We don't normally crack hashes for proof-of-concept, it's not usually that hard to convince a client about the perils of insecure password storage (although I g

We don't normally crack hashes for proof-of-concept, it's not usually that hard to convince a client about the perils of insecure password storage (although I guess ocassionally you might need to give them a concrete example). Generally, we crack passwords to be able to try those credentials on more secured systems (thanks to the ubiquity of password reuse). As to why so many, When doing network tests, there's some percentage of time when you manage to obtain a hash (it might be a small percent), but when you multiply that by the number of tests going on in a given week, it seems to have worked out that folks are lining up to use it.