hashcat
Run hashcat in interactive mode or run hashcat with a warmed up cache so it doesn't spend building it
Hey guys,
We are in a situation where we want to build a live cracking feature. For this to work, the initial load time of the dictionary doesn't work for us, is there a way to perform a warm up of the dictionary and prebuild the cache?
I've tried ramdisk, rerunning hashcat same command but in both cases it rebuilds the cache. The dictionary is 48GB with a rules file.
Desired Behaviour:
Given I give Hashcat a password When I have already prebuilt the dictionary cache Then Hashcat does not rebuild the cache and starts cracking the password
If not possible with the current way, can you give me some pointers on how to modify Hashcat and get this done? Up for a pull request if we can manage this feature.
Thanks very much.
The cache shouldn't build every time, it is often re-used, although there are a few conditions that force Hashcat to rebuild each time like if it's never seen a -m hash mode before or you're using -j / -k single rules. There have also been quite a few issues with dictstat in the past, so it may be a good idea to update to the latest beta if possible. The only way to get around it currently would be to run Hashcat in stdin mode, where you pipe the wordlist in instead so it can't use cache but this isn't recommended, as it has a large performance impact
Thanks @PenguinKeeper7 - Interesting, this is the command we're running:
hashcat -O -w4 -a 0 -m 1000 hashfile.txt dictionary.txt -r rules.txt --potfile-path=file.pot --hwmon-disable --username --status --status-timer=30 --session=request_1
Do you expect this command to rebuild the cache everytime? It does so at present. We always use this command consistently, the input hash file name changes everytime but that wouldn't matter I guess?
Hashcat version: v6.2.6-603-g11502c77e
Also is there a way to tell Hashcat to ignore dictionary words and subsequent rule expansion if they are less than x characters? I've tried --increment-x flags but those don't seem to work. Just trying to minimise the necessary computing that needs happening.
There is no reason why hashcat should be rebuilding the dict stat cache every time on that command unless the path to the dictionary or the dictionary itself have changed since last build. It's possible your dictionary stats are also not being saved in a path hashcat can access again after last launch or they are being saved against that specific session and not being attributed correctly in future runs. Unfortunately, we rebuild the dictstat cache for safety reasons, we must know some information about it to use the data quickly and safely, and in some cases it can't be avoided.
There's a possibility this is being caused by your "installed" hashcat not pathing correctly, and running hashcat in it's directory may solve this for you. That shouldn't be the case but I don't know how you installed hashcat or what your environment looks like.
As for your second question, this is something that can sorta be done, but with major caveats about how hashcat and hashcat rules work under the hood. This is NOT something that can be done in the way you are thinking and only a bit of a deeper dive into how hashcat actually works will make that understandable. Given the above is not a code issue and it sounds like this will be more of a discussion about how to better use hashcat and not about the code itself, I'd suggest we close this here and move the discussion over to the hashcat discord or the hashcat forums. As of right now, the forums are down pending an OVH migration issue, but that should be resolved soon.
Is the cache saved at the end of the process? It seems if I press ctrl+c no cache, but if I quit using the 'q' key then I get the cache created.
I'm not sure when the file is updated in terms of the hashcat session but the cache is saved to the .dictstat file. You really shouldn't ctrl+c hashcat at any time though, as you may miss other important file writes like cracks being written to the potfile.
