hashpwn

I have multiple rigs, servers, desktops, laptops and raspberry pi 3b, 4 & 5 SBC, but the two below are my main hash cracking rigs. Rig #1 GPU(s): 1x Nvidia RTX 4090 MSI Suprim Liquid X GPU Cooling: Waterblock GPU Driver: 580.95.05 (CUDA 13.0) GPU Overclock / Undervolt Settings: 400W power limit CPU(s): 1x Ryzen 7 3700X CPU Cooling: Waterblock RAM: 64gb DDR4 G.SKILL Ripjaws V (4x16GB) MB: ASUS ROG STRIX X470-F GAMING Storage: (OS, ZFS RAIDZ1, backups, scratch disk, etc) - NVMe: 1x 2TB ADATA - SSD: 4x 2TB Samsung 870 - SSD: 1x 120GB OCZ - HDD: 2x 8TB WD80 PSU: 1600W EVGA SuperNOVA Platinum+ OS: Debian 13 Tools Used: hashcat 6.2.6 / 7.x, mdxfind, jtr, rling, hashgen, spider, pcfg-go Rig Type: rackmount LAN: 10Gb fiber (SFP+) Rig #2 GPU(s): 2x NVIDIA RTX 4090 MSI Gaming X GPU Cooling: Air (triple-fan) GPU Driver: 580.95.05 (CUDA 13.0) GPU Overclock / Undervolt Settings: 400W power limit CPU(s): 2x Intel Xeon E5-2690 v4 CPU Cooling: OEM Dell RAM: 128GB DDR4 ECC (8x16GB) MB: OEM Dell 0KJCC5 Storage: (OS, ZFS RAIDZ1) - SSD: 5x 2TB Samsung 870 QVO PSU: - 825W Dell OEM Platinum - 1600W EVGA SuperNOVA 1600 Platinum+ (GPUs) OS: Debian 13 Tools Used: hashcat 6.2.6 / 7.x, mdxfind, jtr, rling, hashgen, spider, pcfg-go Rig Type: rackmount LAN: 10Gb fiber (SFP+)

Crack the Con 2026 is offically over, and great job to everyone who participated! 1st place - HashMob Lite 2nd place - PizzaPlannet (hashcat, is that you?) 3rd place - hash_meltdown Final scoreboad: [image: 1775182625518-f6431215-1098-43e3-98a1-71e57433388e-image.jpeg] [image: 1775182656561-3b555f9e-1c87-46c1-87f9-7dbb2e5e806e-image.jpeg] [image: 1775182667583-73af4e73-bc7f-4600-afc0-4b9beec5fde3-image.jpeg]

75266_found.txt 11206738_left

solflare_pwn v0.3.1 released includes xpass exploit, details here: https://forum.hashpwn.net/post/11116 https://github.com/cyclone-github/solflare_pwn/releases/tag/v0.3.1

Update: Details of the Solflare “xpass” Exploit March 13, 2026 Over the past year I have received many requests asking when I would release the full details of the Solflare xpass exploit. Today, I am publishing those details. This post serves as an update to my original disclosure in Feb 2025 regarding a purposeful backdoor master key I discovered in the Solflare Chrome wallet extension that allows a wallet vault to be decrypted without requiring the user's wallet password. At the time of the original report I privately disclosed this to Solflare and delayed public publication to give Solflare time to address the exploit. The Core Issue Solflare stores two critical values inside the extension's LevelDB storage: solflaredata – encrypted wallet vault containing the seed phrase <-- this encrypted string contains the wallet seed phrase solflarexpass – a key used to decrypt the vault <-- the "backdoor master key" Because the decryption key is stored locally alongside the encrypted vault, the user's wallet password is not required to decrypt the vault and gain access to the wallet's seed phrase. All that is required to decrypt the wallet and gain access to the seed phrase is access to the Chrome extension storage and extraction of the solflarexpass key -- something very easy for a malicious actor or stealer malware to do. Once the vault is extracted with the key, the seed phrase can be recovered. No password cracking required. Example Storage Layout Inside the Chrome Solflare extension storage database the relevant entries appear similar to: solflaredata: { "data":{ "digest":"sha256", "encoding":"base64", "encrypted64":"..." } } solflarexpass: "<stored key>" Using the key stored in solflarexpass, the encrypted vault (solflaredata) can be decrypted. A screenshot of the original report is attached below. [image: 1773412854934-c25dc614-d139-4de7-9c3b-da142cb773bb-image.png]

@cyclone Trying to extract the vault gives me checksum mistakes with Chrome

Some of the above wordlists are now available via mirrors thanks to weakpass.com, so if you encounter download limits from Mega you can use these links instead Goodies_v1 Goodies_v2 Archive Archive.founds Triodante A1131 top_passwords

trustwallet_pwn toolkit has been released which supports extracting and decrypting Chrome based Trust Wallet browser extensions for password and seed phrase recovery. https://forum.hashpwn.net/post/10795

trustwallet_pwn toolkit has been released which supports extracting and decrypting Chrome based Trust Wallet browser extensions for password and seed phrase recovery. https://forum.hashpwn.net/post/10795

I confirm. None of the ready-made extractor or decryptor programs worked with the Zen browser. This person sorted out the situation for free, adapted the programs for my browser, and restored my SRP. For that, I'm incredibly grateful.

@test123456 said in Hashchef: Are there any tutorials available, such as video tutorials? No. There is plenty of documentation on the git and is fairly straight forward to use. If you have any specific questions I am more than happy to answer them.

dump not have salt i check all bd planetarium-laupheim.de

Previous left list appears to be a found list, so using original 123.txt from OP as left list. 11675_found.txt 743_left.txt 12418 total

Answered on your other post: https://forum.hashpwn.net/post/8383

@freeroute Is it compatible with Ubuntu? Could you share a download link?