Hashcat Rule Ranker – GPU-accelerated ranking of Hashcat rules

[A1131]

A tool that evaluates and ranks Hashcat rules against a wordlist + a list of known cracked passwords.

• GPU (OpenCL – NVIDIA/AMD/Intel)

• Multi-Armed Bandit (Thompson Sampling) with early elimination of weak rules → much faster on large rulesets or legacy exhaustive run

• Optional CELF post-processing (max-coverage) – selects the smallest, most efficient set of rules instead of a plain top-K

• Three strategy's: bitmap, recompute-gpu, sparse

• Handler for quick analysis and merging results from multiple runs
Output: ranked CSV + ready-to-use optimized .rule file.

GitHub: https://github.com/A113L/ranker

Credits:
@Vavaldi for coverage optimization inspiration

[A1131]

On the results of ranker x1.greedy vs a1131.greedy rulesets

# head x1.greedy_top50000.rule
: 
T0 T2 T4 T6 T8 TA TC $1 $2
l
x12
c'1$s18
“A$p t
T0 T6 TA $3
T0 T5 TA 1 $2 $3
R2
-9x35 ^f

# head a1131.greedy.25000.rule
: 
l
T0
$1
K
]
$1 $2 $3
$4
$2
+2

# head a1131.greedy_top50000.r1.rule
: 
] $a
[$1
[$9
[$8
[$7
[$4
[$3
[ [ $6
[ [ $5

As can be seen above, the rules obtained using the ranker (with CELF) are not only diverse, but also deliver very similar results at the identical cut-offs of 10k / 25k / 50k.

Rule	Hit rate	Size	AVG Time	Eff.
a1131.greedy.10000.rule	22.75%	10 000	25 352	2.275
x1.greedy_top10000.rule	22.56%	10 001	501.44	2.2558
a1131.greedy.25000.rule	28.60%	25 000	31 879	1.144
x1.greedy_top25000.rule	28.46%	25 001	25 832.06	1.1384
a1131.greedy_top50000.r1.rule	33.60%	50 001	16 987.14	0.672
x1.greedy_top50000.rule	33.05%	50 001	21 051.92	0.661

Ranker + CELF generates rulesets with very similar effectiveness (differences of only 0.14–0.55 pp), while being more diverse and less redundant. At the 10k/25k/50k cut-offs the results are practically equivalent.

Full Benchmark