/
← Voltar ao feed
low

TrustedSec releases HashcatRosetta, a tool to explain and analyze hashcat rules, debug logs and masks

1 fonte(s) · 1 atualização(ões) · publicado 01/10/2026 01:00 · coletado há 2 dias

TrustedSec's Justin Bollinger describes HashcatRosetta, an open-source tool for password-cracking practitioners (part 2 of a 3-part series on hate_crack). It translates dense hashcat rule syntax into plain-English, step-by-step explanations. It also analyzes --debug-mode 4/5 output to show which rules, basewords and wordlists actually produced cracks. This is tooling and methodology news with no vulnerability, exploitation or threat actor activity.

The author shows that line 53 of the stock best64.rule (^e ^h ^t) simply prepends "the". He also shows that case-sensitive leetspeak substitutions (sa@ se3 so0) are no-ops against uppercase basewords, which wastes GPU time on NTDS- or OSINT-derived lists. The tool can also validate .hcmask files, which hashcat otherwise handles silently, and statically profile rule files (best64 is mostly suffix-oriented operations).

Detalhes técnicos

  • Debug workflow: hashcat -m 1000 -a 0 --debug-mode 4 --debug-file debug.txt -r rules.rule hashes.txt wordlist.txt. --debug-file is required, otherwise output goes to hashcat's profile directory.
  • Analysis metrics: frequency, basewords and unique candidates, which expose rules that produce redundant candidates. --wordlists (mode 5) attributes cracks to source wordlists.
  • --analyze-rules on best64.rule: 77 rules and 215 opcode tokens, with append at 27.91%, truncate at 18.60% and rotate right at 11.63%. Only four ^ tokens appear in the whole file.
  • --verify-masks mirrors hashcat's hcmask parser (src/mpsp.c), reports per-line validity and keyspace, and returns a non-zero exit code on invalid lines. The author fixed backslash-escape handling and support for custom charsets ?5-?8.
  • Verification: scripts/verify_rules.py uses real hashcat as an oracle (generate-rules.bin from hashcat-utils) and reports 7,545 rule/baseword pairs matched with 0 mismatches, and 60 opcodes covered. Memory and filter opcodes are checked against the host-side -j engine because they are not valid in -r rule files.
  • Bugs found in the author's initial simulator include misdescribed opcodes (S, h, H, 4, v, B), missing opcodes (6, Q, 3NX), \xNN escape decoding and non-ASCII casing.

Remediação

No remediation applies. Practitioners are advised to run attacks with --debug-mode 5 --debug-file, review the most productive rules by unique candidates, build trimmed rule files, and use --explain before trusting third-party rule files. Install with uv tool install git+https://github.com/bandrel/HashcatRosetta.git.

Linha do tempo

  1. trustedsec.com ↗ · pub. 01/10/2026 01:00 · coletado 19/10 17:57 primeiro registro

    TrustedSec releases HashcatRosetta, a tool to explain and analyze hashcat rules, debug logs and masks

    ler a análise desta fonte

    TrustedSec's Justin Bollinger describes HashcatRosetta, an open-source tool for password-cracking practitioners (part 2 of a 3-part series on hate_crack). It translates dense hashcat rule syntax into plain-English, step-by-step explanations. It also analyzes --debug-mode 4/5 output to show which rules, basewords and wordlists actually produced cracks. This is tooling and methodology news with no vulnerability, exploitation or threat actor activity.

    The author shows that line 53 of the stock best64.rule (^e ^h ^t) simply prepends "the". He also shows that case-sensitive leetspeak substitutions (sa@ se3 so0) are no-ops against uppercase basewords, which wastes GPU time on NTDS- or OSINT-derived lists. The tool can also validate .hcmask files, which hashcat otherwise handles silently, and statically profile rule files (best64 is mostly suffix-oriented operations).

    Technical Details

    • Debug workflow: hashcat -m 1000 -a 0 --debug-mode 4 --debug-file debug.txt -r rules.rule hashes.txt wordlist.txt. --debug-file is required, otherwise output goes to hashcat's profile directory.
    • Analysis metrics: frequency, basewords and unique candidates, which expose rules that produce redundant candidates. --wordlists (mode 5) attributes cracks to source wordlists.
    • --analyze-rules on best64.rule: 77 rules and 215 opcode tokens, with append at 27.91%, truncate at 18.60% and rotate right at 11.63%. Only four ^ tokens appear in the whole file.
    • --verify-masks mirrors hashcat's hcmask parser (src/mpsp.c), reports per-line validity and keyspace, and returns a non-zero exit code on invalid lines. The author fixed backslash-escape handling and support for custom charsets ?5-?8.
    • Verification: scripts/verify_rules.py uses real hashcat as an oracle (generate-rules.bin from hashcat-utils) and reports 7,545 rule/baseword pairs matched with 0 mismatches, and 60 opcodes covered. Memory and filter opcodes are checked against the host-side -j engine because they are not valid in -r rule files.
    • Bugs found in the author's initial simulator include misdescribed opcodes (S, h, H, 4, v, B), missing opcodes (6, Q, 3NX), \xNN escape decoding and non-ASCII casing.

    Remediation

    No remediation applies. Practitioners are advised to run attacks with --debug-mode 5 --debug-file, review the most productive rules by unique candidates, build trimmed rule files, and use --explain before trusting third-party rule files. Install with uv tool install git+https://github.com/bandrel/HashcatRosetta.git.