Hashcat supports rule-based attacks that transform candidate credentials during cracking. Which statement is true?

• A. Rules allow on-the-fly modification of candidate guesses to increase success
• B. Rules slow down cracking and are rarely useful
• C. Rules only apply to rainbow tables
• D. Rules expose hashed password values

Answer: (A)

Rule-based attacks work by applying transformations to each candidate password as it is tested. This on-the-fly modification lets you generate many plausible variants from a single guess—such as changing case, appending digits, substituting characters, or adding common suffixes—without having to precompute or store every variant. By encoding a broad set of common password patterns in a compact rule file, you effectively expand the search space in a targeted, efficient way, improving the chances of a match while keeping the process streamlined. It’s not about rainbow tables, it doesn’t reveal hashed values, and while there is some overhead, the practical benefit is a much higher success rate.