A collection of hashcat and John the Ripper rules for password cracking, optimized for common password generation patterns.
Hashcat-rules is a collection of rule files for hashcat and John the Ripper, designed to crack passwords by applying common transformations like adding digits, punctuation, or years. It solves the problem of inefficient password cracking by providing optimized, non-random rules that target predictable password generation habits. The project includes rule sets of varying sizes for different hashing algorithm speeds.
Security professionals, penetration testers, and red teamers who use hashcat or John the Ripper for password cracking and need efficient, targeted rule sets.
Developers choose this for its curated, practical rules that avoid randomness, focus on common password patterns, and are optimized for performance with different hash algorithms, unlike broader rule collections.
Rule for hashcat or john. Aiming to crack how people generate their password
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.
Provides large, medium, and small rule sets tailored for fast (e.g., MD5) and slow (e.g., bcrypt) hashing algorithms, as explicitly mentioned in the README for efficient cracking.
Focuses on non-random, common password habits like adding digits, punctuation, years, and leet substitutions, avoiding overly broad approaches for targeted efficiency.
Includes instructions for testing rules with hashcat's --stdout switch and saving matched rules using --debug-mode, enabling easy verification and statistical analysis.
Offers clear references to hashcat's rule-based attack documentation and uses clem9669_small.rule as a starter example for writing custom rules.
Admits targeting 'a certain language like french,' making it less effective for password cracking in multilingual or diverse cultural contexts.
Requires manual combination of multiple rule files (e.g., toggle-case.rule with clem9669_big.rule), adding setup complexity and potential for errors.
The small rule set is minimal, primarily for adding single characters, which may not provide comprehensive coverage for slow algorithm attacks without combining rules.