Passwords
hashcat
GPU password recovery against hashes obtained under RoE, run only in the engagement vault.
What it is
hashcat is for offline recovery of hashes you already obtained through an authorized path (Kerberoast, dump of a test account, password-store extract). It is not a network attack. Wordlists and rules should be engagement-local; recovered secrets stay in the vault and go into the report as evidence of weakness, not as a loot pile.
Reach for it when
After an authorized hash collection (Kerberoast, test-DB extract, password store) when the RoE allows offline cracking.
Watch-outs
Never move production hashes to a personal GPU box or a cloud instance the client has not approved — that is data exfil. Do not attempt to crack MFA seeds or payment-card data. Wipe vault jobs at close. Report entropy and time-to-crack, not the password itself, unless the client asks.
Typical invocation
hashcat -O -a 0 hashes.txt wordlists/corp.txt
Authorized assessments only. Stay inside the rules of engagement.
Pin to a kit
Open an engagement first.
Related
- John the Ripper
CPU-oriented password recovery and format conversion for hashes collected under RoE.
- Responder
LLMNR/NBT-NS/mDNS analysis and poisoning for authorized internal identity assessments.
- Impacket
Python collection of Windows/AD protocol tools for authorized authentication and post-ex proof.