curiouslearnerdev/online_tools-ai/password-cracking

Name: password-cracking
Author: curiouslearnerdev

Claude Code and agent skill by curiouslearnerdev/online_tools-ai

Trust tier 2

community

LLM review pending

By curiouslearnerdev
AI/ML
curiouslearnerdev/online_tools-ai
storage/hexstrike-ai-community-edition-master/skills/password-cracking/SKILL.md
Updated 24 Oct 2026
Version 1.0.01 version recorded

Source check pending

Checking that the SKILL.md file is still in the repository.

Password hash identification, cracking, and credential brute-forcing using hashid, john, hashcat, hydra, medusa, and ophcrack

Install

npx vskill@latest install curiouslearnerdev/online_tools-ai/password-cracking

SKILL.md

password-cracking

Password cracking and credential brute-force workflow for HexStrike AI. Use this skill when a user has captured hashes to crack, wants to brute-force a login service, or needs to identify an unknown hash format.

Workflow

Step 1 — Identify the hash type (hashid)

Always identify the hash format before cracking. Do not guess.

run_tool(tool="hashid", hash="<paste_hash_here>")

Common hash types and their hashcat mode numbers:

Hash	hashcat mode
MD5	0
SHA-1	100
SHA-256	1400
SHA-512	1700
bcrypt	3200
NTLM	1000
Net-NTLMv2	5600
WPA2	22000
Kerberos 5 AS-REP	18200
Kerberos 5 TGS	13100

Step 2 — Dictionary attack (john or hashcat)

John the Ripper — best for automatic format detection and many exotic formats:

run_tool(tool="john", hash_file="/path/to/hashes.txt",
         wordlist="/usr/share/wordlists/rockyou.txt")
 
# Force a specific format
run_tool(tool="john", hash_file="/path/to/hashes.txt",
         wordlist="/usr/share/wordlists/rockyou.txt",
         format_type="NT")

Hashcat — best for speed, GPU acceleration, and rule-based attacks:

# Dictionary attack (mode 0)
run_tool(tool="hashcat", hash_file="/path/to/hashes.txt",
         hash_type="1000",
         attack_mode="0",
         wordlist="/usr/share/wordlists/rockyou.txt")
 
# Dictionary + rules (best64 rule)
run_tool(tool="hashcat", hash_file="/path/to/hashes.txt",
         hash_type="0",
         attack_mode="0",
         wordlist="/usr/share/wordlists/rockyou.txt",
         additional_args="-r /usr/share/hashcat/rules/best64.rule")

Step 3 — Brute-force / mask attack (hashcat)

Use when dictionary attack fails and you know the password format:

# 8-character lowercase + digit (e.g. "summer23")
run_tool(tool="hashcat", hash_file="/path/to/hashes.txt",
         hash_type="0",
         attack_mode="3",
         mask="?l?l?l?l?l?l?d?d")

Mask charset reference:

?l lowercase letters
?u uppercase letters
?d digits
?s special characters
?a all printable

Step 4 — Windows NTLM / rainbow tables (ophcrack)

Use ophcrack for Windows NTLM hashes when you have rainbow tables available:

run_tool(tool="ophcrack", hash_file="/path/to/ntlm_hashes.txt",
         tables_dir="/path/to/tables")

Step 5 — Network service brute-force (hydra or medusa)

Use after gaining credentials to test for password reuse, or when attacking login services directly.

Hydra:

# SSH brute-force
run_tool(tool="hydra", target="<target>", service="ssh",
         username="admin",
         password_file="/usr/share/wordlists/rockyou.txt")
 
# HTTP form brute-force
run_tool(tool="hydra", target="<target>", service="http-post-form",
         username_file="/usr/share/seclists/Usernames/top-usernames-shortlist.txt",
         password_file="/usr/share/wordlists/rockyou.txt",
         additional_args='"/login:username=^USER^&password=^PASS^:Invalid"')

Medusa (alternative to Hydra, stronger on some protocols):

run_tool(tool="medusa", target="<target>", module="ssh",
         username="root",
         password_file="/usr/share/wordlists/rockyou.txt")

Service-to-tool selection guide

Service	Tool
SSH	hydra, medusa
FTP	hydra, medusa
HTTP form POST	hydra
SMB	netexec (see `smb-enum` skill)
RDP	hydra
MySQL	hydra, medusa
NTLM hashes	hashcat (mode 1000), john
Net-NTLMv2	hashcat (mode 5600)
bcrypt	john (slow), hashcat (mode 3200)

Tips

Start with rockyou.txt + best64.rule — covers most real-world passwords.
For corporate targets, build a custom wordlist from the company name, domain, and OSINT findings.
GPU hashcat is orders of magnitude faster than CPU john for MD5/NTLM — use it when available.
Never skip hashid — cracking the wrong format wastes significant time.

HexStrike Tool Reference

Tool	Use case
`hashid`	Identify unknown hash type
`john`	Dictionary + format-aware cracking
`hashcat`	GPU-accelerated dictionary/mask/rule cracking
`hydra`	Network login brute-forcer
`medusa`	Alternative network login brute-forcer
`patator`	Multi-purpose brute-forcer
`ophcrack`	NTLM rainbow table cracker

Security

Security scanPassed, 100 of 100Pattern checks on the skill's files.
Model reviewNot runA model review is scheduled for the next rescan.

See the full security report

Quality evaluation

Task evaluationNot runNo evaluation yet. Run one in Skill Studio.

See evaluation results

Source

SKILL.md in the repositoryCheckingstorage/hexstrike-ai-community-edition-master/skills/password-cracking/SKILL.md

Popularity

7-day trend score: 0

Not refreshed yet.

Works with

Any agent vskill installs to: 56 targets in all. These 39 have a page on this site.

Claude Code
Cursor
GitHub Copilot
Windsurf
Codex
Gemini CLI
Cline
Amp
Roo Code
Goose
Continue
Kilo Code
Junie
Trae
OpenHands
Qwen Code
AI Agent
Tabnine Chat
Sourcegraph Cody
Amazon Q
Firebase Genkit
Sweep
Devin
Phind
Mentat
Claude Desktop
Aider
GPT Pilot
Plandex
bolt.new
v0
Replit Agent
Anse
TypingMind
BetterChatGPT
LibreChat
Warp AI
Pieces
Fig AI

Embed badge

[![vskill VERIFIED](https://verified-skill.com/api/v1/skills/curiouslearnerdev/online_tools-ai/password-cracking/badge)](https://verified-skill.com/skills/curiouslearnerdev/online_tools-ai/password-cracking)

Something wrong with this skill or its page? Tell us.