<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
---
name: password-cracking
description: >-
  Password cracking covering GPU-accelerated hashcat attacks, John the Ripper analysis,
  password spraying, custom wordlist generation, NTLM hash cracking, Kerberos ticket
  cracking, rainbow table attacks, password policy analysis, online brute force,
  wireless handshake cracking, memory credential extraction, and credential stuffing
  analysis. Enables authorized penetration testing and security auditing with hashcat,
  John the Ripper, Hydra, aircrack-ng, and mimikatz tooling.
domain: cybersecurity
subdomain: password-cracking
tags:
  - password-cracking
  - hashcat
  - john-the-ripper
  - password-spraying
  - wordlists
  - ntlm
  - kerberos
  - rainbow-tables
  - password-policy
  - brute-force
  - wireless
  - credential-extraction
  - credential-stuffing
  - hydra
  - mimikatz
  - aircrack-ng
version: "1.0"
author: defconxt
license: AGPL-3.0
compatibility: Designed for Claude Code, GitHub Copilot, OpenAI Codex, Cursor, Gemini CLI, and any agentskills.io-compatible agent.
metadata:
  mitre-attack: ["T1110", "T1003", "T1558", "T1201", "T1552"]
  cwe: ["CWE-916", "CWE-521", "CWE-307", "CWE-316", "CWE-798"]
  frameworks: ["MITRE ATT&CK", "CWE", "OWASP", "PTES"]
---

# Password Cracking

## When to Use

Activate when the operator asks about password cracking, hash analysis,
credential attacks, wordlist generation, brute force testing, wireless security
assessment, or credential audit in authorized engagements.

Mode: `[MODE: RED]` for offensive credential attacks; `[MODE: BLUE]` for password policy hardening; `[MODE: PURPLE]` for detection validation.

## Prerequisites

- Tools: `hashcat`, `john`, `hydra`, `aircrack-ng`, `mimikatz`, `crackmapexec`
- GPU-capable hardware for hash cracking
- Authorization and signed Rules of Engagement (RoE)
- Isolated testing environment

## Quick Reference

| Technique | Primary Tools | CWE |
|-----------|--------------|-----|
| Hashcat attacks | hashcat, hashcat-utils, statsgen | CWE-916 |
| John the Ripper | john, john-jumbo, unshadow | CWE-916 |
| Password spraying | sprayhound, crackmapexec, kerbrute | CWE-307 |
| Custom wordlists | CeWL, CUPP, Mentalist, crunch | CWE-521 |
| NTLM hashes | hashcat, secretsdump.py, mimikatz | CWE-916 |
| Kerberos tickets | hashcat, GetUserSPNs.py, Rubeus | CWE-916 |
| Rainbow tables | RainbowCrack, ophcrack, rtgen | CWE-916 |
| Password policies | crackmapexec, ldapsearch, ADRecon | CWE-521 |
| Online brute force | Hydra, Medusa, Ncrack, Patator | CWE-307 |
| Wireless handshakes | aircrack-ng, hcxpcapngtool, wifite | CWE-916 |
| Memory extraction | mimikatz, Volatility3, pypykatz | CWE-316 |
| Credential stuffing | SentryMBA, h8mail, pwndb | CWE-521 |

## Workflow

### Step 1: Acquire Hashes

```bash
# Extract from SAM/NTDS
secretsdump.py domain/user:pass@target

# Extract from memory
pypykatz lsa minidump lsass.dmp
```

### Step 2: Identify Hash Type

```bash
# hashcat hash identification
hashid -m hash_sample.txt
hashcat --identify hashfile.txt

# John format detection
john --list=formats | grep -i ntlm
```

### Step 3: Execute Cracking

```bash
# Hashcat GPU attack
hashcat -m 1000 -a 0 hashes.txt rockyou.txt -r best64.rule

# John the Ripper
john --format=NT --wordlist=rockyou.txt hashes.txt
```



## Verification

- [ ] All tools installed and operational
- [ ] Target acquired through authorized channels
- [ ] Analysis completed with findings documented
- [ ] Detection opportunities identified for blue team
- [ ] Artifacts preserved and report generated

## References

- [MITRE ATT&CK](https://attack.mitre.org/) — Adversary tactics and techniques
- [CWE](https://cwe.mitre.org/) — Common Weakness Enumeration
- [OWASP](https://owasp.org/) — Open Web Application Security Project
