PE-HAS
hashcat
GPU-accelerated cracker for auditing the strength of password hashes recovered during an engagement.
OVERVIEW
hashcat (hashcat.net, github.com/hashcat/hashcat) is the standard open-source password-hash cracker: it loads recovered hashes (NTLM, NetNTLMv2, bcrypt, Kerberos tickets, and hundreds of other formats) and tests candidate passwords against them at high speed using the GPU rather than the CPU, exploiting hardware built for parallel computation to try billions of guesses per second on weaker hash types.
Beyond straight wordlist attacks, it supports rule-based mutation (appending digits, leetspeak substitutions, case changes), combinator and mask attacks for structured guessing, and hybrid modes that combine a wordlist with a brute-force mask — letting an operator target likely human password patterns instead of pure brute force, which is what makes it practical against anything but the weakest hashing algorithms.
USE CASES
Practical use cases
- 01
Cracking NTLM or NetNTLMv2 hashes recovered via secretsdump or Responder to recover plaintext passwords.
- 02
Auditing password policy strength by measuring how quickly a representative hash set falls to common wordlists.
- 03
Cracking hashed credentials found in leaked databases, config files, or memory dumps during an engagement.
- 04
Running rule-based or mask attacks to test whether a client's password patterns resist targeted guessing.
QUICK START
Once password hashes have been recovered (via secretsdump, Responder, or similar), to test offline whether they crack against wordlists and rules.
- Confirm that cracking the specific hashes in hand, and keeping any recovered plaintexts, is covered by the engagement scope and data-handling rules.
- Install hashcat (or a driver-ready environment with a capable GPU) and identify the correct hash mode (-m) for the format recovered.
- Run a first pass against a common wordlist (e.g. rockyou.txt) before layering on rules or masks.
- Review cracked passwords, note any weak patterns for the report, and dispose of the plaintext output per the engagement's data-handling rules.
hashcat -m 1000 -a 0 hashes.txt rockyou.txtBEFORE YOU RUN IT
What to check before running it
Cracking speed and coverage depend entirely on the GPU and wordlist/rules used — document which wordlist, rule set, and time budget were used so the report's 'password X was weak' claim is reproducible.
Recovered plaintext passwords are as sensitive as the original credentials — store, transmit, and delete them per the engagement's data-handling rules, not in a plain report attachment.
A hash that doesn't crack in the time available is not proof the password is strong — say so explicitly rather than implying a clean scan.