crack passwords with hashcat masks and hybrid attacks

the password pattern everyone thinks is clever

capital letter up front, some lowercase, a few digits at the end. Summer2024. Password1. Charlie123. it feels random to the person typing it, but it's actually one of the most predictable structures in human password creation. attackers know this, which is why tools like hashcat have entire attack modes built specifically to exploit it. this post walks through how mask and hybrid attacks work, using the exact commands, so you can turn around and test your own hashes before someone else does.

the mask attack, broken down

hashcat -m 1000 hashes -a 3 '?u?l?l?l?l?d?d?d' --increment

let's take this apart piece by piece:

-m 1000 tells hashcat what kind of hash it's cracking. mode 1000 is ntlm, the hash format windows uses to store passwords locally. if you're auditing a windows environment, this is usually where you start.

-a 3 selects attack mode 3, which is the mask attack. instead of guessing random strings or feeding in a wordlist, hashcat builds guesses character position by character position, based on a pattern you define.

'?u?l?l?l?l?d?d?d' is the mask itself. ?u means one uppercase letter. ?l means one lowercase letter. ?d means one digit. so this mask says: one capital, four lowercase letters, three digits. that's "Word123" or "Chair456" or a thousand other passwords that feel unique but follow the exact same skeleton.

--increment tells hashcat to also try shorter versions of that mask, starting from length one and working up. so it's not just testing 8-character combos, it's testing every length along the way, which covers even more of the "human default" pattern space.

the reason this works so well isn't luck. it's that people were taught password rules, not password security. "use a capital letter, a number, and don't make it too short" turned into a template, and templates are exactly what masks are built to chew through fast.

the hybrid attack, and why it's scarier

hashcat -m 1000 hashes -a 6 rockyou.txt '?d?d?d?d'

-a 6 is a hybrid attack: wordlist plus mask. hashcat takes every word from rockyou.txt (a massive leaked password wordlist) and appends the mask pattern to the end of each word. so "dragon" becomes "dragon0000" through "dragon9999," "soccer" becomes "soccer0000" through "soccer9999," and so on for every word in the list.

this matters because most people don't invent brand new passwords, they take a familiar word and tack numbers on the end because a login form told them to. a hybrid attack doesn't need to guess your exact word from scratch, it just needs your base word to already exist somewhere in a leaked dataset, which, statistically, it probably does.

why length actually wins

complexity rules (one capital, one number, one symbol) create predictable structure. length does not. a 16-character passphrase like "horseshoe forest tuesday" has more real entropy than "P@ssw0rd1" even though the second one looks scarier on paper. mask and hybrid attacks are fast precisely because they exploit short, structured passwords. the search space for an 8-character password with a known pattern is tiny compared to the search space for a random 16+ character passphrase with no predictable shape at all.

how to defend your own systems

first, audit before someone else does. if you're responsible for a windows domain, pull the ntds.dit and sam hashes in a controlled, authorized test environment and run them through hashcat yourself using these same mask and hybrid attacks. anything that cracks in minutes is a password policy failure, not a one-off weak user.

second, kill the complexity theater. stop requiring "one capital, one number, one symbol" as your only rule. require length instead, 14 characters minimum, ideally longer, and let people use passphrases.

third, turn on account lockout policies and, where possible, phishing-resistant mfa. a cracked hash is useless if the account also needs a hardware key or an authenticator prompt to log in.

fourth, check your own systems against known-breached passwords using tools like haveibeenpwned's api or an offline "have i been pwned" password list check, so predictable patterns get flagged before an attacker's mask beats them to it.

the takeaway

hashcat's mask and hybrid attacks aren't magic, they're just automation applied to human habits. the fix isn't paranoia, it's length, passphrases, mfa, and actually testing your own password policy instead of assuming it's fine. crack your own hashes first. that's the whole game.