Hashcat (Advanced Password Recovery Tool)
- Biohazard
- 2 hours ago
- 13 min read
Hashcat (Password Hacking / Recovery Tool)
Hashcat is the world's fastest password recovery tool and the de facto standard for password security auditing. It's an open-source, GPU-accelerated cracker that supports over 350 hash algorithms across five attack modes. During authorized pentests, it's used to audit password strength — you extract hashes from a target system (SAM dump, /etc/shadow, database dump) and crack them offline to demonstrate weak credential policies.
Architecture - Why Hashcat Is So Fast
Hashcat doesn't just "use the GPU." It's built from the ground up for parallel hash computation.
GPU Acceleration
A modern GPU has thousands of cores. An NVIDIA RTX 4090 has 16,384 CUDA cores. Hashcat distributes hash computation across all of them simultaneously. For a simple hash like NTLM, a single 4090 can attempt over 300 billion guesses per second. Compare that to CPU-based cracking at maybe 2-3 million per second on a 32-core server. That's a 100,000x speed difference.
Hashcat achieves this through:
Kernel fusion: Multiple hash computation steps are fused into single GPU kernel operations, reducing memory round-trips
Wordlist caching in GPU VRAM: The wordlist is loaded into GPU memory once, then processed in parallel without touching system RAM
Rule engine on GPU: Rules are applied directly on the GPU, not pre-processed on the CPU
Vectorized operations: Single instructions process multiple data elements (SIMD at GPU scale)
Backend Options
Backend | API | Supported Hardware |
CUDA | NVIDIA's CUDA API | NVIDIA GPUs only |
OpenCL | OpenCL framework | AMD GPUs, Intel GPUs, CPUs |
Metal | Apple Metal API | Apple Silicon (M1/M2/M3/M4), AMD GPUs on macOS |
HIP/ROCm | AMD ROCm platform | AMD GPUs on Linux |
CPU | Fallback | Any x86/ARM CPU (slow, for testing only) |
On a system with multiple GPUs, hashcat uses all of them simultaneously with near-linear scaling. Four RTX 4090s produce roughly 4x the throughput of one.
Installation
Kali Linux (Pre-installed)
bash
hashcat --version
# Already there. Update with:
sudo apt update && sudo apt install hashcatBuilding from Source (for latest GitHub version)
bash
git clone https://github.com/hashcat/hashcat.git
cd hashcat
make
sudo make installWindows
Download the binaries from hashcat.net. Install the latest NVIDIA CUDA or AMD ROCm drivers. Extract the hashcat archive. Run hashcat.exe from the extracted folder.
Verify GPU Access
bash
hashcat -I
# Shows all detected devices, VRAM, driver versions
hashcat -b
# Built-in benchmark — runs all hash modes against your hardware
# Useful for performance estimation before an engagementAttack Modes
Hashcat has five attack modes, each with a distinct use case. Understanding when to use each is what separates effective password auditing from wasted GPU time.
Mode 0: Straight / Dictionary Attack (-a 0)
Feeds a wordlist line-by-line against the target hashes. Each line of the wordlist is one password candidate.
bash
hashcat -a 0 -m 1000 hashes.txt /usr/share/wordlists/rockyou.txtThis is the starting point for every audit. crackstation-human-only.txt, rockyou.txt, SecLists, and Hashes.org's found lists are the standards. If a password exists in a known breach, straight mode catches it in seconds.
Mode 1: Combinator Attack (-a 1)
Combines two wordlists — every word from list A appended to every word from list B.
bash
hashcat -a 1 -m 0 hashes.txt words1.txt words2.txtIf words1.txt contains Summer and words2.txt contains 2024!, the candidate Summer2024! is generated. This catches the "word + number/symbol" pattern that dominates corporate password policies.
The candidate count is len(list1) × len(list2). With two 10,000-word lists, that's 100 million candidates. Manageable. With two 1-million-word lists, that's 1 trillion — only viable for fast hashes with serious hardware.
Mode 3: Mask Attack / Brute-Force (-a 3)
Systematically tries every combination within a character set pattern. The pattern is defined by masks.
bash
hashcat -a 3 -m 1000 hashes.txt ?l?l?l?l?d?d?d?d
# Tries: aaaa0000 through zzzz9999Mask syntax:
Placeholder | Character Set |
?l | abcdefghijklmnopqrstuvwxyz |
?u | ABCDEFGHIJKLMNOPQRSTUVWXYZ |
?d | 0123456789 |
?s | !"#$%&'()*+,-./:;<=>?@[]^_`{|}~ |
?a | ?l + ?u + ?d + ?s (all 95 printable ASCII) |
?b | 0x00 - 0xff (all 256 byte values) |
?h | 0123456789abcdef (lowercase hex) |
?H | 0123456789ABCDEF (uppercase hex) |
Custom character sets:
-1 ?l?d → Set #1 = lowercase + digits
-2 ?u?s → Set #2 = uppercase + specials
hashcat -a 3 -m 0 --custom-charset1=?l?d --custom-charset2=?u?s hashes.txt ?1?1?1?1?2?2
# Uses custom set 1 for four characters, then custom set 2 for twoKeyspace estimation:
?l?l?l?l?l?l?l?l = 26^8 = 208 billion candidates
?l?l?l?l?l?l?d?d = 26^6 × 10^2 = 30.8 billion
?a?a?a?a?a?a?a?a = 95^8 = 6.6 quadrillion (intractable)8-character full ASCII brute-force is not practical on any hardware. This is why mask attacks require intelligence — you use the target's password policy to narrow the keyspace.
Mode 6: Hybrid Wordlist + Mask (-a 6)
Appends mask-generated suffixes to each wordlist entry.
bash
hashcat -a 6 -m 0 hashes.txt wordlist.txt ?d?d?d?d
# Tries: password0000, password0001, ... password9999This catches the pattern where users take a dictionary word and append numbers (the most common password creation strategy when a policy says "must contain numbers").
Mode 7: Hybrid Mask + Wordlist (-a 7)
Prepends mask-generated prefixes to each wordlist entry.
bash
hashcat -a 7 -m 0 hashes.txt ?d?d?d?d wordlist.txt
# Tries: 0000password, 0001password, ... 9999passwordCommon Hash Modes
Hashcat identifies hash algorithms by numeric mode. You specify the mode with -m. Using the wrong mode produces no results — hashcat looks for a specific format and length.
Mode | Hash Type | Where You'll Find It |
0 | MD5 | Legacy web apps, old CMS passwords |
100 | SHA1 | Old databases, Git commits |
1000 | NTLM | Windows local accounts, LSASS dumps, SAM dumps |
1400 | SHA2-256 | /etc/shadow on modern Linux ($5$) |
1700 | SHA2-512 (SHA512crypt) | Overloaded — used for many things |
1800 | SHA512crypt ($6$) | /etc/shadow on Linux |
2100 | Domain Cached Credentials (DCC/DCC2) | Windows domain cached logins (mscache2) |
2200 | NetNTLMv1 | Challenge-response captured via Responder or Inveigh |
3000 | LM | Legacy Windows LAN Manager (pre-Vista) |
3200 | bcrypt ($2a$, $2b$, $2y$) | Modern web apps (WordPress, Laravel, Django) |
5500 | NetNTLMv1 + ESS | NetNTLMv1 with Extended Session Security |
5600 | NetNTLMv2 | Challenge-response, Responder captures (most common) |
6800 | LastPass (SN), SHA-256 | LastPass vault password |
7300 | IPMI2 RAKP HMAC-SHA1 | Server BMC / IPMI interfaces |
7500 | Kerberos 5 AS-REQ Pre-Auth etype 23 | AS-REP roasting (accounts without pre-auth) |
8200 | 1Password Cloud Keychains | 1Password vault master password |
9200 | Cisco IOS $8$ | Cisco device passwords |
9600 | MS Office 2013 | Word/Excel/PowerPoint passwords |
9700 | MS Office 2010/2013 (SHA-512) | Older Office documents |
11600 | 7-Zip | Encrypted 7z archives |
13100 | Kerberos 5 TGS-REP etype 23 | Kerberoasting (service account hashes) |
13400 | KeePass 1/2 KDBX | KeePass database master password |
13600 | WinZip | Encrypted ZIP archives |
13711 | VeraCrypt SHA256 + XTS 512 | VeraCrypt volume password |
16700 | FileVault 2 | macOS FileVault encrypted drives |
18200 | Kerberos 5 AS-REP etype 23 | AS-REP roasting (Kerberos accounts with pre-auth disabled) |
18400 | Open Document Format (ODF) | LibreOffice/OpenOffice passwords |
22000 | WPA-PBKDF2-PMKID+EAPOL | WiFi WPA/WPA2 handshake captures |
22001 | WPA-PMK-PMKID | WiFi PMKID attack (no clients needed) |
Hash Extraction - Getting Hashes Into Hashcat
Windows SAM + SYSTEM Dump
bash
# On target (needs admin/root):
# Method 1: reg save
reg save HKLM\SAM sam.hiv
reg save HKLM\SYSTEM sys.hiv
# Method 2: secretsdump (Impacket) — remote, needs credentials
secretsdump.py DOMAIN/user:pass@10.10.10.10
# Extract for hashcat:
secretsdump.py -sam sam.hiv -system sys.hiv LOCAL > hashes.txt
# Format: username:rid:LM:NT::::
# Hashcat wants the NTLM portion (the 4th field)
# Clean for hashcat:
cat hashes.txt | cut -d: -f4 | grep -v '^\$' | grep -v 'aad3b' > ntlm_hashes.txt
# Or just use the full secretsdump output — hashcat auto-detects the NTLM hashLinux /etc/shadow
bash
# Combine passwd and shadow:
unshadow /etc/passwd /etc/shadow > unshadowed.txt
# Hash mode depends on the prefix:
# $1$ → MD5crypt → mode 500
# $5$ → SHA256crypt → mode 7400
# $6$ → SHA512crypt → mode 1800
# $y$ → yescrypt → mode (use -m 16900 for some; check hashcat --help)Kerberoasting
bash
# Impacket GetUserSPNs:
GetUserSPNs.py DOMAIN/user:pass -request -outputfile kerberoast.txt
# The output format includes $krb5tgs$23$* — hashcat mode:
hashcat -m 13100 kerberoast.txt wordlist.txtAS-REP Roasting
bash
GetNPUsers.py DOMAIN/ -usersfile users.txt -format hashcat -outputfile asrep.txt
hashcat -m 18200 asrep.txt wordlist.txtWiFi WPA2 Handshake
bash
# Capture:
hcxdumptool -i wlan0 -o capture.pcap --enable_status=1
# Or: airodump-ng + aircrack-ng suite
# Convert to hashcat format:
hcxpcapngtool -o wpa.22000 capture.pcap
# Crack:
hashcat -m 22000 wpa.22000 wordlist.txtResponder Captures (NetNTLMv2)
bash
# Responder logs go to /usr/share/responder/logs/
# The format in the log files is already hashcat-compatible:
# user::domain:challenge:HMAC-MD5:blob
hashcat -m 5600 responder_hashes.txt wordlist.txtRules - The Real Power Of Dictionary Attacks
Rules transform dictionary words into candidates. Instead of just trying password, a rule can generate Password1!, p@ssw0rd, PASSWORD, password2024, and hundreds of other variants per word — all on the GPU.
A rule file is a text file where each line is a transformation instruction:
bash
hashcat -a 0 -m 1000 hashes.txt wordlist.txt -r /usr/share/hashcat/rules/best64.ruleRule Syntax Quick Reference
Rule | Action | Example |
: | Do nothing (try word as-is) | password → password |
l | Lowercase all | PassWord → password |
u | Uppercase all | PassWord → PASSWORD |
c | Capitalize first letter, lowercase rest | passWORD → Password |
C | Capitalize first letter, leave rest | passWORD → PassWORD |
t | Toggle case (invert) | PassWord → pASSwORD |
r | Reverse string | drowssap → password |
d | Duplicate word | pass → passpass |
f | Reflect (append reversed) | pass → passssap |
$X | Append character X | pass$1 → pass1 |
^X | Prepend character X | ^1pass → 1pass |
[ | Delete first character | password → assword |
] | Delete last character | password → passwor |
Dn | Delete character at position n | D3 → pasword (from password) |
sXY | Substitute X with Y | sso$$ → pa$$word |
@X | Purge all instances of X | @a → pssword (from password) |
Tn | Toggle case at position n | T0 → Password |
pN | Repeats character N times | p2 → tries pp |
ON | Omit(delete) N chars starting from position 0 | O12 → delete first 12 chars |
iNX | Insert X at position N | i4! → pass!word |
oNX | Overwrite position N with X | o4! → pass!ord |
'N | Truncate at length N | '4 → pass |
Multi-Rule Lines
Rules execute left to right:
$1$2$3 → Append 1, then 2, then 3 → password123
so0 so1 so2 → Substitutions: o→0, o→1, o→2 → passw0rd passw1rd passw2rd
c$! → Capitalize, then append ! → Password!Shipping Rule Sets
Hashcat ships with quality rule files. Here's what they do and when to use them:
Rule File | Candidates Generated Per Word | Use Case |
best64.rule | Up to 64 | First pass — highest hit rate per GPU cycle. Most efficient. |
d3ad0ne.rule | ~34,000 | Aggressive mutation — leetspeak, years, common append. Good second pass. |
dive.rule | ~100,000 | Very aggressive — includes keyboard walks and complex mutations. |
OneRuleToRuleThemAll.rule | ~55,000 | Community gold standard — highest unique crack rate in benchmarks. Download separately. |
rockyou-30000.rule | ~30,000 | Generated from statistical analysis of the rockyou breach — rules that humans actually use. |
T0XlC.rule | ~26,000 | Focused on complexity requirements — uppercase + digit + special at same time. |
generated2.rule | ~65,000 | Randomly generated rules — catches unpredictable mutations. |
Rule Stacking Strategy
Pass 1: best64.rule → Catch the low-hanging fruit (seconds)
Pass 2: rockyou-30000.rule → Catch human-realistic mutations (minutes)
Pass 3: OneRuleToRuleThemAll → Comprehensive sweep (hours)
Pass 4: generated2.rule → Random coverage (hours)Most passwords crack in passes 1–2. By pass 3, you're scraping the bottom.
Mask Attack Strategy - Intelligent Brute-Force
Blind brute-force is wasteful. The mask attack shines when you know the target's password policy.
Policy-Driven Mask Attack
If the policy is "8+ characters, must have uppercase + lowercase + digit":
# The most common pattern for this policy: Capital letter, 5-6 lowercase, 2-3 digits
hashcat -a 3 -m 1000 hashes.txt ?u?l?l?l?l?l?d?d
hashcat -a 3 -m 1000 hashes.txt ?u?l?l?l?l?l?l?d
hashcat -a 3 -m 1000 hashes.txt ?u?l?l?l?l?l?d?d?d
hashcat -a 3 -m 1000 hashes.txt ?u?l?l?l?l?l?l?d?dPACK (Password Analysis and Cracking Kit)
PACK analyzes cracked passwords to generate optimal masks for the remaining uncracked ones:
bash
# Generate statistics from already-cracked passwords:
python2 statsgen.py cracked_passwords.txt
# Generate optimized masks:
python2 maskgen.py --optindex cracked_stats.txtThe output ranks masks by probability. Feed the top masks to hashcat:
bash
hashcat -a 3 -m 1000 --increment --increment-min=6 --increment-max=12 hashes.txt masks.hcmaskOptimizations - Getting Maximum Speed
Hashcat Workload Profiles
-w 1 → Low (usable while doing other work on the machine)
-w 2 → Default
-w 3 → High (dedicated cracking machine)
-w 4 → Insane (maximum power, possible thermal throttling, display may freeze)Kernel Tuning
bash
# -O flag: Optimized kernel — 2-10x faster but limits password length to 31 chars
hashcat -O -a 0 -m 1000 hashes.txt wordlist.txt
# -w 3 combined with -O:
hashcat -O -w 3 -a 0 -m 1000 hashes.txt wordlist.txt -r best64.ruleThe -O flag is almost always worth it. Very few real-world passwords exceed 31 characters.
Temperature Management
bash
# Monitor GPU temperature and fan speed
nvidia-smi -l 1
watch -n 1 nvidia-smi
# Set fan speed manually (NVIDIA):
nvidia-settings -a "[gpu:0]/GPUFanControlState=1" -a "[fan:0]/GPUTargetFanSpeed=80"
# If temperatures exceed 85°C, reduce workload or add coolingPause and Resume
bash
# Graceful pause — saves state and exits:
# Press 'p' during cracking, then wait for "Checkpoint" message
# Resume from checkpoint:
hashcat --restore
# Or specify session name for multiple jobs:
hashcat --session audit1 -a 0 -m 1000 hashes.txt wordlist.txt
hashcat --restore --session audit1Potfile Management
The potfile stores cracked passwords. Hashcat checks it before processing — if a hash is already cracked, it's skipped:
bash
# Show currently cracked passwords:
hashcat --show -m 1000 hashes.txt
# Remove a cracked hash from the potfile (to re-crack it):
# Edit ~/.local/share/hashcat/hashcat.potfile
# Use a custom potfile for different engagements:
hashcat --potfile-path engagement1.pot -a 0 -m 1000 hashes.txt wordlist.txtPractical Engagement Workflow
Phase 1: Pre-Cracking — Hash Extraction and Normalization
bash
# 1. Extract hashes from target
secretsdump.py DOMAIN/admin:pass@dc01.domain.local > all_hashes.txt
# 2. Parse and normalize
cat all_hashes.txt | grep ':::' | cut -d: -f1,4 > ntlm_hashes.txt
# Format: username:NTHASH
# 3. Count and catalog
wc -l ntlm_hashes.txt
# "847 user accounts with NTLM hashes"
# 4. Check for empty/well-known hashes (disabled accounts, machine accounts ending in $)
grep '31d6cfe0d16ae931b73c59d7e0c089c0' ntlm_hashes.txt # Empty password
grep 'aad3b435b51404eeaad3b435b51404ee' ntlm_hashes.txt # LM empty (often = blank)Phase 2: Target Analysis
Before firing hashcat, look at what you've got:
How many hashes? 50 is a quick job. 5000 is a multi-day affair.
What hash type? NTLM (mode 1000) is fast. bcrypt (mode 3200) is slow. You'll crack 90% of NTLM hashes in hours; you'll crack 15% of bcrypt hashes in days.
Is there a password complexity policy? If so, mask attacks become viable. If not, dictionary attacks dominate.
Are there service accounts? Their passwords are often longer but use predictable patterns (company name + year + symbol).
Phase 3: Cracking Sequence
bash
# ---- Pass 1: RockYou straight (30 seconds) ----
hashcat -O -w 3 -a 0 -m 1000 hashes.txt /usr/share/wordlists/rockyou.txt
# ---- Pass 2: RockYou + best64 rules (2 minutes) ----
hashcat -O -w 3 -a 0 -m 1000 hashes.txt /usr/share/wordlists/rockyou.txt -r best64.rule
# ---- Pass 3: Large wordlist + best64 (30-60 minutes) ----
hashcat -O -w 3 -a 0 -m 1000 hashes.txt /path/to/hashesorg2019.txt -r best64.rule
# ---- Pass 4: Large wordlist + OneRuleToRuleThemAll (4-8 hours) ----
hashcat -O -w 3 -a 0 -m 1000 hashes.txt /path/to/hashesorg2019.txt -r OneRuleToRuleThemAll.rule
# ---- Pass 5: NetNTLMv2 (Kerberoasted) with targeted wordlist ----
hashcat -O -w 3 -a 0 -m 13100 kerberoast.txt company_wordlist.txt -r best64.rule
# ---- Pass 6: Mask attack for remaining (run overnight) ----
# If 50% remain and policy is 8+ chars with complexity:
hashcat -O -w 3 -a 3 -m 1000 hashes.txt -i --increment-min=8 --increment-max=10 ?u?l?l?l?l?l?d?d
hashcat -O -w 3 -a 3 -m 1000 hashes.txt -i --increment-min=8 --increment-max=10 ?u?l?l?l?l?l?l?dPhase 4: Result Analysis
bash
# Show all cracked passwords with usernames:
hashcat --show -m 1000 --username hashes.txt
# Output to file:
hashcat --show -m 1000 --username -o cracked.txt hashes.txt
# Analyze patterns:
cat cracked.txt | cut -d: -f2 | sort | uniq -c | sort -rn | head -20
# Shows the 20 most common passwords
# Check length distribution:
cat cracked.txt | cut -d: -f2 | awk '{print length}' | sort -n | uniq -c
# Check character composition:
cat cracked.txt | cut -d: -f2 | grep -c '[A-Z]' # How many contain uppercase
cat cracked.txt | cut -d: -f2 | grep -c '[0-9]' # How many contain digits
cat cracked.txt | cut -d: -f2 | grep -c '[!@#$%]' # How many contain specials
# Identify service accounts with weak passwords:
cat cracked.txt | grep '\$'Phase 5: Reporting
For the pentest report:
Raw numbers: "Cracked 412 of 847 (48.6%) NTLM hashes in 6.3 GPU-hours on a single RTX 4090."
Policy analysis: "The password policy requires 8+ characters with 3 of 4 character classes, yet 67% of cracked passwords were exactly 8 characters ending in ! or 1."
Top patterns: The 20 most common passwords, frequency distribution, character composition stats.
Service accounts: Any service accounts with crackable passwords are HIGH findings.
Credential reuse: If the same password appears across multiple accounts, note the lateral movement risk.
Remediation: Recommend increasing minimum length to 12+, implementing banned-password lists, deploying MFA for service accounts, and auditing against HaveIBeenPwned's NTLM corpus.
Hardware Reference - What To Expect
GPU | NTLM (mode 1000) | NetNTLMv2 (mode 5600) | WPA2 (mode 22000) | bcrypt (mode 3200) |
RTX 4090 | ~320 GH/s | ~75 GH/s | ~2,800 kH/s | ~220 kH/s |
RTX 4080 | ~240 GH/s | ~55 GH/s | ~2,100 kH/s | ~165 kH/s |
RTX 3090 | ~150 GH/s | ~35 GH/s | ~1,100 kH/s | ~110 kH/s |
RTX 3080 | ~100 GH/s | ~23 GH/s | ~820 kH/s | ~75 kH/s |
RX 7900 XTX | ~130 GH/s | ~28 GH/s | ~950 kH/s | ~90 kH/s |
Apple M2 Ultra | ~24 GH/s | ~5 GH/s | ~210 kH/s | ~18 kH/s |
CPU (32-core EPYC) | ~2.5 GH/s | ~600 MH/s | ~25 kH/s | ~2 kH/s |
GH/s = billions of hashes per second. kH/s = thousands. For NTLM, a single 4090 tries 320 billion passwords per second. For bcrypt (deliberately slow by design, with an adjustable work factor), that drops to 220 thousand per second — over a million times slower. This is why bcrypt is recommended for web applications and why cracking bcrypt at scale requires either massive hardware or exceptional wordlist quality.
Advanced Techniques
Slow Hash Strategy (bcrypt, WPA2, VeraCrypt)
For slow hashes where brute-force is infeasible:
Perfect your wordlist. Use target-specific words: company name, local sports teams, internal project names, usernames themselves as passwords
Aggressive rule chaining: best64.rule first, then walk away for days with a massive rule set
Celebrity breaches: If the target's users have been in known breaches, their old passwords are the highest-probability candidates for their current hash
Use PrinceProcessor (PP) for combinatorially generated candidates with probability sorting
PrinceProcessor (PRobability INfinite Chained Elements)
PrinceProcessor generates candidates by chaining together fragments from a wordlist, sorted by probability. It's more efficient than combinator attacks because candidates are ordered by likelihood:
bash
# Generate Prince candidates, pipe to hashcat:
pp64 wordlist.txt | hashcat -a 0 -m 3200 bcrypt_hashes.txt
# Or with rules:
pp64 wordlist.txt | hashcat -a 0 -m 3200 bcrypt_hashes.txt -r best64.ruleCombinator with Rules
Stack combinator attack output through rules:
bash
# Generate combinator, apply rules:
hashcat -a 1 --stdout words1.txt words2.txt | hashcat -a 0 -m 1000 hashes.txt -r best64.ruleToggle-Case Precomputed Candidates
For passwords known to be all-uppercase or mixed-case, pre-generate case variations:
bash
# mp64 generates mask-based candidates to stdout:
mp64 ?l?l?l?l?l?l?l?l | hashcat -a 0 -m 0 hashes.txtCustom Charset from Cracked Passwords
Analyze already-cracked passwords to derive the actual character set in use:
bash
cat cracked.txt | cut -d: -f2 | grep -o . | sort -u | tr -d '\n'
# Output: !$0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ_acdefhijklmnoprstuvwxy
# Use this as --custom-charset for mask attacks — it's much narrower than full ?aLegal & Operational Boundaries
During authorized pentesting, hashcat is used to demonstrate password policy weaknesses. The ROE should explicitly authorize password cracking. Hash extraction from live systems requires caution — extracting LSASS memory on a production domain controller can cause stability issues. Always coordinate.
What you should demonstrate:
"Your password policy requires 8+ characters with 3/4 complexity, yet I cracked 48% of hashes in under 7 GPU-hours."
"Sixteen domain admin accounts use the same password pattern: SeasonYear!."
What you should never do:
Crack hashes from out-of-scope systems
Exfiltrate the full hash file off the client's network (crack on a machine they provide, or seek explicit permission to take hashes off-site)
Store cracked passwords beyond the engagement window
Use cracked passwords to access systems outside scope
Comments