Hashcat is the world's fastest password recovery tool and the de facto standard for password security auditing. It's an open-source, GPU-accelerated cracker that supports over 350 hash algorithms across five attack modes. During authorized pentests, it's used to audit password strength — you extract hashes from a target system (SAM dump, /etc/shadow, database dump) and crack them offline to demonstrate weak credential policies.

Here's your comprehensive wordlist reference for hacking & cracking. This is a(n) article / guide on cracking & hacking with wordlists.

Hydra is a parallelized network login cracker that supports many protocols (SSH, FTP, HTTP/S, SMB, RDP, MySQL, SMTP, etc.). This is a(n) article / guide on Hydra.

Mimikatz is the gold standard for credential extraction on Windows systems. It extracts plaintext passwords, NTLM hashes, Kerberos tickets, and more from memory. This is a(n) article / guide on the Mimikatz tool for credential extraction.