Password Cracking Rules

Overview

Password cracking rules specify how to transform candidates from a wordlist. Capitalization, added digits or symbols, and character substitutions can be combined to produce more candidates. In Windows and AD, they are used for offline analysis of captured NetNTLMv2 responses and Kerberos-related values.

password -> Password
password -> password1
password -> password!
summer   -> Summer2026!

Common Targets

Target	Example hashcat mode	Notes
NetNTLMv2	`5600`	A challenge-response captured with a tool such as Responder.
Kerberoast RC4 TGS-REP	`13100`	Offline cracking of a service ticket for an account with an SPN.
Kerberoast AES TGS-REP	`19600` / `19700`	Kerberoasting with an AES encryption type.
AS-REP roast	`18200`	Targets accounts that do not require Kerberos pre-authentication.

Mode names may vary by tool version, so check hashcat --help when running it.

When Rules Help

Rules work well for common variations in human-created passwords.

Capitalize the first letter: summer -> Summer
Add a year or digits: Summer -> Summer2026
Add a symbol: Summer2026 -> Summer2026!
Apply leetspeak substitutions: password -> p@ssw0rd

By contrast, gMSA passwords and passwords for ordinary domain-joined computer accounts are managed as long random values, so they are not targets for wordlist-plus-rule cracking. With a gMSA, the question is whether an authorized principal can retrieve its managed password, rather than whether it can be cracked.

Differences Between hashcat and John the Ripper Rules

Sets such as best64.rule are well-known rules originating from John the Ripper. They can sometimes be used with hashcat, but the rule dialects are not identical, so unsupported lines may be skipped.

hashcat -m <mode> hashes.txt wordlist.txt -r rules/best64.rule
hashcat -m <mode> hashes.txt --show

The important point is not to mistake a candidate displayed on screen for a cracked password. A word such as Muffin in a progress display or the current candidate is not necessarily a successful result.

Check for success as follows.

Does hashcat --show display a hash and matching password?
Has the Recovered count in the status increased?
Was the result saved in the potfile?
Do the recovered credentials actually authenticate?

Operational Interpretation

Obtaining a Kerberoastable ticket and cracking its password are separate outcomes.
Rules expand the candidate space, increasing runtime and GPU load.
Using gMSAs or long random passwords for service accounts makes offline cracking less practical.
Disabling RC4 and preferring AES does not remove the risk of offline cracking if a password is weak.