What attack type is hashcat using with -a 0, a wordlist, and rules?

PT0-002 By islever Editorial Last updated

Short answer

B Dictionary

Question

A penetration tester would like to crack a hash using a list of hashes and a predefined set of rules. The tester runs the following command: hashcat.exe -a 0 .\hash.txt .\rockyou.txt -r .\rules\replace.rule Which of the following is the penetration tester using to crack the hash?
  1. Hybrid attack
  2. Dictionary Correct Answer
  3. Rainbow table
  4. Brute-force method

Key Takeaways

The test is checking whether you understand that applying rules to a wordlist is still a dictionary attack, not a separate 'hybrid' attack mode in Hashcat.

The command hashcat -a 0 hash.txt rockyou.txt -r replace.rule is a dictionary (wordlist) attack with rule-based word mangling. Community consensus strongly favors answer B (Dictionary), as -a 0 explicitly designates the straight dictionary attack mode in Hashcat.

Common mistake: Choosing A. Hybrid attack is the most common mistake because the rule file modifies words, but Hashcat's hybrid modes (6 and 7) combine a wordlist with a mask, not with a rule file. Rule-based cracking is an extension of dictionary mode.

Expert Analysis

Why the Answer Is Correct

Hashcat's -a 0 flag selects attack mode 0, which is officially the 'Straight' or dictionary attack. The command feeds rockyou.txt as the dictionary and applies replace.rule to each word before hashing. This is a classic rule-based dictionary attack, so B is correct. Comments [1] and [2] both correctly explain that -a 0 defines a dictionary attack and the rule file merely applies transformations to the dictionary entries.

Why the Other Options Are Wrong

A. Hybrid attack in Hashcat refers to combining a wordlist with a brute-force mask (modes 6 and 7), such as ?d or ?a patterns, not a .rule file. C. Rainbow table would require precomputed hash tables, not a wordlist. D. Brute-force method would use -a 3 and a character set/mask, not a dictionary. Therefore none of these match the given -a 0 command.

Community Comment Notes

Comment [1] highlights that the command specifies a straight dictionary attack mode and points to rockyou.txt as the dictionary. Comment [2] provides a clean breakdown of each command element and concludes dictionary attack. Comment [3] incorrectly claims 'Hybrid attack,' but this contradicts the official Hashcat attack mode definition and the majority vote of 80% for B. The rule file does not make it a hybrid attack; hybrid attacks in Hashcat specifically use masks.

Official Reference

These links open the official vendor documentation in a new tab.

Exam Strategy

For Hashcat command questions, always identify the attack mode flag first: -a 0=dictionary, -a 3=brute-force, -a 6/7=hybrid. If a rule file -r is present along with -a 0, it is still a dictionary attack, just with mangling rules.

Community Votes

B
80%
A
20%

80% of anonymous learners picked answer B. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 3 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 3

  1. Alex818119 👍 3 Answered B
    Bing AI says the answer is B: In this scenario, the penetration tester is using a combination of a wordlist and predefined rules to crack the hash. The command provided uses a dictionary (wordlist) attack along with specific rules for modifying the words in the list. The best answer here is: B. Dictionary By using -a 0, the tester specifies a straight dictionary attack mode. The rockyou.txt file is the wordlist, and the replace.rule file contains the rules for modifying the words in the dictionary during the attack.
  2. zemijan 👍 1 Answered B
    dictionary attack: hashcat.exe: Runs the Hashcat tool. -a 0: Specifies a dictionary attack mode (standard dictionary-based cracking). .\hash.txt: File containing the list of hashes to crack. .\rockyou.txt: A wordlist (dictionary) used to try common passwords. -r .\rules\replace.rule: Applies a set of transformation rules (e.g., replacing characters, appending numbers, etc.) to the dictionary entries to increase the chance of matching the hash.
  3. Learner213 👍 1 Answered A
    Test answer is Hybrid attack.

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Submitted for moderation before publishing. Keep it helpful and respectful.

Which Post-Report Activity Prevents CISO Disputing Finding Validity?

S-grade

How should penetration testers prioritize findings in a report?

S-grade

Which agreement did a pen tester breach by requesting a CVE without authorization?

S-grade

Which Tool Best Detects Vulnerabilities on a Database Server?

S-grade

← Back to PT0-002 Study Guide