What attack type is hashcat using with -a 0, a wordlist, and rules?
A penetration tester would like to crack a hash using a list of hashes and a predefined set of rules. The tester runs the following command: hashcat.exe -a 0 .\hash.txt .\rockyou.txt -r .\rules\replace.rule Which of the following is the penetration tester using to crack the hash?
Community Votes
80% of anonymous learners picked answer B. Votes are pick records left by other test-takers — they are not the verified answer.
Community Insight
The test is checking whether you understand that applying rules to a wordlist is still a dictionary attack, not a separate 'hybrid' attack mode in Hashcat.
The command hashcat -a 0 hash.txt rockyou.txt -r replace.rule is a dictionary (wordlist) attack with rule-based word mangling. Community consensus strongly favors answer B (Dictionary), as -a 0 explicitly designates the straight dictionary attack mode in Hashcat.
Choosing A. Hybrid attack is the most common mistake because the rule file modifies words, but Hashcat's hybrid modes (6 and 7) combine a wordlist with a mask, not with a rule file. Rule-based cracking is an extension of dictionary mode.
Community Discussion (3 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
Hashcat's-a 0 flag selects attack mode 0, which is officially the 'Straight' or dictionary attack. The command feeds rockyou.txt as the dictionary and applies replace.rule to each word before hashing. This is a classic rule-based dictionary attack, so B is correct. Comments [1] and [2] both correctly explain that -a 0 defines a dictionary attack and the rule file merely applies transformations to the dictionary entries.Why the Other Options Are Wrong
A. Hybrid attack in Hashcat refers to combining a wordlist with a brute-force mask (modes 6 and 7), such as?d or ?a patterns, not a .rule file. C. Rainbow table would require precomputed hash tables, not a wordlist. D. Brute-force method would use -a 3 and a character set/mask, not a dictionary. Therefore none of these match the given -a 0 command.Community Comment Notes
Comment [1] highlights that the command specifies a straight dictionary attack mode and points torockyou.txt as the dictionary. Comment [2] provides a clean breakdown of each command element and concludes dictionary attack. Comment [3] incorrectly claims 'Hybrid attack,' but this contradicts the official Hashcat attack mode definition and the majority vote of 80% for B. The rule file does not make it a hybrid attack; hybrid attacks in Hashcat specifically use masks. Official Reference
Exam Strategy
For Hashcat command questions, always identify the attack mode flag first: -a 0=dictionary, -a 3=brute-force, -a 6/7=hybrid. If a rule file -r is present along with -a 0, it is still a dictionary attack, just with mangling rules.