Overview¶

What is KrakenHashes?¶

KrakenHashes is a distributed password cracking management system that transforms the power of Hashcat into an enterprise-ready platform. While Hashcat excels as a command-line tool for password recovery, KrakenHashes adds the orchestration, management, and collaboration features needed for professional security teams.

Think of KrakenHashes as the control center for your password auditing operations – coordinating multiple machines, managing vast collections of hashes, and providing actionable insights through an intuitive web interface.

Why KrakenHashes?¶

The Challenge with Direct Hashcat Usage¶

Running Hashcat directly presents several challenges for security teams:

• Single Machine Limitation: Hashcat runs on one machine at a time
• Manual Coordination: No built-in way to distribute work across multiple systems
• Limited Visibility: Command-line output makes it hard to track multiple jobs
• No Collaboration: Difficult for teams to share resources and results
• Manual Management: Wordlists, rules, and results require manual organization

The KrakenHashes Solution¶

KrakenHashes addresses these limitations by providing:

• Distributed Processing: Coordinate multiple agents across your infrastructure
• Centralized Management: Single interface for all your cracking operations
• Team Collaboration: Share resources, results, and strategies
• Automated Workflows: Pre-configured attack patterns and job templates
• Enterprise Features: Authentication, authorization, and audit trails

KrakenHashes main dashboard showing the hashlist overview table with crack progress and the jobs management interface with dark theme

Key Features and Capabilities¶

🚀 Distributed Architecture¶

📊 Job Management¶

KrakenHashes transforms password cracking from ad-hoc commands into managed operations:

• Job Templates: Pre-configured attack strategies for common scenarios
• Workflows: Chain multiple attack types for comprehensive audits
• Priority System: Ensure critical jobs get resources first (0-1000 scale)
• Progress Tracking: Real-time visibility into job status and ETA
• Automatic Chunking: Large jobs are split for optimal distribution

🗂️ Resource Organization¶

Centralized management of all cracking resources:

• Wordlist Library: Upload once, use across all agents
• Rule Management: Organize and version your rule files
• Binary Versioning: Ensure all agents run compatible Hashcat versions
• Hash Organization: Group hashes by client, project, or engagement
• Result Storage: Automatic capture and organization of cracked passwords

🔒 Security & Compliance¶

Built with enterprise security requirements in mind:

• Multi-Factor Authentication: TOTP, email, and backup codes
• Role-Based Access: Admin and user roles with granular permissions
• TLS/SSL Support: Multiple certificate options including self-signed
• Audit Logging: Track all actions for compliance requirements
• Data Retention: Configurable policies for automatic cleanup
• Client Isolation: Keep customer data properly segregated

System Architecture¶

graph TB
    subgraph "Web Interface"
        UI[React Frontend]
    end

    subgraph "Backend Services"
        API[REST API]
        WS[WebSocket Hub]
        SCH[Job Scheduler]
        FS[File Storage]
    end

    subgraph "Data Layer"
        PG[(PostgreSQL)]
    end

    subgraph "Agent Pool"
        A1[Agent 1<br/>GPU: RTX 4090]
        A2[Agent 2<br/>GPU: RTX 3080]
        A3[Agent N<br/>CPU Only]
    end

    subgraph "Hashcat"
        HC1[Hashcat Instance]
        HC2[Hashcat Instance]
        HC3[Hashcat Instance]
    end

    UI -->|HTTPS| API
    API --> PG
    API --> FS
    API --> SCH
    SCH --> WS
    WS <-->|WebSocket| A1
    WS <-->|WebSocket| A2
    WS <-->|WebSocket| A3
    A1 --> HC1
    A2 --> HC2
    A3 --> HC3

Component Breakdown¶

Typical Use Cases¶

🔍 Penetration Testing¶

During security assessments, teams often need to:

• Test password strength across multiple client environments
• Maintain separation between different client data
• Generate compliance reports showing password vulnerabilities
• Coordinate efforts across team members

KrakenHashes Solution: Create separate clients for each engagement, assign team members appropriately, and use preset workflows to ensure consistent testing methodology.

🚨 Incident Response¶

When responding to security incidents:

• Time is critical – need results fast
• May have various hash formats from different systems
• Need to document the recovery process
• Multiple analysts working simultaneously

KrakenHashes Solution: Use high-priority jobs to get critical results first, leverage distributed agents for speed, and maintain audit trails for evidence handling.

🔬 Security Research¶

Researchers analyzing password security need:

• Consistent benchmarking across hash types
• Ability to test new attack methodologies
• Performance metrics and statistics
• Reproducible results

KrakenHashes Solution: Built-in benchmarking system, custom workflow creation, detailed metrics collection, and comprehensive result export options.

🏢 Corporate Security Audits¶

Internal security teams conducting password audits require:

• Regular testing of AD password dumps
• Tracking improvement over time
• Executive-friendly reporting
• Automated testing schedules

KrakenHashes Solution: Scheduled jobs, historical tracking, client-based organization for different departments, and retention policies for compliance.

Workflows: Attack Strategy Made Simple¶

One of KrakenHashes' most powerful features is the workflow system. Instead of manually running different Hashcat commands, you can define comprehensive attack strategies:

Example: Standard Password Audit Workflow¶

graph LR
    A[Quick Wins] -->|Found: 40%| B[Common Passwords]
    B -->|Found: 15%| C[Rule-Based Attacks]
    C -->|Found: 20%| D[Hybrid Attacks]
    D -->|Found: 10%| E[Brute Force]

    style A fill:#90EE90
    style B fill:#87CEEB
    style C fill:#FFB6C1
    style D fill:#FFE4B5
    style E fill:#F0E68C

1. Quick Wins - Try the most common passwords first
2. Common Passwords - Test against known breach compilations
3. Rule-Based - Apply transformations to wordlists
4. Hybrid Attacks - Combine wordlists with masks
5. Brute Force - Last resort for remaining hashes

Security Considerations¶

🛡️ Data Protection¶

• All agent communication is encrypted
• Passwords are never logged in plaintext
• Database connections use SSL/TLS
• File transfers are authenticated and encrypted

🔐 Access Control¶

• JWT-based authentication with refresh tokens
• Multi-factor authentication options
• Role-based permissions (Admin/User)
• Secure session management with token validation

📝 Compliance¶

• Comprehensive audit logging
• Data retention policies
• Client data isolation
• Export capabilities for reporting

⚠️ Operational Security¶

Getting Started¶

Ready to deploy KrakenHashes? Here's your path forward:

1. Quick Start Guide - Get running in 5 minutes with Docker
2. Installation Guide - Detailed setup for production
3. First Crack Tutorial - Step-by-step first password recovery
4. User Guide - Learn all features and capabilities

Comparison: KrakenHashes vs Direct Hashcat¶

Next Steps¶

Now that you understand what KrakenHashes offers, choose your next step: