- Add validated mitre_attack frontmatter to all 754 skills (286 distinct
techniques), verified against MITRE ATT&CK v19.1 via the official
mitreattack-python library: 0 revoked, deprecated, or invalid IDs
- Curate precise per-skill technique IDs for forensics, malware-analysis,
threat-intel, and red-team skills (e.g. DCSync -> T1003.006,
Kerberoasting -> T1558.003, Pass-the-Ticket -> T1550.003)
- Reconcile v19.1 tactic restructuring: Defense Evasion split into
Stealth (TA0005) and Defense Impairment (TA0112); revoked T1562.*
family and T1070.001/.002 remapped to active equivalents (T1685.*)
- Normalize word-split tags across 35 skills (remove filename-derived
stopword tags, add semantic cybersecurity tags)
- Add api-reference.md for 3 skills that were missing it
- Update README ATT&CK section with accurate v19.1 tactic distribution
Hash cracking is an essential skill for penetration testers and security auditors to evaluate password strength. Hashcat is the world's fastest password recovery tool, supporting over 300 hash types w
cybersecurity
cryptography
cryptography
hash-cracking
password-security
hashcat
penetration-testing
1.0
mahipal
Apache-2.0
PR.DS-01
PR.DS-02
PR.DS-10
T1600
T1573
T1553
Performing Hash Cracking with Hashcat
Overview
Hash cracking is an essential skill for penetration testers and security auditors to evaluate password strength. Hashcat is the world's fastest password recovery tool, supporting over 300 hash types with GPU acceleration. This skill covers using hashcat for authorized password auditing, understanding attack modes, creating effective rule sets, and generating hash analysis reports. This is strictly for authorized penetration testing and password policy assessment.
When to Use
When conducting security assessments that involve performing hash cracking with hashcat
When following incident response procedures for related security events
When performing scheduled security testing or auditing activities
When validating security controls through hands-on testing
Prerequisites
Familiarity with cryptography concepts and tools
Access to a test or lab environment for safe execution
Python 3.8+ with required dependencies installed
Appropriate authorization for any testing activities
Objectives
Identify hash types from captured hashes
Execute dictionary, brute-force, and rule-based attacks
Create custom hashcat rules for targeted cracking
Analyze password strength from cracking results
Generate compliance reports on password policy effectiveness
Benchmark GPU performance for hash cracking
Key Concepts
Hashcat Attack Modes
Mode
Flag
Description
Use Case
Dictionary
-a 0
Wordlist attack
Known password patterns
Combination
-a 1
Combine two wordlists
Compound passwords
Brute-force
-a 3
Mask-based enumeration
Short passwords
Rule-based
-a 0 -r
Dictionary + transformation rules
Complex variations
Hybrid
-a 6/7
Wordlist + mask
Passwords with appended numbers
Common Hash Types
Hash Mode
Type
Example Use
0
MD5
Legacy web apps
100
SHA-1
Legacy systems
1000
NTLM
Windows credentials
1800
sha512crypt
Linux /etc/shadow
3200
bcrypt
Modern web apps
13100
Kerberos TGS-REP
Active Directory
Security Considerations
Only perform hash cracking with explicit written authorization
Secure all captured hash data in transit and at rest
Report all cracked passwords immediately to asset owners
Use results to improve password policies, not exploit users
Destroy cracked password data after engagement concludes
Follow rules of engagement for penetration test scope
mukul975
cb8d79e068