So atom, main developer of @hashcat , used the "rapid prototyping in Python" plugin of the new "assimilation bridge" in the new hashcat 7, with some success in our DEF CON password CTF win this past weekend (hosted by @jabbercracky).

Afterwards, atom realized it would make a good case study for how to use the new feature, so he wrote it up:

https://hashcat.net/forum/thread-13346.html

If you do exploration of mystery hash types (either for CTFs, or in the real world) ... this approach should absolutely be in your toolbox.

#PasswordCracking #HashCracking
#hashcat #hashcat7

July 15th 1991: 34 years ago I published the first “modern” password cracker…
https://alecmuffett.com/article/113704
#ComputerHistory #PasswordCracking #crack

The monthly casual event for July will start this Friday!

1 hash list will be created with 250k hashes based on a hidden theme. The competition portion will last 7 days and the write-up will be prepared and released shortly after.

16 Billion Passwords Stolen From 320 Million+ Computers Leaked Online https://gbhackers.com/16-billion-passwords-stolen-from-320-million-computers-leaked-online/ #CyberSecurityNews #PasswordCracking #cybersecurity #FACEBOOK #Google #Apple

Well, this cracking attack is going to take 5.5 days on 2x 4090s.

Top #hashcat tip:

Want per-position duplication in your rules to leverage your GPU?

It's not available in a single op, but you can emulate it by incrementally duplicating the first N chars, and then incrementally deleting the position and frequency of the redundant characters

If you need to sort and dedupe a ton of strings/records, Cynosure Prime member blazer has released rlite, a 'lite' version of rling. I helped debug early versions. A nice balance of performant and simple, but with useful knobs like frequency counting, writing dupes to another file, etc.

(And heavy on the 'performant' - multi-threaded sort + dedupe time for 1.4B records in a 16GB file is 45 seconds on 48 EPYC 7642 cores, and uses 26GB of RAM)

https://github.com/Cynosureprime/rlite

Next time password cracking comes up conversationally and someone says "And can't you can just use rainbow tables" ... send them this.

https://hashcat.net/faq/rainbowtables

tl;dr They are only worthwhile in a very specific (and rare) set of circumstances.

Team #Hashcat is pleased to present our much anticipated write-up for this year's #CrackMeIfYouCan contest at #Defcon32

Read it here:
https://raw.githubusercontent.com/hashcat/team-hashcat/8a72d338660cc6d8f4f8014bd8e3236f8c59cd6e/CMIYC2024/CMIYC2024TeamHashcatWriteup.pdf

No, NCSC, passprhases of only three (or even four) random words is not sufficient - unless the user knows that the password hashing method is a "slow" (bad for the attacker). Which is rarely guaranteed.