Rules & Masks
GovCracker Practical Reference

1. Core Concepts: Rules, Masks & Hybrid

GovCracker supports all Hashcat attack modes through a guided interface without a command line. The three core attack principles differ greatly in scope, keyspace, and runtime – the right choice determines success or failure.

More Attack Modes

2. Masks & Built-in Charsets

A mask is a character template. Each placeholder defines which characters are tested at that position. Fixed characters can be embedded directly. The mask length determines the candidate length (when increment is disabled).

Built-in Charsets

Mask Examples with Fixed Characters

Fixed characters are written directly into the mask – only placeholders start with ?.

3. Custom Charsets (-1 to -4)

Hashcat allows up to four custom charsets. They are defined with -1–-4 (or --custom-charset1 to --custom-charset4) and used in the mask as ?1–?4. Built-in charsets can be combined.

4. Mask Options & Increment Mode

Beyond the mask itself, various options control the behavior of the mask attack – especially the increment mode for variable password lengths.

5. Hashcat Mask Files: .hcmask

An .hcmask file contains multiple masks, optionally with their own custom charsets per line. Hashcat processes lines sequentially. Sorting by probability or expected runtime can significantly improve efficiency.

Format of an .hcmask Line

[?1,][?2,][?3,][?4,]mask

Complete Example: forensics.hcmask

# Comment lines start with #
# Line 1: First name (6 chars) + year → most common pattern
?u?l?l?l?l?l?d?d?d?d
# Line 2: lowercase letters + digit at end
?l?l?l?l?l?l?l?d
?l?l?l?l?l?l?d?d
# Line 3: Company name pattern
Company?d?d?d?d!
Firma?d?d?d?d!
# Line 4: Custom charset (lower + digit) at every position
?l?d,?1?1?1?1?1?1?1?1
# Line 5: with special char at end
?u?l?l?l?l?l?d?d?s
# Line 6: PIN pattern (4–6 digits)
?d?d?d?d
?d?d?d?d?d?d
# Line 7: Date pattern
?d?d?d?d?d?d?d?d

hashcat -m 1000 -a 3 hashes.txt forensics.hcmask

6. Keyspace & Runtime Estimation

The keyspace is the total number of candidates for a mask. It is the product of the charset sizes at all positions.

$$\text{Keyspace} = \prod_{i=1}^{n} |\text{Charset}_i|$$

Runtime Formula

$$t = \frac{\text{Keyspace}}{\text{Hashrate (H/s)}}$$

Example: ?u?l?l?l?d?d?d?d with NTLM (~100 GH/s on RTX 4090): approx. 0.12 seconds. With MD5-crypt (-m 500, ~1 MH/s): over 130 hours.

7. Markov Chains & Smart Masks

GovCracker supports Markov chain-based character sequence probabilities via .hcstat2 files. This tries more probable character combinations first – ideal for larger keyspaces. The Markov function can be toggled in the mask attack dialog; threshold and a custom .hcstat2 file can be configured there directly.

8. Rule Basics

Rule Special Options

9. Alle Rule-Funktionen (Standardfunktionen)

All functions below are compatible with John the Ripper. The test word for the Output column is p@ssW0rd (8 characters).

Case & Order

Rotation & Duplication

Append & Insert

Delete & Extract

Replace & Overwrite

10. Hashcat-specific Functions

These functions are Hashcat-specific and not compatible with John the Ripper. The test word for the Output column is p@ssW0rd.

Swap & Shift

Block Duplication & Title Case

11. Memory Operations (M, 4, 6, X)

Memory operations allow temporary storage and reuse of intermediate states within a rule line. The concept is powerful but error-prone – always test with --stdout.

Memory Usage Examples

# Original word + uppercase version
# sommer → sommerSOMMER
M u4

# Original word + reversed version
# sommer → sommerremmos
M r4

# Word “mirrored” + space in between
# hello → hello olleh
M $  r4

# Suppress duplicate (Q-Reject after memory comparison)
# Discards if word == memory (i.e. rule changed nothing)
r M r Q

12. Reject Rules

Reject rules discard candidates based on conditions. They work only with -j/-k (inline rules) or hashcat-legacy — in regular rule files they are ignored by hashcat.

13. Hex Bytes in Rules

Non-printable characters or special characters can be specified in rules as hex escape sequences \xNN. This is useful for encoding-specific passwords, null bytes, or characters outside the ASCII range.

# Append letter 'd' (0x64)
hashcat words.txt -j '$\x64' --stdout
# penguin → penguind

# Append null byte (forensic special case)
$\x00

# Append umlaut ä (UTF-8: c3 a4)
$\xc3$\xa4

# Replace: 'a' with ä (UTF-8)
sa\xc3\xa4

14. Known Rule Sets & Recommendations

Hashcat ships with several high-quality rule files. The choice depends on the target scenario.

Key Rules from best64.rule

# No change
:
# Lowercase
l
# Capitalize
c
# Reverse
r
# Append digit 1
$1
# Exclamation mark
$!
# Capitalize + 1
c$1
# Year 2022
$2$0$2$2
# Duplicate
d
# Delete last character
]
# Delete first character
[
# Replace all s with $
ss$
# Replace all o with 0
so0

15. Hashcat Brain – Intelligent Deduplication

Hashcat Brain is an optional server-client system for candidate deduplication. A Brain server records which candidates have already been tested – connected clients skip these automatically. This prevents duplicate work across parallel sessions using the same wordlists or rules.

Components

Brain Feature Level

When Brain is Useful – and When It's Not

The decision depends entirely on the GPU hashrate of the target algorithm. Brain is only useful when the cracking rate is low enough that the network overhead of the Brain server does not become a bottleneck.

Brain Rule of Thumb by Algorithm

16. Common Errors & Best Practices

Common Errors

Recommended Workflow

1. 1
   Identify hashes correctly: Always determine the correct -m mode first. In GovCracker the automatic hash detection handles this step. Wrong mode = no hits, even if the password is in the wordlist.
2. 2
   Build a project-specific wordlist: Collect names, locations, company terms, known passwords from context. A single specific word can be decisive.
3. 3
   Start with small rule sets: Begin with best64.rule, then expand if needed. Don't start immediately with dive.rule – it costs enormous time.
4. 4
   Hybrid before brute-force: Wordlist + ?d?d?d?d or + ?d?d?d?d?s covers the majority of real passwords and is much faster than blind brute-force.
5. 5
   Keep masks realistic: Derive patterns from context (organization's password policies, known password frequencies). Check keyspace with --keyspace in advance.
6. 6
   Validate candidates in advance: Always test every new rule or mask with --stdout | head before investing GPU time.
7. 7
   Save sessions with --session: Always start long attacks with a session name. Resume with --restore after interruption.
8. 8
   Document results: Log all hits and successful rules with --outfile and --debug-file. In GovCracker results are saved automatically and can be exported.
9. 9
   Stay within legal boundaries: Only attack lawfully seized evidence or authorized systems. Document Hashcat actions and record them in the report.