hashcat Forum

Hello, I would like to ask you about functionality of the --skip and --limit parameters.

Let me show you my problem on an example.

First I checked hashcat-keyspace of 8x ?l mask:


OK, so about 12 milion indexes, I tried to search the first half of some testing Office document.


That took me about 1.5 minute. Let's now finish the second half, skip the first 6mil indexes and...


Time remaining: One hour+. 

Could you please clarify what exactly is entered into skip and limit parameters, when not the hashcat-keyspace?

I noticed, for the first limit, 6mil, hashcat tried about 4 bilions passwords. And maximum --skip parameter value hashcat allowed here is much smaller then real keyspace (cosnidering 26^8 = 208 bilion and maximum --skip value here is something about 300 milions), so neither the real keyspace is used in limit nor skip arguments.

Looking forward to your answer!

your examples above have 2 different masks:

you used ?l?l?l?l?l?l?l?l for the keyspace calculation and ?l?l?l?l?l?l?l? for the actual run.

You should always use the same mask!

Furthermore, you should have also used this command instead:

The hash type is sometimes important when using --keyspace, so you better always specify it.

BTW: for office documents (of the same type as 9700) there are the collider modes (-m 9710 and -m 9720) which depending on the mask (or password policy etc) should make it even more easier for you to quickly access the data

Sorry, that was just a typo I did in a post (I will edit it). I ran the computation always with mask ?l?l?l?l?l?l?l?l.

Thanks for the answer, this clarifies everything!