hashcat has three ways to generate toggle-case candidates. The rules below limit the attack to at most five flipped characters in positions 1 to 15. The file rules/toggles5.rule contains 4,943 rules, so it does not cover longer words or candidates that need more than five flips.
To generate all case combinations, use the Table attack with tables/toggle.table.
To combine case variants with a mask around the word, use attack mode 12. The mask sets the word position, and the rules toggle its case.
The command:
$ hashcat -a 12 -m 0 hash.txt ?d?w! words.txt -r rules/toggles3.rule 1pass! 1Pass! 1pAss! 1paSs!
Many passwords are entirely lowercase. Some people change a few letters to uppercase to strengthen them. (Avoid flipping every letter. Aim for a balance between password length and the number of uppercase characters.)
The rules below generate candidates with two to five characters changed to uppercase. This reduces the number of candidates compared with trying every possible case combination, but it will miss passwords with fewer than two or more than five uppercase characters.
Thanks to legion from Team Hashcat for finding this first.
Case can be toggled with specialized rules. Since hashcat-legacy and hashcat support rules files, they can do toggle-attacks, too.
There is now a second way as well. The Table attack (-a 5) ships tables/toggle.table, which toggles case at each letter independently, in both directions, for Latin, Greek and Cyrillic.
$ hashcat -m 0 -a 5 hash.txt words.txt tables/toggle.table
The ruleset below is still the better choice when you want to limit how many characters get flipped, which is what makes it fast. The table flips every combination.
For rules files that use this technique, see rules/toggles[12345].rule in the hashcat distribution. They are cumulative: each file holds every combination of 1 up to N flipped characters across positions 1 to 15, so toggles5.rule already contains toggles1 through toggles4. The counts are 15, 120, 575, 1940 and 4943 rules, and you pick one file rather than stacking them.
To get a feel for what toggle rules look like, here is the content of toggles2.rule.
These rules have been optimized to eliminate redundancy. For example, “T1T1” produces no change in case. Including both “T2T4” and “T4T2” would also be redundant.
T0 T1 T2 T3 T4 T5 T6 T7 T8 T9 TA TB TC TD TE T0T1 T0T2 T0T3 T0T4 T0T5 T0T6 T0T7 T0T8 T0T9 T0TA T0TB T0TC T0TD T0TE T1T2 T1T3 T1T4 T1T5 T1T6 T1T7 T1T8 T1T9 T1TA T1TB T1TC T1TD T1TE T2T3 T2T4 T2T5 T2T6 T2T7 T2T8 T2T9 T2TA T2TB T2TC T2TD T2TE T3T4 T3T5 T3T6 T3T7 T3T8 T3T9 T3TA T3TB T3TC T3TD T3TE T4T5 T4T6 T4T7 T4T8 T4T9 T4TA T4TB T4TC T4TD T4TE T5T6 T5T7 T5T8 T5T9 T5TA T5TB T5TC T5TD T5TE T6T7 T6T8 T6T9 T6TA T6TB T6TC T6TD T6TE T7T8 T7T9 T7TA T7TB T7TC T7TD T7TE T8T9 T8TA T8TB T8TC T8TD T8TE T9TA T9TB T9TC T9TD T9TE TATB TATC TATD TATE TBTC TBTD TBTE TCTD TCTE TDTE