A mask attack is a targeted form of password cracking that uses known patterns to reduce the search space, making it far more efficient than a full brute force approach. This technique is applied in Hashcat using character placeholders to isolate and crack unknown portions of a password.
Let's take a look at mask attacks. We will be practicing this, but remember that these skills are for ethical hacking purposes only.
We did a lesson on brute force attacks, and every time we add another character to the password, it makes that password so much harder to guess, that really the amount of variance that could be with that password makes a brute force attack not very effective. But there still is another attack that can be very effective but not have nearly as much processing power to check those passwords, or to crack those passwords. One of the sites that I read defined a mask attack as being a targeted brute force attack that streamlines the cracking process.
Let's take a look at a couple of scenarios so we can understand what this mask attack is used for. First of all, let's take a look at a password history example. A lot of people will have these same passwords, but their work requires them to change their passwords. Maybe it's every 90 days, maybe it's every 180 days, but they have to change it. And what they resort to is just putting something different at the end, because they have maybe what they consider a complex password and they don't want to keep memorizing a new password. So they just count up: 1, 2, 3, 4, 5, 6, 7. Well, if anybody were ever to be able to see their past passwords at all, they would be able to guess what the sequence is and be able to predict what the next sequence is. So this is problematic. But we can use a mask attack to be able to figure out which password is being used at any given time.
Here's scenario number two: this user right here has passwords at each one of the sites. At least they know that each site they visit needs to have a different password. And maybe they feel like their password is fairly complex, but they don't change the whole password. There's only part of the password they change depending on what site they're visiting. So they have a password for their bank, and for their work, for their email, for their school. Well, we can devise a mask. If we know that this is one of their passwords, we can identify, oh, that's their work password. I wonder what else they have. And we devise a mask to help crack this password at one of their sites. So this would be another great use for a mask attack.
Really, mask attacks apply in a lot of different scenarios. In this case right here, we have fairly decent passwords, but we can see a pattern forming. All these passwords are probably to different sites. And the user of these passwords feels like they're fairly secure, and for the most part, they are, except for they do have four characters or four numbers at the beginning, four lowercase letters in the middle, and four uppercase letters at the end. Essentially what this does is it gives us a pattern that we can work with that a mask attack would be fairly effective on. So this is a good scenario where we'd use a mask attack.
The thing is that passwords are being stolen all the time. I think it's almost a yearly occasion where some account has notified me that their passwords have been hacked or their accounts have been hacked, and some of my personal information has gotten out, some of which can be the account login and the passwords for those accounts. And so this is problematic, because now other users out there know my passwords. So if I'm using that same password at other sites, this can be problematic. Or if I have some sort of pattern that I use for all of my sites, that can be a problem as well. This site right here, Have I Been Pwned, you can look up your email address and see if your information has gotten out there. This would put you at risk for somebody to crack your password and see what kind of patterns that you have when creating passwords.
Quite simply, mask attacks use masks. Well, what's a mask? A mask is a way for us to identify certain information that is known, while letting the computer go through several different iterations, many different iterations, to try to figure out what's unknown here. So think of it as a wild card. This is an Uno card and it's a wild card. If I were to play this in the game of Uno, what I could do is choose what color it's going to be next. And so really it's the same type of concept. In this case, it's going to try many different combinations for the parts that are wild cards. And we commonly use asterisk as being the wild parts. Not when we get into hashcat, but for many programs they'll use asterisks. So a mask will selectively reveal or conceal certain parts of data. That's what a mask means in computers.
So think about this. If you go to a masquerade ball, you're going to wear a mask. And the mask sometimes can be big or sometimes it can be small, but it's covering a certain portion of you. So in this case right here, we can see their eyes. We can see maybe their nose. We can see their mouth. We can see their hair. We can see the clothes that they're wearing. We can see certain aspects of this person. But what we can't see is what is not shown behind that mask. The part that's covered up, we don't see. And so our mind has to kind of interpret what is behind that masked part. Well, it's the same type of thing: we're giving the computer certain pieces of information, but then we're letting the computer fill in the rest of it.
I've seen a lot of variations of the password. If this is a password that somebody's using, I've seen it just spelled out like normal English. I've seen them replace A's with ampersands or at symbols. I've seen S's replaced with dollar signs. I've seen O's replaced with zeros. And I've seen a lot of different combinations of this. Sometimes they'll add characters at the end of this. So if I want to see what variation is being used, all I have to do is create a mask that interprets what these characters are.
Then we have the known characters here. We're going to be doing this in hashcat. So we can specify several things in hashcat. For instance, if we want to specify a lowercase letter, that's going to be a question mark L. If I want to do an uppercase, that's going to be a question mark U, and that will specify an uppercase letter. Or if I want a number, that's going to be a question mark D for digit, and so it's going to be 0 through 9. Or if it's hexadecimal, hexadecimal lowercase or hexadecimal uppercase, or any kind of special characters, that's going to be a question mark S.
So in this case right here, if we've got a series of passwords that's counting up — one of those things that somebody is counting up — what we would do is place a question mark D for digit, and it would try every variation of password with the O being replaced by a digit here. So now it just needs to go through and check 10 iterations of this, and then it will find its match.
So this is the command we're going to use. We're going to do hashcat -m0. This is going to select MD5. The zero means MD5 is the hash that we're going to use. So we'll put that MD5 hash in there. And then we're going to do a -a3. This is the attack mode, and we'll see what that looks like here. And then we also will do the password with a question mark D to replace it with the digit.
So I'm on my Kali Linux box, and what I'm going to do is the hashcat, and we'll do -m0 -a3, and then we will paste that hash in there. Paste from the clipboard — I've already created the hash for this. And we're going to see which version of the word password this is. So then what we'll do is we'll type in P A S S W question mark D R D, and then we'll hit enter with this. And it found the hash and the password associated with the hash, which is password with a nine in there. That's what it found, and it cracked this hash.
Let's take a look at that command one more time. It has this -a3. Let's just take a quick look and see what that looks like. That's the attack mode. Here are the different attack modes right here. We've done in another lesson the straight, which is zero. What that just means is that we're taking a word list and we're comparing it against some sort of word list like a dictionary attack. And then in this case, it's a -a3. So what hashcat is considering is that a brute force attack, or a mask attack, is a type of brute force attack. So this is a brute force attack, and we're using a mask to carry out that brute force attack.
If I knew somebody had a certain pattern to their passwords, and there's only a section of it changed, what I could do is I could statically put in my password part of this. And for the middle part, it looks like it always starts with a capital letter, so that would be a percent U. Then next, it's followed by three lowercase, so I'd do percent L, percent L, percent L. And I could then run it against this and figure out what all of their passwords were for all of their sites. This one would take much longer to run, but it wouldn't be a full brute force attack where we could do something.
We know that there's 12 characters total. We could do a percent D four times for that. A percent lowercase number or letter, so that would be percent L, and then uppercase, percent U. Of course, this would be times four; it would have to be written out four times. But essentially, they could create the pattern within hashcat in order to hack all of these passwords. So then I would have their passwords.
Now, if I wanted to do a brute force attack rather than a mask attack — that is, I wanted to go through every iteration of something — we can use the same command. In fact, it gives us an example of this right here. So what we would do is type in this command at the end: hashcat -a3 -m0. So a3 is doing the brute force attack and it's using a hash here. It's using a file as a hash, but we would just use a hash. We could substitute a hash into there. And then it's doing percent a, percent a, percent a, percent a, percent a, percent a. And so what this would do, the percent a — if we scroll up here, it shows us it's actually checking all lowercase, uppercase, digits, and also the s, which is special character, the symbols. So that is going to check everything there. So now what it could do is check all six-letter passwords there could be against whatever hash that we have here. So we could do a brute force attack using a mask attack.
The one drawback to this is that this would only check six-letter passwords, or six-character passwords. So if we do a -increment at the end of this, which is missing from this command — but if we did a -increment, then it would increment up through all of these. So it'd start out with one character, and then two characters, and then three characters, and four characters, and five characters, and keep testing it up until it gets to, in this case, six characters long.
So here's the attack on a mask attack. In a mask attack, we're using different masks in order to be able to specify and get down to really what our passwords that are going to be tested are. So in this case right here, we've got password and we've got a percent D. So it's going to go through the iteration of 0 through 9 to test each one of those combinations out.
TechKnowSurge builds IT and cybersecurity professionals through hands-on, concept-first training built around real understanding — not memorization. Free interactive tools, structured programs, and 25+ years of real-world experience, all in one place.
Explore free tools and programs →