The Table attack has a more technical explanation here.

This page however is a very basic guide for people new to hashcat or this attack in particular and just want to get started.

The Table attack (-a 5) can be seen in context within the following example.

hashcat -a 5 --stdout B.txt A.table > C.txt

In this case the user intends to generate a new, more diverse and complex word list from a selection of simple or plain base words. Thanks to the --stdout feature in hashcat we are able to write the output to a text file for future use.

So to be clear, the command above is not an actual “attack”. It is being used to modify an existing wordlist (B.txt) and to generate a new wordlist (C.txt) which can be used later by hashcat in its other modes.

Here is a breakdown of each part of the command.

hashcat This of course is the main executable. On Windows it is hashcat.exe.

-a 5 This tells hashcat to use the “Table attack”. You can also write it out in full as --attack-mode 5.

--stdout This tells hashcat to print the password candidates instead of trying to crack anything with them.

B.txt This is the wordlist you are starting from, your plain or base words. It comes before the table.

A.table This is your table file. “A” could be any name you choose. Here it is assumed that the file sits in the same folder as hashcat. If not, give the full path, and you may need to put quotes around it. A good trick is to drag and drop the file into the command window at the point where you need to type the location.

> C.txt Finally we send the results into a text file called C.txt. As before this is just a random name for the output file, you may name your output file differently.

It is good practice to name the output file in such a way you can easily identify it. Trying to open a very large text file to see what it contains at a later date can sometimes be very difficult to do.

You should now be able to generate new password text files by modifying your existing base word lists.

I suggest you make a very small input file, (B.txt) at first and see just how your table affects it. The size of your output file can be huge in comparison to your input file, so take things easy until you fully understand tables.

Atom has kindly provided some default table files in the tables/ folder of the hashcat directory. If you believe you have created a particularly good table file or password list, please consider sharing on the hashcat forum.

Each line is one character, then a tab, then what that character may become. This table lets every s become a $ or a 5:

s	$
s	5

That tab matters. If you use spaces, or an equals sign, hashcat will tell you that a table line is a source and a replacement with one tab between them.

Everything after the wordlist is treated as a table, so you can hand hashcat several at once and it merges them into one attack:

hashcat -a 5 --stdout B.txt tables/leetspeak-common.table tables/toggle.table > C.txt

The old limit was on word length. Now there is a budget on how many candidates a single word is allowed to produce on the host, called maxperm, and it defaults to 1048576. It exists because a long word with a big table can otherwise produce more candidates than you could ever run, and the whole job would be spent on the first few long words. You can raise it, or set maxperm=0 to remove the limit entirely, if you know what you are asking for.

--table-file A.table is how you used to name the table, and hashcat-cli32.exe or hashcat-cli64.exe is what the program used to be called. The table is now just named on the command line after the wordlist, and there is one hashcat binary. See What changed since hashcat-legacy.