In the combinator attack built into hashcat (-a 1), two dictionaries are “combined” - each word of a dictionary is appended to each word in another dictionary.

You need to specify exactly 2 dictionaries on your command line, for example:

./hashcat -m 0 -a 1 hash.txt dict1.txt dict2.txt

hashcat sometimes refers to the first dictionary specified on the command line as the “left” file, and the second dictionary as the “right” file.

Tip: attack mode 12 can do everything -a 1 does and more. -a 12 ?w?q left.dict right.dict produces exactly the same candidates as the command above, except that with -a 12 you may also put characters between the two words, or around them, by writing them into the mask.

If dict1.txt contains:

pass
12345
omg
Test

… and dict2.txt contains:

alice
bob
cat
dog

… then with the command line above, hashcat will create the following password candidates:

passalice
passbob
passcat
passdog
12345alice
12345bob
12345cat
12345dog
omgalice
omgbob
omgcat
omgdog
Testalice
Testbob
Testcat
Testdog

You can also use the same dictionary twice:

./hashcat -m 0 -a 1 hash.txt dict1.txt dict1.txt

… which would produce:

passpass
pass12345
passomg
passTest
12345pass
1234512345
12345omg
12345Test
omgpass
omg12345
omgomg
omgTest
Testpass
Test12345
Testomg
TestTest

To add rules to the left (first) dictionary, the right (second) dictionary, or both, use the -j and -k commands:

  -j,  --rule-left=RULE              Single rule applied to each word on the left dictionary

  -k,  --rule-right=RULE             Single rule applied to each word on the right dictionary

(You can specify only a single sequence of rules for each, not a file or list of rules.)

For example, with these inputs:

Dictionary 1

yellow
green
black
blue

Dictionary 2

car
bike

… and these rule commands:

-j '$-' -k '$!'

… the output would be:

yellow-car!
green-car!
black-car!
blue-car!
yellow-bike!
green-bike!
black-bike!
blue-bike!

Note: the quotes around the rules are only there to escape the $ character, which would otherwise cause $- to be interpreted as a variable in some command shells. The rules that are used here are still just $- and $!. Escaping might not work exactly the same way on each operating system and with each shell interpreter (if you are unsure about what needs to be escaped and how it should be escaped, please consider looking up your OS and/or shell interpreter manual).

You may see that one of your dictionaries is shown in hashcat's status as the “base” (the core basis of the attack), and the other as the “mod” (a “modifier” of the attack being applied). For efficiency, hashcat chooses these roles based on the relative sizes of the files. You cannot control this choice. It affects speed but has no effect on the output.