Update render script and Makefile

This commit is contained in:
Jonas Zeunert
2024-04-22 21:54:39 +02:00
parent 2d63fe63cd
commit 4d0cd768f7
10975 changed files with 47095 additions and 4031084 deletions

View File

@@ -1,9 +1,11 @@
 Awesome Password Cracking !Awesome (https://awesome.re/badge.svg) (https://awesome.re)
 Awesome Password Cracking !Awesome (https://awesome.re/badge.svg) (https://awesome.re)
In cryptanalysis and computer security, password cracking is the process of recovering passwords from data that has been stored in or transmitted by a computer system in scrambled form. A common approach (
brute-force attack (https://en.wikipedia.org/wiki/Brute-force_attack)) is to repeatedly try guesses for the password and to check them against an available cryptographic hash of the password.
In cryptanalysis and computer security, password cracking is the process of recovering passwords from data that has been stored in or transmitted by a computer system in scrambled form. A 
common approach (brute-force attack (https://en.wikipedia.org/wiki/Brute-force_attack)) is to repeatedly try guesses for the password and to check them against an available cryptographic hash
of the password.
This is a curated list of awesome tools, research, papers and other projects related to password cracking and password security by @n0kovo@infosec.exchange (https://infosec.exchange/@n0kovo/?l).
This is a curated list of awesome tools, research, papers and other projects related to password cracking and password security by @n0kovo@infosec.exchange 
(https://infosec.exchange/@n0kovo/?l).
Read CONTRIBUTING.md (https://github.com/narkopolo/awesome-password-cracking/blob/main/CONTRIBUTING.md) before contributing! In short:
@@ -51,8 +53,8 @@
Books
- Hash Crack: Password Cracking Manual (v3) (https://www.amazon.com/-/en/Joshua-Picolet/dp/1793458618) - Password Cracking Manual v3 is an expanded reference guide for password recovery (cracking) methods, 
tools, and analysis techniques.
- Hash Crack: Password Cracking Manual (v3) (https://www.amazon.com/-/en/Joshua-Picolet/dp/1793458618) - Password Cracking Manual v3 is an expanded reference guide for password recovery 
(cracking) methods, tools, and analysis techniques.
@@ -60,8 +62,8 @@
- Cloud_crack (https://github.com/lordsaibat/Cloud_crack) - Crack passwords using Terraform and AWS.
- Cloudcat (https://github.com/stormfleet/cloudcat) - A script to automate the creation of cloud infrastructure for hash cracking.
- Cloudstomp (https://github.com/Fmstrat/cloudstomp) - Automated deployment of instances on EC2 via plugin for high CPU/GPU applications at the lowest price.
- Cloudtopolis (https://github.com/JoelGMSec/Cloudtopolis) - A tool that facilitates the installation and provisioning of Hashtopolis on the Google Cloud Shell platform, quickly and completely unattended (and 
also, free!).
- Cloudtopolis (https://github.com/JoelGMSec/Cloudtopolis) - A tool that facilitates the installation and provisioning of Hashtopolis on the Google Cloud Shell platform, quickly and 
completely unattended (and also, free!).
- NPK (https://github.com/c6fc/npk) - NPK is a distributed hash-cracking platform built entirely of serverless components in AWS including Cognito, DynamoDB, and S3.
- Penglab (https://github.com/mxrch/penglab) - Abuse of Google Colab for cracking hashes.
- Rook (https://github.com/JumpsecLabs/Rook) - Automates the creation of AWS p3 instances for use in GPU-based password cracking.
@@ -77,12 +79,14 @@
- hc\_to\_7z (https://github.com/philsmd/hc_to_7z) - Convert 7-Zip hashcat hashes back to 7z archives.
- hcxtools (https://github.com/ZerBea/hcxtools) - Portable solution for conversion of cap/pcap/pcapng (gz compressed) WiFi dump files to hashcat formats.
- itunes_backup2hashcat (https://github.com/philsmd/itunes_backup2hashcat) - Extract the information needed from the Manifest.plist files to convert it to hashes compatible with hashcat. 
- mongodb2hashcat (https://github.com/philsmd/mongodb2hashcat) - Extract hashes from the MongoDB database server to a hash format that hashcat accepts: -m 24100 (SCRAM-SHA-1) or -m 24200 (SCRAM-SHA-256).
- mongodb2hashcat (https://github.com/philsmd/mongodb2hashcat) - Extract hashes from the MongoDB database server to a hash format that hashcat accepts: -m 24100 (SCRAM-SHA-1) or -m 24200 
(SCRAM-SHA-256).
Hashcat
Hashcat (https://github.com/hashcat/hashcat) is the "World's fastest and most advanced password recovery utility." The following are projects directly related to Hashcat in one way or another.
Hashcat
 (https://github.com/hashcat/hashcat) is the "World's fastest and most advanced password recovery utility." The following are projects directly related to Hashcat in one way or another.
- Autocrack (https://github.com/pry0cc/autocrack) - A set of client and server tools for automatically, and lightly automatically cracking hashes.
- docker-hashcat (https://github.com/dizcza/docker-hashcat) - Latest hashcat docker for Ubuntu 18.04 CUDA, OpenCL, and POCL.
@@ -98,7 +102,8 @@
- autocrack (https://github.com/timbo05sec/autocrack) - Hashcat wrapper to help automate the cracking process.
- hat (https://github.com/sp00ks-git/hat) - An Automated Hashcat Tool for common wordlists and rules to speed up the process of cracking hashes during engagements.
- hate_crack (https://github.com/trustedsec/hate_crack) - A tool for automating cracking methodologies through Hashcat from the TrustedSec team.
- Naive hashcat (https://github.com/brannondorsey/naive-hashcat) - Naive hashcat is a plug-and-play script that is pre-configured with naive, emperically-tested, "good enough" parameters/attack types.
- Naive hashcat (https://github.com/brannondorsey/naive-hashcat) - Naive hashcat is a plug-and-play script that is pre-configured with naive, emperically-tested, "good enough" 
parameters/attack types.
Distributed cracking
- CrackLord (https://github.com/jmmcatee/cracklord) - Queue and resource system for cracking passwords.
@@ -136,8 +141,8 @@
John the Ripper
John the Ripper (https://github.com/openwall/john) is "an Open Source password security auditing and password recovery tool available for many operating systems." The following are projects directly related to 
John the Ripper in one way or another.
John the Ripper (https://github.com/openwall/john) is "an Open Source password security auditing and password recovery tool available for many operating systems." The following are projects 
directly related to John the Ripper in one way or another.
- BitCracker (https://github.com/e-ago/bitcracker) - BitCracker is the first open source password cracking tool for memory units encrypted with BitLocker.
- johnny (https://github.com/openwall/johnny) - GUI frontend to John the Ripper.
@@ -148,7 +153,8 @@
- 920mPasswordMasks (https://github.com/jakewnuk/920mPasswordMasks) - Hashcat password masks from 920 million breach passwords filtered into groups.
- hashgen (https://github.com/cyclone-github/hashgen) - Hashgen is a simple yet very fast CLI hash generator written in Go and cross compiled for Linux, Windows & Mac.
- hashID (https://github.com/psypanda/hashID) - Software to identify the different types of hashes.
- Name That Hash (https://github.com/HashPals/Name-That-Hash) - Don't know what type of hash it is? Name That Hash will name that hash type! Identify MD5, SHA256 and 300+ other hashes. Comes with a neat web app.
- Name That Hash (https://github.com/HashPals/Name-That-Hash) - Don't know what type of hash it is? Name That Hash will name that hash type! Identify MD5, SHA256 and 300+ other hashes. Comes 
with a neat web app.
Notable People
@@ -186,7 +192,8 @@
Communities
- hashcat Forum (https://hashcat.net/forum/) - Forum by the developers of hashcat.
- Hashmob (https://hashmob.net/) - A growing password recovery community aimed towards being a center point of collaboration for cryptography enthusiasts. Huge wordlist collection and a lookup service too.
- Hashmob (https://hashmob.net/) - A growing password recovery community aimed towards being a center point of collaboration for cryptography enthusiasts. Huge wordlist collection and a 
lookup service too.
- Hashkiller Forum (https://forum.hashkiller.io/) - A password cracking forum with over 20,000 registered users.
Lookup services
@@ -203,25 +210,26 @@
Tools for analyzing, generating and manipulating wordlists.
Analysis
- PACK (https://github.com/iphelix/pack) - A collection of utilities developed to aid in analysis of password lists in order to enhance password cracking through pattern detection of masks, rules, character-sets
and other password characteristics.
- password-smelter (https://github.com/TheTechromancer/password-smelter) - Ingests passwords from hashcat, etc. and outputs to HTML, Markdown, XLSX, PNG, JSON. Dark and light themes supported. Compliments 
password-stretcher.
- PACK (https://github.com/iphelix/pack) - A collection of utilities developed to aid in analysis of password lists in order to enhance password cracking through pattern detection of masks, 
rules, character-sets and other password characteristics.
- password-smelter (https://github.com/TheTechromancer/password-smelter) - Ingests passwords from hashcat, etc. and outputs to HTML, Markdown, XLSX, PNG, JSON. Dark and light themes 
supported. Compliments password-stretcher.
- password-stretcher (https://github.com/thetechromancer/password-stretcher) - Generate "disgusting quantities" of passwords from websites, files, or stdin. Compliments password-smelter.
- pcfg_cracker (https://github.com/lakiw/pcfg_cracker) - This project uses machine learning to identify password creation habits of users.
- Pipal (https://github.com/digininja/pipal) - THE password analyser.
- PwdStat (https://github.com/jakewnuk/pwdstat) - Tool for identifying systemic password usage, creating password masks, and analyzing cracked password samples with human readable statistics to help defenders.
- PwdStat (https://github.com/jakewnuk/pwdstat) - Tool for identifying systemic password usage, creating password masks, and analyzing cracked password samples with human readable statistics 
to help defenders.
- Graphcat (https://github.com/Orange-Cyberdefense/graphcat) - Generate graphs and charts based on password cracking result.
Generation/Manipulation
- accent_permutator (https://github.com/cyclone-github/accent_permutator) - A tool to transform characters from ASCII / UTF-8 to accented characters such as "o" to "ò".
- anew (https://github.com/tomnomnom/anew) - Append lines from stdin to a file, but only if they don't already appear in the file. Outputs new lines to stdout too, making it a bit like a tee -a that removes 
duplicates.
- anew (https://github.com/tomnomnom/anew) - Append lines from stdin to a file, but only if they don't already appear in the file. Outputs new lines to stdout too, making it a bit like a tee 
-a that removes duplicates.
- bopscrk (https://github.com/r3nt0n/bopscrk) - Generate smart and powerful wordlists for targeted attacks. Includes song lyrics fetching and different transforms.
- common-substr (https://github.com/sensepost/common-substr) - Simple tool to extract the most common substrings from an input text. Built for password cracking.
- Crunch (https://sourceforge.net/projects/crunch-wordlist/) - Crunch is a wordlist generator where you can specify a standard character set or a character set you specify. Crunch can generate all possible 
combinations and permutations.
- Crunch (https://sourceforge.net/projects/crunch-wordlist/) - Crunch is a wordlist generator where you can specify a standard character set or a character set you specify. Crunch can 
generate all possible combinations and permutations.
- CUPP (https://github.com/Mebus/cupp) - A tool that lets you generate wordlists by user profiling data such as birthday, nickname, address, name of a pet or relative etc.
- duplicut (https://github.com/nil0x42/duplicut) - Remove duplicates from MASSIVE wordlist, without sorting it (for dictionary-based password cracking).
- Gorilla (https://github.com/d4rckh/gorilla) - Tool for generating wordlists or extending an existing one using mutations.
@@ -232,8 +240,8 @@
- maskcat (https://github.com/jakewnuk/maskcat) - Utility tool for Hashcat Masks and Password Cracking.
- maskprocessor (https://github.com/hashcat/maskprocessor/) - High-performance word generator with a per-position configureable charset.
- maskuni (https://github.com/flbdx/maskuni) - A standalone fast word generator in the spirit of hashcat's mask generator with unicode support.
- Mentalist (https://github.com/sc0tfree/mentalist) - Mentalist is a graphical tool for custom wordlist generation. It utilizes common human paradigms for constructing passwords and can output the full wordlist 
as well as rules compatible with Hashcat and John the Ripper.
- Mentalist (https://github.com/sc0tfree/mentalist) - Mentalist is a graphical tool for custom wordlist generation. It utilizes common human paradigms for constructing passwords and can 
output the full wordlist as well as rules compatible with Hashcat and John the Ripper.
- Mode (https://github.com/JakeWnuk/mode) - A program for quickly aggregating and frequency sorting text from multiple sources and supports concurency.
- Phraser (https://github.com/Sparell/Phraser) - Phraser is a phrase generator using n-grams and Markov chains to generate phrases for passphrase cracking.
- princeprocessor (https://github.com/hashcat/princeprocessor) - Standalone password candidate generator using the PRINCE algorithm.
@@ -251,8 +259,8 @@
Wordlists
Laguage specific
- Albanian wordlist (https://github.com/its0x08/albanian-wordlist) - A mix of names, last names and some albanian literature.
- Danish Phone Wordlist Generator (https://github.com/narkopolo/danish_phone_wordlist_generator) - This tool can generate wordlists of Danish phone numbers by area and/or usage (Mobile, landline etc.) Useful for
password cracking or fuzzing Danish targets.
- Danish Phone Wordlist Generator (https://github.com/narkopolo/danish_phone_wordlist_generator) - This tool can generate wordlists of Danish phone numbers by area and/or usage (Mobile, 
landline etc.) Useful for password cracking or fuzzing Danish targets.
- Danish Wordlists (https://github.com/narkopolo/danish-wordlists) - Collection of danish wordlists for cracking danish passwords.
- French Wordlists (https://github.com/clem9669/wordlists) - This project aim to provide french word list about everything a person could use as a base password.
@@ -272,7 +280,8 @@
- pemcracker (https://github.com/bwall/pemcracker) - Tool to crack encrypted PEM files.
JKS
- JKS private key cracker (https://github.com/floyd-fuh/JKS-private-key-cracker-hashcat) - Cracking passwords of private key entries in a JKS fileCracking passwords of private key entries in a JKS file.
- JKS private key cracker (https://github.com/floyd-fuh/JKS-private-key-cracker-hashcat) - Cracking passwords of private key entries in a JKS fileCracking passwords of private key entries in 
a JKS file.
ZIP
- bkcrack (https://github.com/kimci86/bkcrack) - Crack legacy zip encryption with Biham and Kocher's known plaintext attack.
@@ -306,7 +315,8 @@
- PassGPT: Password Modeling and (Guided) Generation with LLMs (https://arxiv.org/abs/2306.01545)
Talks
- BsidesKY2023 - Leveling Up Password Attacks with Breach Data (https://github.com/JakeWnuk/Security-Conferences/blob/main/BsidesKY2023%20-%20Leveling%20Up%20Password%20Attacks%20with%20Breach%20Data.pdf)
- BsidesKY2023 - Leveling Up Password Attacks with Breach Data 
(https://github.com/JakeWnuk/Security-Conferences/blob/main/BsidesKY2023%20-%20Leveling%20Up%20Password%20Attacks%20with%20Breach%20Data.pdf)
- DEF CON Safe Mode Password Village - Getting Started with Hashcat (https://www.youtube.com/watch?v=MBTJ8f6Fsmg)
- DEF CON Safe Mode Password Village - Jeremi Gosney - Cracking at Extreme Scale (https://www.youtube.com/watch?v=4Ell1Tt23NI)
- DEF CON 28 Safe Mode Password Village 'Let's Crack RockYou Without Using rockyou txt' (https://www.youtube.com/watch?v=8FtXntEsZdU)