How to use oclHashcat on Ubuntu for password cracking testing

Hashcat is the practical successor to oclHashcat, the standalone OpenCL password-cracking tool used in older security tutorials. Modern Ubuntu systems install the unified hashcat package, whose GPU acceleration still relies heavily on OpenCL. This guide explains how to prepare hardware, select the correct hash mode, and run controlled tests against password hashes you are authorised to examine.

The work must stay within a written testing agreement. Australian organisations may also be bound by the Privacy Act 1988, the Australian Privacy Principles, the Criminal Code Act 1995, and the Telecommunications Interception and Access Act 1979. Obtain permission to test specific accounts, define permitted techniques and dates in writing, and avoid collecting information that the engagement does not require.

The workflow begins with a small set of synthetic hashes, followed by dictionary, rule-based, and mask attacks. You then examine the cracked hashes, record performance and coverage, and remove sensitive results when the exercise ends. Nothing in the process requires access to somebody else’s account or password.

Ubuntu installations are common in Australian homes, studios, and small offices around Sydney, Melbourne, and Brisbane. The UbuntuNext community site offers useful Ubuntu-specific background, while this guide focuses on a controlled password-cracking test using current hashcat commands.

Distinguish legacy oclHashcat from modern hashcat

Older instructions often download a binary called oclHashcat and reference version 1.2. That project was merged into hashcat 2, so modern distributions no longer maintain a separate oclHashcat package. Installing hashcat gives access to the same basic cracking model while providing current kernels, device handling, session restoration, and hash-mode definitions.

A hash mode identifies the password hashing algorithm. For example, mode 1400 represents SHA-256 and mode 0 represents MD5. The correct mode must match how the test hash was created; using the wrong mode can make a valid password appear absent from the entire wordlist.

Before creating any test material, confirm the installed version and available algorithms. The device list also shows whether Ubuntu can see a GPU through OpenCL:

hashcat --version
hashcat --example-hashes
hashcat -I

If hashcat -I lists only a CPU, the GPU driver or OpenCL runtime still needs attention. Treat this as a setup problem rather than assuming the cracking configuration is ready.

Prepare a legally authorised Ubuntu lab

Create a dedicated account and directory for the engagement. Keep test hashes, candidate lists, logs, and recovered passwords separate from personal files, cloud folders, and real corporate data. A simple home directory is sufficient for a small evaluation, while a client engagement may require an encrypted disk and an agreed retention process.

The following commands create the basic directory structure and protect it from other local users:

mkdir -p ~/hashcat-lab/{hashes,wordlists,rules,results}
chmod 700 ~/hashcat-lab

Use only synthetic identities and deliberately weak passwords for the initial run. Australian personal habits are still worth representing safely: common dates often appear as DD/MM/YYYY, mobile numbers use 04 or +61 formats, and local references may include city names, suburbs, clubs, or sporting terms such as AFL. These details make a test corpus realistic without exposing an actual customer.

Record the authorisation boundary before starting. It should identify the authorised systems or hash files, approved users, attack types, testing window, handling rules, and person to contact when something unexpected occurs. A vague instruction to “test security” is not sufficient authority.

Install and verify GPU acceleration on Ubuntu

Ubuntu’s package repositories usually provide hashcat and the OpenCL tools needed to detect compatible hardware. If hashcat is unavailable, enable the universe repository first. Install the CPU-capable version initially, then add the vendor-specific OpenCL component required by the graphics adapter.

sudo apt update
sudo apt install hashcat clinfo ocl-icd-libopencl1

Intel systems generally use intel-opencl-icd, while many AMD systems use mesa-opencl-icd. NVIDIA systems normally require the proprietary driver recommended by Ubuntu rather than the generic open-source driver. Some Australian-market gaming laptops contain both integrated and discrete graphics, so device detection is particularly important.

sudo apt install intel-opencl-icd
sudo apt install mesa-opencl-icd
sudo ubuntu-drivers autoinstall
sudo reboot

On AMD or Intel systems, the current account may also need access to the video and render groups. Log out and back in after changing group membership. Run clinfo to confirm that an OpenCL platform appears, then use hashcat’s device listing and benchmark:

clinfo
hashcat -I
hashcat -b --runtime 5

During a long run, some testers monitor progress from another device; for personal audio between checks, this Bluetooth earbud comparison provides a practical accessory guide. The cracking workstation itself still needs stable power, driver support, and adequate ventilation.

Build a harmless password test corpus

A small custom wordlist makes the first run easier to audit than a large collection downloaded from an unknown source. The following candidates reflect Australian formats and locations while remaining synthetic. Confirm that the placeholder mobile number is not associated with any subscriber before using a similar value elsewhere.

printf '%s\n' \
  'Password123!' \
  'summer2026' \
  'Melbourne1998' \
  'Brisbane2025!' \
  'Sydney2026' \
  '31/12/2025' \
  'Newtown2024!' \
  'AFL2025!' \
  '+61400000000' > wordlists/lab-passwords.txt

Generate a known SHA-256 hash and a known MD5 hash from those candidates. The absence of a newline after the password is important because hashcat reads each candidate as one line without the line-ending character:

printf '%s' 'Password123!' | sha256sum | awk '{print $1}' > hashes/sha256.txt
printf '%s' 'summer2026' | md5sum | awk '{print $1}' > hashes/md5.txt

Larger public collections, such as those maintained in SecLists, can broaden coverage during an authorised assessment. They remain candidate data, not evidence of compromised credentials. Small custom rule files also help demonstrate how policy changes affect strength. This file appends either 1 or 2 to each candidate:

printf '$1\n$2\n' > rules/append-digit.rule

Hashcat may also include ready-made rules under /usr/share/hashcat/rules, depending on the package version and installation method. Inspect the available files rather than assuming a particular path.

Run dictionary, rule, and mask attacks

A straight dictionary attack checks every supplied candidate exactly as written. The 1400 mode must match the SHA-256 file, while -D 2 selects GPU devices if the earlier device check succeeded. The separate potfile and output file keep the exercise organised:

hashcat -m 1400 hashes/sha256.txt wordlists/lab-passwords.txt -D 2 \
  --potfile-path=results/lab.pot --outfile=results/cracked.txt

Rules extend each candidate through substitutions, appending characters, or other transformations. A rule attack can recover Password123! when the original list contains only Password123, showing why measuring base wordlists alone understates practical resistance:

hashcat -m 1400 hashes/sha256.txt wordlists/lab-passwords.txt -D 2 \
  -r rules/append-digit.rule \
  --potfile-path=results/lab.pot --outfile=results/cracked.txt

A mask attack generates candidates from character classes. Here, ?l means lowercase and ?d means a digit, producing roughly 176 million combinations. The runtime limit makes this suitable for a controlled demonstration:

hashcat -m 1400 hashes/sha256.txt -a 3 '?l?l?l?d?d?d?d' -D 2 \
  --runtime 60 --session ubuntu-lab \
  --potfile-path=results/lab.pot --outfile=results/cracked.txt

Interrupting a longer session with Ctrl+C saves its state. Running the same command again resumes from the saved position. A run stopped by the runtime limit is only a partial search unless hashcat explicitly reports that the candidate space was exhausted.

Verify results and interpret failures

Hashcat stores recovered values in the potfile, while the output file records cracked hash and password pairs. Use the show, left, and output commands to confirm what was actually recovered:

hashcat -m 1400 hashes/sha256.txt --show --potfile-path=results/lab.pot
hashcat -m 1400 hashes/sha256.txt --left --potfile-path=results/lab.pot
less results/cracked.txt

The recovered plaintext should remain within the authorised lab environment. A useful report records the hash mode, candidate source, attack type, elapsed time, average speed, GPU model, number of recovered hashes, and hashes left untested. Avoid distributing the potfile or cracked output with general performance notes.

When a known password is not recovered, check the original hash generation first. Recalculate it and compare the hexadecimal value with the test file:

printf '%s' 'Password123!' | sha256sum

A mismatch commonly indicates the wrong hash mode, an accidental newline, a malformed hash file, or a rule that was not applied. If the hash and configuration are correct, examine candidate coverage and whether the attack actually used the intended GPU.

Make the exercise repeatable and private

Australian home networks often connect phones, laptops, televisions, and financial applications through the same NBN-connected router. Keep the test device on an isolated network or spare Ethernet segment, and avoid running hashcat over shared café Wi-Fi in Melbourne, Sydney, or other public locations. A virtual machine is convenient, although it must have direct access to the host GPU for meaningful acceleration.

Store the potfile and recovered passwords with restrictive permissions, and exclude them from cloud synchronisation. When the engagement ends, delete the plaintext output, potfile, temporary candidates, and any authorised copies. Keep only the agreed report or non-sensitive metrics. If a client’s data was used, follow its contractual retention and destruction requirements.

Document the procedure so another tester can reproduce it: package versions, GPU and driver details, hash modes, candidate sources, rules, commands, and measured durations. Include the authorisation reference and responsible personnel in the report, while keeping recovered credentials out of ordinary email and chat systems. That separation protects both the organisation and the people whose synthetic or authorised data was tested.

The practical takeaway is a reproducible baseline rather than a claim about speed: one authorised account, one confirmed hash mode, one synthetic corpus, and one measured run create a defensible result that can guide stronger password policies, multi-factor authentication, storage controls, and user training.