Skip to content
  • Hashes.com Escrow Feed

    Pinned Locked Moved Resources
    5k
    1 Votes
    5k Posts
    63k Views
    hashpwn-botH
    Escrow ID# 80683 • Algorithm: Electrum Wallet (Salt-Type 5), -m 21800 • Total hashes: 1089 • Price per hash: $24.9503 • Escrow URL: https://hashes.com/en/escrow/item/?id=80683 • Download hashes: 80683_21800.zip
  • hashes.com Escrow API Tool

    Hash Cracking
    4
    1 Votes
    4 Posts
    1k Views
    cycloneC
    New version released. https://github.com/cyclone-github/hashes.com-escrow-tool/releases/tag/v1.1.2 v1.1.2; 2025-11-21 fixed redundant new line logic added http timeouts Full Changelog: https://github.com/cyclone-github/hashes.com-escrow-tool/compare/v1.1.1...v1.1.2
  • Infosec News

    General Discussion
    97
    1
    1 Votes
    97 Posts
    23k Views
    cycloneC
    Fortinet: FortiWeb Actively Exploited (again) [image: 1763653560091-7d7c2820-93bb-49dc-987e-db05cdd138da-image.png] Fortinet has issued an alert for CVE-2025-58034, a command injection bug in FortiWeb (CVSS 6.7) that is being weaponized. The flaw is an OS command injection issue in FortiWeb’s HTTP and CLI handling that allows arbitrary code execution, but only after an attacker has authenticated by some other method. Patches are available for all affected branches: • 8.0.0 to 8.0.1 → update to 8.0.2 • 7.6.0 to 7.6.5 → update to 7.6.6 • 7.4.0 to 7.4.10 → update to 7.4.11 • 7.2.0 to 7.2.11 → update to 7.2.12 • 7.0.0 to 7.0.11 → update to 7.0.12 Reported by Trend Micro’s Jason McFadyen, the flaw is already under active exploitation, prompting CISA to add it to the Known Exploited Vulnerabilities catalog with a federal patch deadline of November 25, 2025. Exploit chain activity: The situation escalates when paired with CVE-2025-64446, an authentication bypass silently patched by Fortinet in 8.0.2. According to Orange Cyberdefense and Rapid7, attackers are chaining the two bugs: bypassing authentication via CVE-2025-64446, then leveraging CVE-2025-58034 for command execution. This converts an authenticated-only issue into full unauthenticated RCE against unpatched appliances. Industry concern: Security teams have raised concerns about Fortinet’s decision to patch these flaws before publishing advisories. Analysts note that silent patching provides attackers with a window of advantage and leaves defenders unaware of what they're exposed to until exploitation is already underway. Action required: Apply the fixed releases immediately and audit FortiWeb instances for suspicious authenticated activity or anomalous command execution attempts, especially if systems were running vulnerable versions prior to Fortinet’s disclosure. Source: https://nvd.nist.gov/vuln/detail/CVE-2025-58034 https://thehackernews.com/2025/11/fortinet-warns-of-new-fortiweb-cve-2025.html
  • Forum Updates

    Announcements & Comments
    15
    0 Votes
    15 Posts
    3k Views
    cycloneC
    Due to the global Cloudflare outage today, all hashpwn front-end web services were either partially, or fully, unavailable from 11/18/2025 11:57 UTC - 11/18/2025 14:35 UTC with an Internal Server Error 500 status from Cloudflare. As soon as Cloudflare mitigated the issue on their side, all hashpwn front-end web services became available. More info about Cloudflare's outage: https://forum.hashpwn.net/post/6195 https://www.businessinsider.com/cloudflare-outage-internet-down-x-open-ai-2025-11 https://www.cloudflarestatus.com [image: 1763481333855-d87b4a38-06cc-4776-a408-42241232f99e-image.png]
  • crackmon - Monitor hashcat / mdxfind crackrate

    Hash Cracking
    12
    2 Votes
    12 Posts
    1k Views
    freerouteF
    @v1cvap0r I use an ANS (Automated Notification System) for this purpose. It uses the Python Watchdog module. After startup, it continuously monitors the contents of the hashcat.potfile and the john.pot file. Startup message: ️ Warning. Recovery process has been started. ANS (Automated Notification System) has been activated! It continuously monitors for changes and optionally sends them either via email or as a push message to a Signal or Telegram address. The script requests this data after startup. I also created a service file for playing the sound file. It also uses Watchdog to continuously monitor the contents of the potfiles and plays the sound file I selected.
  • xiaopan forum

    General Discussion
    1
    0 Votes
    1 Posts
    26 Views
    No one has replied
  • 3,5M+ MD5 Hashes

    Standard: MD5, SHA1, SHA256, etc.
    9
    0 Votes
    9 Posts
    1k Views
    N
    -m 2600 2641814_left.zip 31575_found.txt
  • nvflash (nvidia vbios flash tool)

    Tools
    1
    0 Votes
    1 Posts
    301 Views
    No one has replied
  • 25 Hashes or Less Requests (Wireless)

    Pinned Wireless / WPA Cracking
    6
    1 Votes
    6 Posts
    1k Views
    T
    WPA*02*39725ebd3a5d48831ad87b8daec7051f*80b57508db1c*c657a482ae73*4368696e614e65742d45364853*43d1254ca96351d7cac1a4fa7e3088e0050564410cfd51905d0c71eaab38db1e*0103007502010a000000000000000000011efb41a3d344f844ce154323b4a42b821d7a39cf5aa7dece3085338c7de9b5b5000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001630140100000fac020100000fac040100000fac028000*82 Moderator note: I removed your duplicate posts and commented out your hash so that it is properly displayed. Please make sure to comment out any hashes that contain markdown formatting chars such as asterisk "*". ~ @cyclone
  • 1 Votes
    6 Posts
    853 Views
    T
    RAR hash-mode:23800 23800.txt
  • hashgen - the blazingly fast hash generator

    Text / Wordlist / Rules
    8
    1 Votes
    8 Posts
    3k Views
    cycloneC
    New version of hashgen published. https://github.com/cyclone-github/hashgen/releases/tag/v1.2.0 v1.2.0; 2025-11-08 addressed raw base-16 issue https://github.com/cyclone-github/hashgen/issues/8 added feature: "keep-order" from https://github.com/cyclone-github/hashgen/issues/7 added dynamic lines/sec from https://github.com/cyclone-github/hashgen/issues/11 added modes: mysql5 (300), phpass (400), md5crypt (500), sha256crypt (7400), sha512crypt (1800), Wordpress bcrypt-HMAC-SHA384 (wpbcrypt) added hashcat salted modes: -m 10, 20, 110, 120, 1410, 1420, 1310, 1320, 1710, 1720, 10810, 10820 added hashcat modes: -m 2600, 4500 added encoding modes: base32encode, base32decode cleaned up hashFunc aliases, algo typo, hex mode, hashBytes case switch, base64 and base58 decoders fixed ntlm encoding issue added sanity check to not print blank / invalid hash lines (part of ntlm fix, but applies to all hash modes) converted checkForHex from string to byte updated yescrypt parameters to match debian 12 (libxcrypt) defaults
  • 0 Votes
    7 Posts
    910 Views
    G
    how to convert my Chrome extension Trust wallet local storage files into hash for bruteforce?
  • rulest - GPU Rules Extractor

    Scripts
    2
    0 Votes
    2 Posts
    425 Views
    A1131A
    Fyi. The OpenCl kernel used by the script has been updated with all Hashcat rules visible at https://hashcat.net/wiki/doku.php?id=rule_based_attack. This slightly increases the rule chain extraction time, but it can also lead to complex rules.
  • phantom_pwn - Phantom Vault Extractor & Decryptor

    Hash Cracking
    29
    2 Votes
    29 Posts
    5k Views
    G
    Hi. I have a question, is it possible to automatically export the private key of the wallet we unlocked using your tool? Or the mnemonic by any chance. I cannot send @cyclone a DM because my reputation is too low.
  • 🎉 Happy 1st Birthday, hashpwn! 🎉

    Announcements & Comments
    5
    0 Votes
    5 Posts
    926 Views
    C
    Hey @cyclone and the whole hashpwn crew — sorry for being 10 days late to the party, but congrats on the 1st anniversary! What you’ve built in just a year is straight-up legendary — a global powerhouse for hash cracking minds. Huge respect for keeping the scene alive, open, and fun. Here’s to many more years of cracking, sharing, and pushing limits together. Happy Birthday, hashpwn!
  • ~90kk MD5 Hashfile for Debugging and Benchmarking

    Resources
    2
    0 Votes
    2 Posts
    452 Views
    P
    That's great, thank you.
  • wordlists for a specific country

    General Discussion
    3
    0 Votes
    3 Posts
    448 Views
    A1131A
    CN passwords International
  • 12m md5 (hex32) dump

    Standard: MD5, SHA1, SHA256, etc.
    15
    0 Votes
    15 Posts
    2k Views
    A1131A
    56221_found.zip 11337696_left Spoiler There is more to be found from this thread using emails rules -> https://raw.githubusercontent.com/A113L/rules/refs/heads/main/a1131/emails.rule stacked with rule "l" (maybe also with swapped numbers and some special characters rules) on bigger dictionaries and more powerful graphic cards.
  • Emails rules extractor

    Scripts
    2
    0 Votes
    2 Posts
    614 Views
    A1131A
    Analyzes and displays the top 20 (customizable by def print_top_domains) overall domains (NEW). Ready to use in script. #!/usr/bin/env python3 """ Email-Based Hashcat Rule Extractor This script processes a file containing email addresses, extracts trailing digit sequences from the usernames (before the '@'), filters them by specified domains, and generates Hashcat-compatible rule strings. It first displays the top 20 most frequent domains in the input file to help the user decide which domains to target for rule extraction. Functionality: - Reads email addresses from an input file. - **Analyzes and displays the top 20 overall domains (NEW).** - Filters addresses by user-specified domain(s) (e.g., 'gmail.com', 'yahoo.com'). - Extracts trailing digits from the local-part (e.g., 'user123' -> '123'). - Groups and counts digit-domain combinations. - Generates Hashcat rules from the most common combinations. - Saves rules to an output file. - Displays the top 5 most frequent patterns with example emails. Usage: - Run the script and provide: 1. Path to the input file containing emails (one per line). 2. Comma-separated list of domains to filter (after seeing the top domains). 3. Path to save the output Hashcat rules. """ import sys import re from collections import Counter, defaultdict def get_file_path(prompt): """Handles continuous prompting until a non-empty path is entered.""" while True: path = input(prompt).strip() if path: return path print("Path cannot be empty. Please try again.") def extract_data_from_email(email): """ Extracts the local part and domain from an email. Returns (digits, domain) if the local part ends in digits, otherwise None. """ # Regex to validate email structure and separate user/domain match = re.match(r'^([a-zA-Z0-9._%+-]+)@([a-zA-Z0-9.-]+\.[a-zA-Z]{2,})$', email.strip()) if not match: return None user, domain = match.groups() domain = domain.lower() # Normalize domain to lowercase # Check for trailing digits in the local part (username) digits_match = re.search(r'(\d+)$', user) if digits_match: digits = digits_match.group(1) return digits, domain return None def string_to_hashcat_rule(s): """Converts a string (e.g., '[email protected]') to a Hashcat rule (e.g., '$1$2$3$@$g$m$a$i$l$.$c$o$m').""" return ''.join(f"${c}" for c in s) def print_top_domains(file_path, limit=20): # edit limit if required """Reads the file, counts all domains, and prints the top 'limit' domains.""" domain_counts = Counter() try: with open(file_path, 'r', encoding='utf-8') as f: for line in f: email = line.strip() if '@' in email: # rsplit ensures we only split once from the right _, domain = email.rsplit('@', 1) if domain: domain_counts[domain.lower()] += 1 except FileNotFoundError: print(f"\nError: File not found at '{file_path}'", file=sys.stderr) return False except Exception as e: print(f"\nAn error occurred while reading the file: {e}", file=sys.stderr) return False top_domains = [f"{domain} ({count})" for domain, count in domain_counts.most_common(limit)] print("\n" + "="*50) print(f"🥇 Top {limit} Domains Found in the Input File:") print("="*50) # Print the top domains comma-separated, without spaces, just like the original request's output print(','.join(domain for domain, count in domain_counts.most_common(limit))) print("="*50 + "\n") return True def main(): """Main function to handle user input, file processing, and rule generation.""" print("--- Hashcat Rule Extractor for Email Patterns ---") # 1. Get Input Path and Print Top Domains input_path = get_file_path("Enter path to input file containing emails: ") # Display the top domains before proceeding if not print_top_domains(input_path, limit=20): # Exit if file reading failed in print_top_domains sys.exit(1) # 2. Get Domains to Filter domains_input = input("Enter comma-separated domains to filter (e.g., gmail.com,yahoo.com): ").strip() # 3. Get Output Path output_path = get_file_path("Enter path to save generated hashcat rules: ") domains_to_include = set(domain.strip().lower() for domain in domains_input.split(',') if domain.strip()) if not domains_to_include: print("\nWarning: No domains were specified for filtering. Exiting.", file=sys.stderr) sys.exit(0) counter = Counter() examples = defaultdict(list) print("\nProcessing file...") try: with open(input_path, 'r', encoding='utf-8') as f: for line in f: email = line.strip() extracted = extract_data_from_email(email) if extracted: digits, domain = extracted if domain in domains_to_include: key = (digits, domain) counter[key] += 1 # Store a few examples for display later if len(examples[key]) < 3: examples[key].append(email) except Exception as e: print(f"An error occurred during file processing: {e}", file=sys.stderr) sys.exit(1) sorted_items = counter.most_common() # 4. Write Rules to Output File try: with open(output_path, 'w', encoding='utf-8') as out: for (digits, domain), count in sorted_items: rule = string_to_hashcat_rule(digits + '@' + domain) out.write(f"{rule}\n") except Exception as e: print(f"Error writing to output file '{output_path}': {e}", file=sys.stderr) sys.exit(1) # 5. Display Summary print(f"\nDone! {len(sorted_items)} rules written to {output_path}") print("\nTop 5 extracted rules with examples:") if not sorted_items: print(" No patterns found matching the specified domains and having trailing digits.") return for (digits, domain), count in sorted_items[:5]: rule = string_to_hashcat_rule(digits + '@' + domain) print(f" Rule: {rule} | Count: {count} | Examples: {', '.join(examples[(digits, domain)])}") if __name__ == '__main__': main() https://raw.githubusercontent.com/A113L/Bucket/refs/heads/main/emailr.py
  • Hashcat Rules

    Hashcat Rules
    17
    0 Votes
    17 Posts
    3k Views
    oe3p32wedwO
    thanks for your work!

Who's Online [Full List]

9 users active right now (4 members and 5 guests).
cyclone, hashpwn-bot, freeroute, petrovivo1234

Board Statistics

Our members have made a total of 6.3k posts in 158 topics.
We currently have 299 members registered.
Please welcome our newest member, hashwolf.
The most users online at one time was 49 on Thursday, December 26, 2024.