lca

八位数字密码：?d?d?d?d?d?d?d?d  
八位未知密码：?a?a?a?a?a?a?a?a  
前四位为大写字母，后面四位为数字：?u?u?u?u?d?d?d?d  
前四位为数字或者是小写字母，后四位为大写字母或者数字：?h?h?h?h?H?H?H?H  
前三个字符未知，中间为admin，后三位未知：?a?a?aadmin?a?a?a  
6-8位数字密码：--increment --increment-min 6 --increment-max 8 ?l?l?l?l?l?l?l?l  
6-8位数字+小写字母密码：--increment --increment-min 6 --increment-max 8 ?h?h?h?h?h?h?h?h

--custom-charset1 [chars]等价于 -1  
--custom-charset2 [chars]等价于 -2  
--custom-charset3 [chars]等价于 -3  
--custom-charset4 [chars]等价于 -4  
在掩码中用?1、?2、?3、?4来表示。

--custom-charset1 abcd123456!@-+。然后我们就可以用"?1"去表示这个字符集了  
--custom-charset2 ?l?d，这里和?2就等价于?h  
-1 ?d?l?u，?1就表示数字+小写字母+大写字母  
-3 abcdef -4 123456 那么?3?3?3?3?4?4?4?4就表示为前四位可能是“abcdef”，后四位可能是“123456”

$ hashcat -a 3 -m 0 --force 10e935b681dd5d9228d914ed31f86b79 ?d?d?d?d?d?d?d

$ hashcat -a 3 -m 0 --force 1b1aee1f5339f686b32d9a255696f080 ?l?l?l?l?l?l?l

$hashcat -a 3 -m 0 --force a1b36807dc763d423f055b617a835521 --increment --increment-min 1 --increment-max 8 ?d?d?d?d?d?d?d?d

$hashcat -a 3 -1 123456abcdf!@+- ca6d3ead08fa8e7eca93966b75f1c1b0 ?1?1?1?1?1

$hashcat -a 3 -1 123456abcdf!@+- 9054fa315ce16f7f0955b4af06d1aa1b --increment --increment-min 1 --increment-max 8 ?1?1?1?1?1?1?1?1

hashcat64.exe -a 3 -1 ?d?u?l?s d37fc9ee39dd45a7717e3e3e9415f65d --increment --increment-min 1 --increment-max 8 ?1?1?1?1?1?1?1?1  
或者：  
hashcat64.exe -a 3 d37fc9ee39dd45a7717e3e3e9415f65d --increment --increment-min 1 --increment-max 8 ?a?a?a?a?a?a?a?a

-a 0是指定字典破解模式，-o是输出结果到文件中  
hashcat64.exe -a 0 ede900ac1424436b55dc3c9f20cb97a8 password.txt -o result.txt

hashcat64.exe -a 0 hash.txt password.txt -o result.txt

NT-hash  
$ hashcat -a 3 -m 1000 --force 1b1aee1f5339f686b32d9a255696f080 ?l?l?l?l?l?l?l  
​  
LM-hash  
$ hashcat -a 3 -m 1000 --force 1b1aee1f5339f686b32d9a255696f080 ?l?l?l?l?l?l?l

.\hashcat.exe -a 3 -m 17200 '$pkzip2$1*2*2*0*161b*19ca*26bf01cc*0*6c*8*161b*26bf*9bc1*169c0f03f18f797477...此处省略...c3f52a18d0537dca26b0baeae8a*$/pkzip2$' --force ?d?d?d?d?d?d

wget https://raw.githubusercontent.com/magnumripper/JohnTheRipper/bleeding-jumbo/run/office2john.py
hashcat -a 0 -m 9500 --username -o crack.txt hash.txt /usr/share/wordlists/nmap.lst --force

hashcat -a 3 -m 1800 --force '$6$H6LRx0yQ62gqLdg7$88r9sgiYtcMKELXTGvyFBPtZmTV.xw4CRamKwYjYIWxiXi3o9dKOlK.2yC3PM2JHRl/xfhXS2kleJmP63nSTJ/' ?l?l?l?l

$ openssl passwd -6 -salt xyz kalia  
$6$xyz$xWzXcL6LjBo1RJjRewXJs9MT7cTutuSUuNX.mVI8jOuBxdeBh4lw170Gx1HpKphRIrQJ82qX/CzJe0F7Soc/l.

hashcat -a 3 -m 1800 --force '$6$xyz$xWzXcL6LjBo1RJjRewXJs9MT7cTutuSUuNX.mVI8jOuBxdeBh4lw170Gx1HpKphRIrQJ82qX/CzJe0F7Soc/l.' --increment --increment-min 4 --increment-max 6 ?l?l?l?l?l

a -6 (Hybrid dict + mask)

a -7 （Hybridmask + dict）

hashcat hash --show

/home/kali/.hashcat/hashcat.potfile

root@kali:~/crackerjack# python3 -m venv venv  
The virtual environment was not created successfully because ensurepip is not  
available.  On Debian/Ubuntu systems, you need to install the python3-venv  
package using the following command.  
​  
    apt-get install python3-venv  
​  
You may need to use sudo with that command.  After installing the python3-venv  
package, recreate your virtual environment.  
​  
Failing command: ['/root/crackerjack/venv/bin/python3', '-Im', 'ensurepip', '--upgrade', '--default-pip']

apt-get install python3-venv

root@kali:~/crackerjack# python3 -m venv venv  
root@kali:~/crackerjack# . venv/bin/activate

pip --no-cache-dir install -r requirements.txt  
# 如果上述命令安装失败，可利用下面的命令一个个安装  
pip install -i https://pypi.doubanio.com/simple/ --trusted-host http://pypi.doubanio.com/ Flask-crontab

flask db init  
flask db migrate  
flask db upgrade  
#######################  
export FLASK_ENV=development  
export FLASK_APP=app  
flask run

root@kali:~/crackerjack# . venv/bin/activate  
flask run