidates:
password0000 password0001 password0002 . . . password9999 hello0000 hello0001 hello0002 . . . hello9999
It also works on the opposite side!
The configuration:
$ ... -a 7 ?d?d?d?d example.dict
generates the following password candidates:
0000password 0001password 0002password . . . 9999password 0000hello 0001hello 0002hello . . . 9999hello
-j applies a single rule to the word on the left and -k applies one to the word on the right, before the pieces are glued together. Neither of them ever applies to a mask, because a mask is not a word.
-r is not accepted here in the 7.1.2 release. It refuses the run outright:
Use of -r/--rules-file and -g/--rules-generate requires attack mode 0 or 9.
So for a rule file, either pre-expand the words with --stdout and pipe them in, or use -j and -k for a single rule a side. On master -r is allowed in the hybrid modes and applies to the finished candidate, see hashcat.net/beta.
Using rules to emulate hybrid attack describes how to build a brute-force rule file with maskprocessor and get a hybrid attack that way. That trick was written when there was no way to put the mask in the middle. -a 12 does that directly now, so the rule file is no longer needed.