Markov is not really an attack of its own. It is the order in which a Mask attack tries its candidates, and it is switched on by default.
A plain brute-force walks a mask in counting order: 000, 001, 002 and so on. That order treats every character as equally likely, which is not how people pick passwords. Markov uses a table of statistics instead, and at each position it tries the characters that most often follow what came before.
This is the same mask, run both ways:
$ hashcat -a 3 --stdout ?d?d?d 123 023 223 323 923 423
$ hashcat -a 3 --stdout ?d?d?d --markov-disable 000 100 200 300 400 500
The Markov-ordered run starts with 123. The statistics file determines this order. With the same full keyspace, both runs test the same 1,000 candidates, but Markov ordering tries more likely candidates first. This helps when you stop the attack before it finishes.
From an .hcstat2 file. hashcat ships hashcat.hcstat2 and uses it unless you say otherwise:
$ hashcat -a 3 -m 0 hash.txt ?a?a?a?a --markov-hcstat2=my.hcstat2
If you are cracking passwords from a particular language or a particular site, a table built from similar passwords does better than the shipped one.
By default the statistics are per position: what is likely in the third character of a password is not the same as what is likely in the first. That is what hashcat calls per-position Markov, and it is the strongest of the three.
| option | what it does |
|---|---|
| (default) | per-position Markov |
--markov-classic | classic Markov, one table for every position |
--markov-inverse | inverse Markov, one table, walked from the back |
--markov-disable | no Markov at all, plain counting order |
-t sets a threshold, which limits how many different characters Markov will consider at each position:
$ hashcat -a 3 -m 0 hash.txt ?a?a?a?a?a?a?a -t 15
With -t 15 each position only ever tries its 15 most likely characters. That makes the keyspace much smaller, so the run finishes far sooner, and it gives up the candidates that use a rare character. It is a trade, and it is worth making on a long mask you would otherwise never finish.
statsprocessor is the stand-alone word generator built on the same per-position Markov idea, and hcstat files are made with the tools in that family.
-a 4) - a different way of putting likely candidates first, using a trained grammar rather than character statistics