Crack passwords of private key entries in Java Key Store (JKS) files using a GPU-accelerated hashcat implementation.
JKS-private-key-cracker-hashcat is a security tool designed to crack passwords protecting private key entries in Java Key Store (JKS) files. It exploits a cryptographic weakness in JKS's Password Based Encryption scheme, enabling efficient password recovery by targeting private key passwords directly while ignoring the keystore password. The tool integrates with hashcat for GPU-accelerated cracking, offering significantly higher speeds compared to traditional methods.
Penetration testers, security researchers, CTF (Capture The Flag) players, and developers auditing Java-based systems who need to recover lost passwords or assess the security of JKS files.
It is the first public tool to exploit this specific JKS weakness, offering compatibility with all JKS configurations and GPU-accelerated performance through hashcat integration, making it faster and more effective than existing alternatives like John the Ripper for this specific task.
Nail in the JKS coffin - Cracking passwords of private key entries in a JKS file
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.
Exploits a cryptographic weakness to bypass the keystore password and target private key passwords directly, making it effective against all JKS configurations as highlighted in the README.
Integrates with hashcat for high-speed cracking using GPU hardware, offering significant speed advantages over CPU-based tools like John the Ripper.
Includes JksPrivkPrepare.jar for hash extraction, guidance for John the Ripper compatibility, and a Python PoC for alternative use, covering various use cases.
First public tool to exploit this specific JKS vulnerability, providing a unique advantage for security researchers and penetration testers.
Only supports JKS files; the README explicitly states that other keystore formats like JCEKS or BKS are not supported, limiting its applicability.
Optimal performance requires hashcat and GPU hardware, adding setup complexity and hardware requirements that may not be feasible in all environments.
Involves multiple command-line steps and familiarity with tools like hashcat, which can be daunting for users new to password cracking workflows.