You have:        "5f4dcc3b5aa765d61d8327deb882cf99"
                           ↓
                   [Identify hash type]
                           ↓
                   Likely MD5 (32 hex chars)
                           ↓
              [Try online database first]
                           ↓
              CrackStation.net: Found!
                           ↓
        Plaintext: "123456"

# hashid can identify hash type
pip3 install hashid
hashid '$2y$10$...'
hashid 'd41d8cd98f00b204e9800998ecf8427e'

# Or use hash-identifier
hash-identifier
# Enter the hash at the prompt

# Basic wordlist attack (mode -a 0)
hashcat -m 0 hash.txt /usr/share/wordlists/rockyou.txt        # MD5
hashcat -m 100 hash.txt /usr/share/wordlists/rockyou.txt      # SHA-1
hashcat -m 1400 hash.txt /usr/share/wordlists/rockyou.txt     # SHA-256
hashcat -m 1700 hash.txt /usr/share/wordlists/rockyou.txt     # SHA-512
hashcat -m 3200 hash.txt /usr/share/wordlists/rockyou.txt     # bcrypt ($2y)
hashcat -m 1000 hash.txt /usr/share/wordlists/rockyou.txt     # NTLM

# With rules (mangling/mutations)
hashcat -m 0 hash.txt rockyou.txt -r /usr/share/hashcat/rules/best64.rule

# Brute force all 4-char alphanumeric (-a 3)
hashcat -m 0 hash.txt -a 3 ?a?a?a?a

# Combinator attack (wordlist1 + wordlist2)
hashcat -m 0 hash.txt -a 1 wordlist1.txt wordlist2.txt

# Show cracked result
hashcat -m 0 hash.txt --show

# Auto-detect hash type
john hash.txt

# With wordlist
john hash.txt --wordlist=/usr/share/wordlists/rockyou.txt

# Specify format
john hash.txt --format=raw-md5 --wordlist=rockyou.txt
john hash.txt --format=bcrypt --wordlist=rockyou.txt

# Show cracked passwords
john hash.txt --show

# Rule-based mutations
john hash.txt --wordlist=rockyou.txt --rules=best64

raw-md5, raw-sha1, raw-sha256, raw-sha512
bcrypt, sha512crypt, sha256crypt, md5crypt
nt (NTLM), lm, mssql, mysql-sha1
zip, 7z, rar, pdf, ssh

# Masks:
# ?l = lowercase a-z
# ?u = uppercase A-Z
# ?d = digit 0-9
# ?s = special char
# ?a = all above

# All 8-char lowercase
hashcat -m 0 hash.txt -a 3 ?l?l?l?l?l?l?l?l

# Capital + 6 lowercase + 2 digits (password like "Secret12")
hashcat -m 0 hash.txt -a 3 ?u?l?l?l?l?l?l?d?d

# 4-digit PIN
hashcat -m 0 hash.txt -a 3 ?d?d?d?d

# With custom charset
hashcat -m 0 hash.txt -a 3 -1 ?l?d ?1?1?1?1?1?1?1?1

# The flag is "flag{something}" - wordlist with flag format
python3 -c "
import itertools, string
for combo in itertools.product(string.ascii_lowercase + string.digits + '_', repeat=6):
    print('flag{' + ''.join(combo) + '}')
" > flag_wordlist.txt

hashcat -m 0 hash.txt flag_wordlist.txt

# Format: hash:salt
echo "hash:salt" > salted.txt
hashcat -m 10 salted.txt wordlist.txt    # MD5(pass+salt)
hashcat -m 20 salted.txt wordlist.txt    # MD5(salt+pass)

import hashlib
# If hash = MD5(MD5(password)):
h = hashlib.md5(hashlib.md5(b'password').hexdigest().encode()).hexdigest()

import hashlib

def crack_md5(target_hash, wordlist_path):
    with open(wordlist_path, 'r', errors='ignore') as f:
        for word in f:
            word = word.strip()
            h = hashlib.md5(word.encode()).hexdigest()
            if h == target_hash:
                return word
    return None

result = crack_md5("5f4dcc3b5aa765d61d8327deb882cf99", "/usr/share/wordlists/rockyou.txt")
print(result)  # → "password"