9 ms·
Hashcat 6.0
- mhasbini 6y agoCongrats on the release! I was following up the development progress on GitHub. I'm pretty excited about "Plugin Interface". I think we can this refactor effort as a success story: simpler code + improved performance + more testing. It's amazing that they've added this tutorial for adding new algorithm: https://github.com/hashcat/hashcat/blob/master/docs/hashcat-plugin-development-guide.md https://github.com/hashcat/hashcat/blob/master/docs/hashcat-... (previously information was scattered around PRs). Thanks atom and all the other contributors!
- jkubrynski 6y ago1800 commits since the last release - that's not the "continuous delivery" ;)
- capableweb 6y agoSmiley indicates that you're joking, but in case you're not, I don't see any commitment from their side about doing continuous delivery and it's neither the best way for ALL projects to do development. Most web startups seems to default to it these days, but that doesn't mean it's a MUST for all types of application building.
- Cthulhu_ 6y agoFor those that care, it is though - they can do their own builds off the master or develop branch. You're confusing continuous delivery with continuous deployment. Delivery is that your software CAN be deployed at any given point, which is ensured by e.g. a test suite and other checks before something is merged.
- capableweb 6y agoGrandest addition that I can see is the various WPA/WPA2 changes. Not only did it get ~13% faster with this release, but PBKDF2 and PMK support been added too. Also CUDA support is obviously a godsend from above as well. Fantastic piece of software. Authors: thank you for your hard work!
- Vadim_M 6y agoAny way to use Metal instead of OpenCL now?
- capableweb 6y agoAFAIK, the main contributors are all on linux (or alike) systems, so you're unlikely to see Metal support out-of-the-box. Although, with the new backend/plugin interface added in this release, outside contributors can it themselves if they really need it.
- jeroenhd 6y agoWhat's the benefit of Metal in this use case? Are there any noticeable speedups in other brute forcing tools that switched to Apple's proprietary API? Given that OpenCL works on every decent modern platform and GPU brand I doubt much effort will be put into Metal unless someone familiar with the API and willing to put in the extra work joins the team of maintainers or creates a fork.
- Hamuko 6y ago>What's the benefit of Metal in this use case? Continued usage on macOS if you care about that kind of a thing since Apple has deprecated OpenCL support.
- jeroenhd 6y agoTIL. That's awful, but then again I'd expect nothing less from Apple. It's a miracle they even supported open standards in the first place. As long as Apple keeps OpenCL around, even if it's deprecated, these tools should still work. I'd expect that only the announcement of complete removal of OpenCL support would be enough to actually make hashcat put in the extra effort of writing a special Apple backend like that. Maybe they're generous or bored and do it before that, but I wouldn't expect them to in the near future.
- continuational 6y agoIt's not such a miracle - all companies like standards until they have sufficiently many apps on their platform - then they switch to proprietary to prevent app portability to competing platforms.
- Hamuko 6y agoIs there a Hashcat-as-a-Service or is everyone just renting out EC2 GPU instances by the hour?
- robert_foss 6y agohttps://gpuhash.me/ https://gpuhash.me/
- jrwr 6y agoMost hashes can be cracked with onlinehashcrack.com -- They are free if its under 8 characters and something like 5$ if its not. You can submit as many as you want and if they don't crack it. its free
- Tenoke 6y agoIs there something similar for Ethereum presale wallet hashes? I have a wallet of which I know enough of the password to reduce the space to < 10 chars that need to be guessed.
- TecoAndJix 6y agoCheck out the configuration for a masked attack [0]. You could create a custom character set with the portion that you know and then brute the rest. You could then rent a p2.16xlarge [1] from AWS at about $15 per hour. If you know how much coin is in there you can do a cost/benefit analysis. [0] https://hashcat.net/wiki/doku.php?id=mask_attack#custom_charsets https://hashcat.net/wiki/doku.php?id=mask_attack#custom_char... [1] https://aws.amazon.com/ec2/instance-types/p2/ https://aws.amazon.com/ec2/instance-types/p2/
- Tenoke 6y agoThanks! That looks fairly simple, I'll try to set it up on my machine first but even a p2 instance will be worth it in this case.
- bredren 6y ago
- j88439h84 6y agoHow many hashes per second can a high end GPU do?
- wolf550e 6y agoYou can find benchmarks on Google, e.g. https://gist.github.com/binary1985/c8153c8ec44595fdabbf03157562763e https://gist.github.com/binary1985/c8153c8ec44595fdabbf03157... 75 giga hashes per second for ntlm.
- mmm_grayons 6y agoThat's v5.0.0, so not really applicable when considering the new performance improvements in version 6 or CUDA support.
- TecoAndJix 6y agoI ran it recently on my 1080ti: Session..........: hashcat Status...........: Exhausted Hash.Type........: MS Office 2010 Hash.Target......: $office$201010000012816*[removed] Time.Started.....: Sat Apr 18 09:05:24 2020 (3 mins, 35 secs) Time.Estimated...: Sat Apr 18 09:08:59 2020 (0 secs) Guess.Base.......: File (merged.txt) Guess.Queue......: 1/1 (100.00%) Speed.#1.........: 92589 H/s (2.67ms) @ Accel:256 Loops:128 Thr:64 Vec:1 Recovered........: 0/1 (0.00%) Digests, 0/1 (0.00%) Salts Progress.........: 19922208/19922208 (100.00%) Rejected.........: 0/19922208 (0.00%) Restore.Point....: 19922208/19922208 (100.00%) Restore.Sub.#1...: Salt:0 Amplifier:0-1 Iteration:99968-100000 Candidates.#1....: Hardware.Mon.#1..: Temp: 74c Fan: 55% Util: 89% Core:1949MHz Mem:5508MHz Bus:8 Started: Sat Apr 18 09:05:07 2020 Stopped: Sat Apr 18 09:09:00 2020
- jonluca 6y agoIs that saying ~92k hashes per second? What's the MS Office 2010 hash type?
- TecoAndJix 6y agoI think that is what it is saying! The hash type is AES-128 with SHA-1 hash stretching x100,000[0][1]. The Office 2010 hashmode is 9200[2]. At work, someone of importance wanted access to a password protected file from an employee that left. I ran it through several wordlists to demonstrate an attempt was made and shared the cost/time required for 100% recovery. Never solved it and the cost/time analysis was enough to make them say oh well! [0] https://en.m.wikipedia.org/wiki/Microsoft_Office_password_protection https://en.m.wikipedia.org/wiki/Microsoft_Office_password_pr... [1] https://en.m.wikipedia.org/wiki/Key_stretching https://en.m.wikipedia.org/wiki/Key_stretching [2] https://hashcat.net/wiki/doku.php?id=example_hashes https://hashcat.net/wiki/doku.php?id=example_hashes
- sam_goody 6y agoThat's ~5 commits a DAY on average since the last release a year ago, primarily from 29 contributors. That is a rate of development that bests most paid teams that I know of. I am very impressed. How do you manage so much commitment for an open source project?
- spiderfarmer 6y agoNon ethical hackers can get paid non ethically.
- ccmcarey 6y agoMaybe don't make unsubstantiated claims without evidence.
- 867-5309 6y agoit may be suggestive, but it's still a fact
- _tk_ 6y agoHow can something be 'suggestive' and 'a fact' at the same time?
- wongarsu 6y agoBy being true, and suggesting something else. Obviously non ethical hackers can get paid non ethically. Anyone can get paid non-ethically after all. It's a fact that's so trivial it's useless if you just take it for its factual content. What makes it interesting is the implication that people use hashcat for unethical (and/or illegal) activities and use the proceeds from that to pay for their time improving hashcat. The comment doesn't state that, but it's what we are all thinking when reading it.
- s0ss 6y agoProve it
- SloopJon 6y agoHashcat has long been a user of OpenCL. I wondered whether that was because CUDA really wasn't much better for this application, but this release puts that to rest: > One of the biggest advantages of CUDA compared to OpenCL is the full use of shared memory ... This and other optimizations are the reason we improved the performance of bcrypt by 46.90%. Also interesting that they specifically call out CUDA on ARM devices like the Jetson Nano and Xavier. I suspect that the GPU in the Nano is better than the MX150 in my laptop.
- penagwin 6y agoNot a hash at dev, but my understanding is that historically, AMD has had "more raw power" GPUS then Nvidia - but has historically suffered worse driver and game implementations. This is even though the 1000x series by Nvidia, AMD cards were usually still the most used cards for crypto mining (which is basically a hash function) As CUDA only really runs on Nvidia hardware, it makes sense that they might be motivated to be as compatible as possible.
- _tk_ 6y agoAll new major features look like incredible additions, and OTOH do not seem to water down what the software is supposed to do in the first place. I can only applaud the contributors for their dedication. This really looks amazing.
- umvi 6y agoSo what's the difference between hashcat and johntheripper? Any reason to use one over the other?
- tristor 6y agoHashcat has massively better scalability and support for GPU acceleration
- SloopJon 6y agoI had to check to see whether John the Ripper is still maintained. As a matter of fact, 1.9.0 was released last year, four years after 1.8.0: https://www.openwall.com/lists/announce/2019/05/14/1 https://www.openwall.com/lists/announce/2019/05/14/1 The release notes mention that CUDA support was dropped, but that 88 formats out of 407 have OpenCL support. A few formats also have support for the ZTEX 1.15y, a now-discontinued FPGA-based board popular for crypto mining, which is something I don't think Hashcat has. Here's an article I found on that topic: https://medium.com/@ScatteredSecrets/bcrypt-password-cracking-extremely-slow-not-if-you-are-using-hundreds-of-fpgas-7ae42e3272f6 https://medium.com/@ScatteredSecrets/bcrypt-password-crackin... Edit: the two HN submissions for JtR 1.9.0 got no comments, but this Slashdot post does have some comments from a maintainer: https://it.slashdot.org/story/19/05/18/1841245/new-john-the-ripper-cracks-passwords-on-fpgas https://it.slashdot.org/story/19/05/18/1841245/new-john-the-...
- gen3 6y agoI’ve used johntheripper for wordlists and hashcat for brute-forcing, but the ethos might have changed.
- Bnshsysjab 6y agoHashcat supports wordlists with large rule sets, search ‘best64 ruleset’ for instance
- gen3 6y agoAwesome, thank you!
- deleted 6y ago[deleted]
- paulpauper 6y agothis is why you should use scrypt vs bcrypt or some other memory intensive algo to generate hashes.
- hangonhn 6y agoAnyone know why Java's object hash is even on the list given how small it is? It's not even mean to be cryptographically secure.
- mmm_grayons 6y agoBecause hashcat doesn't really reject PRs hash algorithms, at least to the extent of my knowledge, so long as the code quality is decent. Or in other words, "Why not?"