What attack type is hashcat using with -a 0, a wordlist, and rules?

A penetration tester would like to crack a hash using a list of hashes and a predefined set of rules. The tester runs the following command: hashcat.exe -a 0 .\hash.txt .\rockyou.txt -r .\rules\replace.rule Which of the following is the penetration tester using to crack the hash?

  1. Hybrid attack
  2. Dictionary Source Reference Answer
  3. Rainbow table
  4. Brute-force method

Community Votes

B
80%
A
20%

80% of anonymous learners picked answer B. Votes are pick records left by other test-takers — they are not the verified answer.

Community Insight

The test is checking whether you understand that applying rules to a wordlist is still a dictionary attack, not a separate 'hybrid' attack mode in Hashcat.

The command hashcat -a 0 hash.txt rockyou.txt -r replace.rule is a dictionary (wordlist) attack with rule-based word mangling. Community consensus strongly favors answer B (Dictionary), as -a 0 explicitly designates the straight dictionary attack mode in Hashcat.

Choosing A. Hybrid attack is the most common mistake because the rule file modifies words, but Hashcat's hybrid modes (6 and 7) combine a wordlist with a mask, not with a rule file. Rule-based cracking is an extension of dictionary mode.

Community Discussion (3 comments)

Alex818119 👍 3 Selected: B
Bing AI says the answer is B: In this scenario, the penetration tester is using a combination of a wordlist and predefined rules to crack the hash. The command provided uses a dictionary (wordlist) attack along with specific rules for modifying the words in the list. The best answer here is: B. Dictionary By using -a 0, the tester specifies a straight dictionary attack mode. The rockyou.txt file is the wordlist, and the replace.rule file contains the rules for modifying the words in the dictionary during the attack.
Learner213 👍 1 Selected: A
Test answer is Hybrid attack.
zemijan 👍 1 Selected: B
dictionary attack: hashcat.exe: Runs the Hashcat tool. -a 0: Specifies a dictionary attack mode (standard dictionary-based cracking). .\hash.txt: File containing the list of hashes to crack. .\rockyou.txt: A wordlist (dictionary) used to try common passwords. -r .\rules\replace.rule: Applies a set of transformation rules (e.g., replacing characters, appending numbers, etc.) to the dictionary entries to increase the chance of matching the hash.

Comments & Corrections

No comments yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Submitted for moderation before publishing. Keep it helpful and respectful.

Expert Analysis

Why the Answer Is Correct

Hashcat's -a 0 flag selects attack mode 0, which is officially the 'Straight' or dictionary attack. The command feeds rockyou.txt as the dictionary and applies replace.rule to each word before hashing. This is a classic rule-based dictionary attack, so B is correct. Comments [1] and [2] both correctly explain that -a 0 defines a dictionary attack and the rule file merely applies transformations to the dictionary entries.

Why the Other Options Are Wrong

A. Hybrid attack in Hashcat refers to combining a wordlist with a brute-force mask (modes 6 and 7), such as ?d or ?a patterns, not a .rule file. C. Rainbow table would require precomputed hash tables, not a wordlist. D. Brute-force method would use -a 3 and a character set/mask, not a dictionary. Therefore none of these match the given -a 0 command.

Community Comment Notes

Comment [1] highlights that the command specifies a straight dictionary attack mode and points to rockyou.txt as the dictionary. Comment [2] provides a clean breakdown of each command element and concludes dictionary attack. Comment [3] incorrectly claims 'Hybrid attack,' but this contradicts the official Hashcat attack mode definition and the majority vote of 80% for B. The rule file does not make it a hybrid attack; hybrid attacks in Hashcat specifically use masks.

Official Reference

Exam Strategy

For Hashcat command questions, always identify the attack mode flag first: -a 0=dictionary, -a 3=brute-force, -a 6/7=hybrid. If a rule file -r is present along with -a 0, it is still a dictionary attack, just with mangling rules.

Related Analysis

← Back to PT0-002 Study Guide