[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M71CYPYH065P28ARKFMSKQEW":3,"skill-same:01M71CYPYH065P28ARKFMSKQEW":87},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":18,"publishedAt":39,"linkOnly":40,"markdownContent":41,"markdownBody":42,"frontMatter":43,"refName":60,"commitSha":61,"skillDirectory":62,"forksCount":14,"repositoryHtmlUrl":63,"repositoryHomepageUrl":6,"ownerHtmlUrl":64,"ownerBlogUrl":6,"ownerDescription":65,"updatedAt":66,"install":67,"resources":80},"01M71CYPYH065P28ARKFMSKQEW","tools-hashcat-crack-extract",null,"Hash cracking is an essential skill for penetration testers and security auditors to evaluate password strength. Hashcat is the world's fastest password recovery tool, supporting over 300 hash types w","DCx7C5\u002Fai-marketplace","DCx7C5","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42419559?v=4","01M71C01G2AZV3NTNGWAWSHJPP","DC","01M71C01GQW6G50S2BYMS7PP3E",0,"MIT","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fcrypto\u002Ftools\u002Fhashcat\u002Fcrack\u002Fextract\u002FSKILL.md",[],[19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38],"tools hashcat crack extract","hashcat","Tools","extract","crack","grep","read","evaluate","recovery","world","Bash","password","cybersecurity","testing","tool","for","types","pr","essential","penetration","2026-11-10 10:12:30",false,"---\nname: tools-hashcat-crack-extract\ndescription: Hash cracking is an essential skill for penetration testers and security auditors to evaluate password strength. Hashcat is the world's fastest password recovery tool, supporting over 300 hash types w\ndomain: cybersecurity\nsubdomain: cryptography\ntags:\n- cryptography\n- hash-cracking\n- password-security\n- hashcat\n- penetration-testing\nnist_csf:\n- PR.DS-01\n- PR.DS-02\n- PR.DS-10\nmodel: sonnet\nmaxTurns: 20\ntools: [Read, Bash, Glob, Grep]\ncapec: []\n---\n\n# Performing Hash Cracking with Hashcat\n\n## Overview\n\nHash cracking is an essential skill for penetration testers and security auditors to evaluate password strength. Hashcat is the world's fastest password recovery tool, supporting over 300 hash types with GPU acceleration. This skill covers using hashcat for authorized password auditing, understanding attack modes, creating effective rule sets, and generating hash analysis reports. This is strictly for authorized penetration testing and password policy assessment.\n\n\n## When to Use\n\n- When conducting security assessments that involve performing hash cracking with hashcat\n- When following incident response procedures for related security events\n- When performing scheduled security testing or auditing activities\n- When validating security controls through hands-on testing\n\n## Prerequisites\n\n- Familiarity with cryptography concepts and tools\n- Access to a test or lab environment for safe execution\n- Python 3.8+ with required dependencies installed\n- Appropriate authorization for any testing activities\n\n## Objectives\n\n- Identify hash types from captured hashes\n- Execute dictionary, brute-force, and rule-based attacks\n- Create custom hashcat rules for targeted cracking\n- Analyze password strength from cracking results\n- Generate compliance reports on password policy effectiveness\n- Benchmark GPU performance for hash cracking\n\n## Key Concepts\n\n### Hashcat Attack Modes\n\n| Mode | Flag | Description | Use Case |\n|------|------|-------------|----------|\n| Dictionary | -a 0 | Wordlist attack | Known password patterns |\n| Combination | -a 1 | Combine two wordlists | Compound passwords |\n| Brute-force | -a 3 | Mask-based enumeration | Short passwords |\n| Rule-based | -a 0 -r | Dictionary + transformation rules | Complex variations |\n| Hybrid | -a 6\u002F7 | Wordlist + mask | Passwords with appended numbers |\n\n### Common Hash Types\n\n| Hash Mode | Type | Example Use |\n|-----------|------|-------------|\n| 0 | MD5 | Legacy web apps |\n| 100 | SHA-1 | Legacy systems |\n| 1000 | NTLM | Windows credentials |\n| 1800 | sha512crypt | Linux \u002Fetc\u002Fshadow |\n| 3200 | bcrypt | Modern web apps |\n| 13100 | Kerberos TGS-REP | Active Directory |\n\n## Security Considerations\n\n- Only perform hash cracking with explicit written authorization\n- Secure all captured hash data in transit and at rest\n- Report all cracked passwords immediately to asset owners\n- Use results to improve password policies, not exploit users\n- Destroy cracked password data after engagement concludes\n- Follow rules of engagement for penetration test scope\n\n## Validation Criteria\n\n- [ ] Hash type identification is correct\n- [ ] Dictionary attack cracks weak passwords\n- [ ] Rule-based attack cracks policy-compliant passwords\n- [ ] Mask attack cracks short passwords\n- [ ] Results report shows password strength distribution\n- [ ] All operations performed within authorized scope\n","# Performing Hash Cracking with Hashcat\n\n## Overview\n\nHash cracking is an essential skill for penetration testers and security auditors to evaluate password strength. Hashcat is the world's fastest password recovery tool, supporting over 300 hash types with GPU acceleration. This skill covers using hashcat for authorized password auditing, understanding attack modes, creating effective rule sets, and generating hash analysis reports. This is strictly for authorized penetration testing and password policy assessment.\n\n\n## When to Use\n\n- When conducting security assessments that involve performing hash cracking with hashcat\n- When following incident response procedures for related security events\n- When performing scheduled security testing or auditing activities\n- When validating security controls through hands-on testing\n\n## Prerequisites\n\n- Familiarity with cryptography concepts and tools\n- Access to a test or lab environment for safe execution\n- Python 3.8+ with required dependencies installed\n- Appropriate authorization for any testing activities\n\n## Objectives\n\n- Identify hash types from captured hashes\n- Execute dictionary, brute-force, and rule-based attacks\n- Create custom hashcat rules for targeted cracking\n- Analyze password strength from cracking results\n- Generate compliance reports on password policy effectiveness\n- Benchmark GPU performance for hash cracking\n\n## Key Concepts\n\n### Hashcat Attack Modes\n\n| Mode | Flag | Description | Use Case |\n|------|------|-------------|----------|\n| Dictionary | -a 0 | Wordlist attack | Known password patterns |\n| Combination | -a 1 | Combine two wordlists | Compound passwords |\n| Brute-force | -a 3 | Mask-based enumeration | Short passwords |\n| Rule-based | -a 0 -r | Dictionary + transformation rules | Complex variations |\n| Hybrid | -a 6\u002F7 | Wordlist + mask | Passwords with appended numbers |\n\n### Common Hash Types\n\n| Hash Mode | Type | Example Use |\n|-----------|------|-------------|\n| 0 | MD5 | Legacy web apps |\n| 100 | SHA-1 | Legacy systems |\n| 1000 | NTLM | Windows credentials |\n| 1800 | sha512crypt | Linux \u002Fetc\u002Fshadow |\n| 3200 | bcrypt | Modern web apps |\n| 13100 | Kerberos TGS-REP | Active Directory |\n\n## Security Considerations\n\n- Only perform hash cracking with explicit written authorization\n- Secure all captured hash data in transit and at rest\n- Report all cracked passwords immediately to asset owners\n- Use results to improve password policies, not exploit users\n- Destroy cracked password data after engagement concludes\n- Follow rules of engagement for penetration test scope\n\n## Validation Criteria\n\n- [ ] Hash type identification is correct\n- [ ] Dictionary attack cracks weak passwords\n- [ ] Rule-based attack cracks policy-compliant passwords\n- [ ] Mask attack cracks short passwords\n- [ ] Results report shows password strength distribution\n- [ ] All operations performed within authorized scope\n",{"name":5,"tags":44,"capec":49,"model":50,"tools":51,"domain":31,"maxTurns":55,"nist_csf":56,"subdomain":45,"description":7},[45,46,47,20,48],"cryptography","hash-cracking","password-security","penetration-testing",[],"sonnet",[52,29,53,54],"Read","Glob","Grep",20,[57,58,59],"PR.DS-01","PR.DS-02","PR.DS-10","main","a91f1293287ffa9f4f1b8f486cd6e835a1568c84","skills\u002Fcrypto\u002Ftools\u002Fhashcat\u002Fcrack\u002Fextract","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace","https:\u002F\u002Fgithub.com\u002FDCx7C5","#Python","2026-09-01 11:21:00",{"source":8,"skillName":5,"commands":68,"prompt":78,"zipAvailable":79},[69,72,75],{"tool":70,"command":71},"npx","npx skills add DCx7C5\u002Fai-marketplace --skill tools-hashcat-crack-extract",{"tool":73,"command":74},"bunx","bunx skills add DCx7C5\u002Fai-marketplace --skill tools-hashcat-crack-extract",{"tool":76,"command":77},"pnpm","pnpm dlx skills add DCx7C5\u002Fai-marketplace --skill tools-hashcat-crack-extract","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fcrypto\u002Ftools\u002Fhashcat\u002Fcrack\u002Fextract\u002FSKILL.md",true,[81],{"path":82,"resourceType":83,"resourceTypeDesc":84,"sizeBytes":85,"sourceHtmlUrl":86},"index.json","REFERENCE","参考文档",694,"https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fcrypto\u002Ftools\u002Fhashcat\u002Fcrack\u002Fextract\u002Findex.json",[88,113,134,154,176,192],{"skillNo":89,"name":90,"nameZh":6,"description":91,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":92,"categories":93,"keywords":94,"publishedAt":39},"01M71HAPZ01KQ30RKTB0FFSQ05","services-wmi-persistence-detect","Detect WMI event subscription persistence by enumerating ActiveScriptEventConsumer, CommandLineEventConsumer, and permanent subscriptions in the WMI repository.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fservices\u002Fwmi\u002Fpersistence\u002Fdetect\u002FSKILL.md",[],[95,96,97,98,99,100,101,102,103,104,105,106,107,108,109,110,111,31,112],"services","detect","services wmi persistence detect","wmi","persistence","de","cm","process","activescript","event","subscriptions","commandline-consumer","repository","subscription","event-subscription","t1546.003","forensics","process-forensics",{"skillNo":114,"name":115,"nameZh":6,"description":116,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":117,"categories":118,"keywords":119,"publishedAt":39},"01M71HAK6JTTTS229T17WJMMCG","services-wmi-exec-exploit","Perform lateral movement across Windows networks using WMI-based remote execution techniques including Impacket wmiexec.py, CrackMapExec, and native WMI commands for stealthy post-exploitation during red team engagements.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fservices\u002Fwmi\u002Fexec\u002Fexploit\u002FSKILL.md",[],[120,95,121,98,122,123,124,31,29,125,126,127,128,129,100,130,131,25,132,133],"exploit","services wmi exec exploit","exec","remote","traffic","analysis","team","across","crackmapexec","native","command","lateral movement","lateral-movement","Impacket",{"skillNo":135,"name":136,"nameZh":6,"description":137,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":138,"categories":139,"keywords":140,"publishedAt":39},"01M71HAG6MHKNQV8KDZKMT4886","registry-artifact-extract","Extract and analyze Windows Registry hives to uncover user activity, installed software, autostart entries, and evidence of system compromise.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fregistry\u002Fartifact\u002Fextract\u002FSKILL.md",[],[141,142,143,22,144,145,31,29,146,125,147,148,100,25,149,150,151,152,153,50],"artifact","registry","registry artifact extract","evidence-collection","artifact-analysis","collection","analyze","uncover","software","activity","digital-forensics","windows-registry","regripper",{"skillNo":155,"name":156,"nameZh":6,"description":157,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":158,"categories":159,"keywords":160,"publishedAt":39},"01M71HACR4A8XTWTTSXK4124AA","processes-token-impersonate-detect","Detect Windows token impersonation and privilege abuse including SeImpersonatePrivilege exploitation via Potato attacks and token stealing techniques.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Ftoken\u002Fimpersonate\u002Fdetect\u002FSKILL.md",[],[96,161,162,163,164,165,166,101,167,31,112,168,169,170,171,172,173,174,175,100],"processes token impersonate detect","token","processes","attacks","windows","escalation","techniques","privilege-escalation","seimpersonate","token-impersonation","printspoofer","exploitation","potato","impersonation","via",{"skillNo":177,"name":178,"nameZh":6,"description":179,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":180,"categories":181,"keywords":182,"publishedAt":39},"01M71HAABSB4Z6QFSXEG00R4RK","processes-thread-injection-detect","Detect Windows thread injection techniques including CreateRemoteThread, QueueUserAPC, NtCreateThreadEx, and thread hijacking via process memory analysis.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Fthread\u002Finjection\u002Fdetect\u002FSKILL.md",[],[183,184,96,185,163,165,186,101,187,167,31,112,125,188,189,190,191,175,100,102],"thread","processes thread injection detect","injection","memory","process-injection","api","apc-injection","thread-injection","nt-api",{"skillNo":193,"name":194,"nameZh":6,"description":195,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":196,"categories":197,"keywords":198,"publishedAt":39},"01M71HA7H311V5G14WMX58HQSS","processes-hollow-technique-detect","Detect process hollowing (RunPE) by identifying processes with mismatched image paths between PEB and VAD tree, or unmapped PE headers in memory.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Fhollow\u002Ftechnique\u002Fdetect\u002FSKILL.md",[],[199,96,163,200,186,101,201,202,31,112,203,204,205,206,207,208,100,102,209,210],"processes hollow technique detect","tree","memory-forensics","process-hollow","peb","runpe","image","pe-header","in memory","with","mismatched","headers"]