cracking-passwords

Identify hash types and crack password hashes with hashcat or John the Ripper.

109|11|Updated Nov 13, 2025

Search Tags:#pass-the-hash #hashcat #john-the-ripper #password-cracking #credential-attacks #password-spraying #hash-identification

Ready to run

npx skills add https://github.com/trilwu/secskills --skill cracking-passwords

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: cracking-passwords
Source: https://github.com/trilwu/secskills/tree/main/secskills/skills/password-attacks
Command: npx skills add https://github.com/trilwu/secskills --skill cracking-passwords

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Password hash cracking and credential-attack guidance for offensive security assessments, enabling you to identify hash types and crack passwords efficiently.

Core Features & Use Cases

Hash identification and mode selection with hashcat/john
End-to-end cracking workflows: dictionary attacks, rules, brute force
Pass-the-hash and credential spraying techniques with common hashes (NTLM, Kerberos) and Linux bcrypt
Use cases include red team exercises, vulnerability assessments, and security research

Quick Start

Provide a hash and I will guide you through identifying its type and cracking it with hashcat or John the Ripper.

Frequently Asked Questions about cracking-passwords

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I identify hash types and crack password hashes using hashcat or John the Ripper?▼

Identify hash types and crack password hashes by providing the hash input to receive mode selection guidance and execute dictionary attacks, rule-based mutations, or brute force strategies with hashcat or John the Ripper for efficient password recovery.

What is the best way to perform pass-the-hash and credential spraying attacks against NTLM and Kerberos?▼

Pass-the-hash and credential spraying attacks against NTLM and Kerberos apply automated authentication attempts using captured hashes, enabling lateral movement during authorized red team exercises and vulnerability assessments without plaintext passwords.

Can I use this for cracking Linux bcrypt hashes and other common credential formats?▼

Cracking Linux bcrypt hashes and other common credential formats is fully supported, applying optimized dictionary attacks and brute force strategies to recover plaintext passwords from Linux shadow files and web application databases.

Does this support rule-based mutations and dictionary attacks for complex passwords?▼

Rule-based mutations and dictionary attacks are core supported features, applying customized wordlists and mangling rules to generate complex password variations that significantly increase hash cracking success rates against targeted systems.

When should I use hashcat vs John the Ripper for password cracking workflows?▼

Hashcat leverages GPU acceleration for high-speed brute force attacks, while John the Ripper excels at CPU-based cracking with extensive format support, guiding selection based on available hardware and target hash algorithms.

What are the limitations and ethical authorization requirements for conducting credential attacks?▼

Ethical authorization requires explicit permission before conducting credential attacks, limiting hash cracking and password spraying activities strictly to approved red team exercises, vulnerability assessments, and security research contexts to ensure legal compliance.