---
title: "Cracking MD5 passwords with Hashcat in Kali Linux - Cybr"
description: "Cracking MD5 passwords with Hashcat in Kali Linux: a thread from the Introduction to Application Security (AppSec) forum on Cybr, with 1 reply. Read-only archive."
url: https://cybr.com/forums/topic/cracking-md5-passwords-with-haschat-in-kali-linux/
---

Topic

# Cracking MD5 passwords with Hashcat in Kali Linux

1 reply

**Archived.** These forums are read-only. The conversation continues on [Discord](https://cybr.com/discord/).

1. Christophe

   Jun 17, 2020

   **2021 UPDATE - view my response below if you're still having errors. Hashcat 6.0.0+ is best run on the host OS versus inside of a virtualized environment.**

   In the [SQL injection lesson](https://cybr.com/courses/introduction-to-application-security-appsec/lessons/sql-injection-attacks-part-3/), we were able to output MD5-hashed passwords from the database. I then proceeded to use an [online website](https://md5hashing.net/hash) to crack a couple of the hashes in order to see the plaintext password. I also mentioned we could use tools in Kali to do this instead of the website.

   One of those tools is called [Hashcat](https://tools.kali.org/password-attacks/hashcat). Here's how we could have used it in the lesson to achieve the same outcome:

   ```
   hashcat '5f4dcc3b5aa765d61d8327deb882cf99' /usr/share/wordlists/rockyou.txt
   ```

   The default for hashchat is MD5, otherwise, we could use the -m option and specify a different hash type. Also, you can specify a different wordlist if you'd like.

   Note: if you get this error message:

   ```
   * Device #1: Not a native Intel OpenCL runtime. Expect massive speed loss. You can use --force to override, but do not report related errors. No devices found/left.
   ```

   You can use the --force flag. Since this is a basic MD5 hash, it will still go very fast.

   ```
   hashcat '5f4dcc3b5aa765d61d8327deb882cf99' /usr/share/wordlists/rockyou.txt --force
   ```

   ![Hashcat demonstration for cracking MD5 passwords](https://media.cybr.com/2020/06/hashcat.jpg)

2. Christophe

   Aug 18, 2021

   Since a hashcat upgrade to v6.0.0+, running hashcat within a virtualized environment is giving errors. The best approach is to not run hashcat inside of Virtual Box or VMWare, and instead, to run it on your host machine. There will be fewer issues with drivers and access to more of your hardware that way.

[< Back to Introduction to Application Security (AppSec)](https://cybr.com/forums/forum/introduction-to-application-security/)