pinkpixel-dev/performing-hash-cracking-with-hashcat
SKILLS/performing-hash-cracking-with-hashcat/SKILL.md
Hash cracking is an essential skill for penetration testers and security auditors to evaluate password strength. Hashcat is the world's fastest password recovery tool, supporting over 300 hash types w
$ install --global
skillsauthnpx skillsauth add pinkpixel-dev/skills-collection-2 performing-hash-cracking-with-hashcatInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
Security Scan Results
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
3
Scanners Passed
9
Scanners in report
Clean
TrivyContainer and dependency vulnerability scanner
95%
Clean
SemgrepStatic code analysis for vulnerabilities
95%
Clean
mcp-scan (Snyk)Model Context Protocol security validation
95%
Skipped
Snyk (dep)Open source security scanning
50%
Skipped
Socket.devSupply chain security analysis
50%
Skipped
VirusTotalMulti-engine malware detection
50%
Skipped
CrowdStrikeAdvanced threat intelligence
50%
Skipped
OSV-ScannerOpen Source Vulnerability database check
50%
Skipped
OWASP Dep-Check
50%
Last scanned: Aug 9, 2026, 3:10 AM154.1s7 files scanned
SKILL.md
- name:
- performing-hash-cracking-with-hashcat
- description:
- Hash cracking is an essential skill for penetration testers and security auditors to evaluate password strength. Hashcat is the world's fastest password recovery tool, supporting over 300 hash types w
- domain:
- cybersecurity
- subdomain:
- cryptography
- tags:
- [cryptography, hash-cracking, password-security, hashcat, penetration-testing]
- version:
- 1.0
- author:
- mahipal
- license:
- Apache-2.0
Performing Hash Cracking with Hashcat
Overview
Hash cracking is an essential skill for penetration testers and security auditors to evaluate password strength. Hashcat is the world's fastest password recovery tool, supporting over 300 hash types with GPU acceleration. This skill covers using hashcat for authorized password auditing, understanding attack modes, creating effective rule sets, and generating hash analysis reports. This is strictly for authorized penetration testing and password policy assessment.
When to Use
- When conducting security assessments that involve performing hash cracking with hashcat
- When following incident response procedures for related security events
- When performing scheduled security testing or auditing activities
- When validating security controls through hands-on testing
Prerequisites
- Familiarity with cryptography concepts and tools
- Access to a test or lab environment for safe execution
- Python 3.8+ with required dependencies installed
- Appropriate authorization for any testing activities
Objectives
- Identify hash types from captured hashes
- Execute dictionary, brute-force, and rule-based attacks
- Create custom hashcat rules for targeted cracking
- Analyze password strength from cracking results
- Generate compliance reports on password policy effectiveness
- Benchmark GPU performance for hash cracking
Key Concepts
Hashcat Attack Modes
| Mode | Flag | Description | Use Case | |------|------|-------------|----------| | Dictionary | -a 0 | Wordlist attack | Known password patterns | | Combination | -a 1 | Combine two wordlists | Compound passwords | | Brute-force | -a 3 | Mask-based enumeration | Short passwords | | Rule-based | -a 0 -r | Dictionary + transformation rules | Complex variations | | Hybrid | -a 6/7 | Wordlist + mask | Passwords with appended numbers |
Common Hash Types
| Hash Mode | Type | Example Use | |-----------|------|-------------| | 0 | MD5 | Legacy web apps | | 100 | SHA-1 | Legacy systems | | 1000 | NTLM | Windows credentials | | 1800 | sha512crypt | Linux /etc/shadow | | 3200 | bcrypt | Modern web apps | | 13100 | Kerberos TGS-REP | Active Directory |
Security Considerations
- Only perform hash cracking with explicit written authorization
- Secure all captured hash data in transit and at rest
- Report all cracked passwords immediately to asset owners
- Use results to improve password policies, not exploit users
- Destroy cracked password data after engagement concludes
- Follow rules of engagement for penetration test scope
Validation Criteria
- [ ] Hash type identification is correct
- [ ] Dictionary attack cracks weak passwords
- [ ] Rule-based attack cracks policy-compliant passwords
- [ ] Mask attack cracks short passwords
- [ ] Results report shows password strength distribution
- [ ] All operations performed within authorized scope
Related Skills
pinkpixel-dev/performing-lateral-movement-with-wmiexec
tools
VerifiedTrustedCommunity
Perform lateral movement across Windows networks using WMI-based remote execution techniques including Impacket wmiexec.py, CrackMapExec, and native WMI commands for stealthy post-exploitation during red team engagements.
1SKILL.mdUpdated Aug 9, 2026
pinkpixel-dev/performing-lateral-movement-detection
data-ai
VerifiedTrustedCommunity
Detects lateral movement techniques including Pass-the-Hash, PsExec, WMI execution, RDP pivoting, and SMB-based spreading using SIEM correlation of Windows event logs, network flow data, and endpoint telemetry mapped to MITRE ATT&CK Lateral Movement (TA0008) techniques.
1SKILL.mdUpdated Aug 9, 2026
pinkpixel-dev/performing-kubernetes-penetration-testing
tools
VerifiedTrustedCommunity
Kubernetes penetration testing systematically evaluates cluster security by simulating attacker techniques against the API server, kubelet, etcd, pods, RBAC, network policies, and secrets. Using tools
1SKILL.mdUpdated Aug 9, 2026
pinkpixel-dev/performing-kubernetes-etcd-security-assessment
testing
VerifiedTrustedCommunity
Assess the security posture of Kubernetes etcd clusters by evaluating encryption at rest, TLS configuration, access controls, backup encryption, and network isolation.
1SKILL.mdUpdated Aug 9, 2026