hashcat & John hash cracking

When it applies

You hold in-scope credential material (tradecraft-scope-roe) that must be proven crackable: NTLM dumps, NetNTLMv2 captures (network-credential-cracking), Kerberos TGS tickets (ad-kerberoasting), JWT HMAC secrets (web-auth-jwt), /etc/shadow, or password-protected archives/keys. In defense mode, the same workflow audits whether org passwords survive a real cracking run.

Why it works

Offline cracking has no lockout and no rate limit — speed is set by hash algorithm and hardware. hashcat drives GPUs (billions of guesses/sec on fast hashes like NTLM); John the Ripper is the flexible CPU fallback with extractors (*2john) that turn encrypted files into crackable hashes. Rules and masks exploit how humans actually pick passwords, so a small wordlist + mutation beats blind brute force.