Adcs Attacks
ADScanPro/Claude-AD
Active Directory Certificate Services (AD CS) escalation techniques ESC1 through ESC17, driven by hand with Certipy (ly4k).
Guides authorized password-hash recovery with hashcat for security audits, forensic cases and policy testing, starting with an explicit authorization check before any cracking runs.
Install Hashcat Password Recovery Workflow
$ npx skills add AgentSecOps/SecOpsAgentKit --skill crack-hashcat -a claude-codeProject install by default; add -g for ~/.claude/skills/.
$ gh skill install AgentSecOps/SecOpsAgentKit crack-hashcat --agent claude-codeProject scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).
$ git clone --depth 1 https://github.com/AgentSecOps/SecOpsAgentKit.git skills-src && mkdir -p .claude/skills && cp -r skills-src/skills/offsec/crack-hashcat .claude/skills/crack-hashcat && rm -rf skills-srcUse ~/.claude/skills/ instead of .claude/skills for a personal install. The folder must contain SKILL.md.
Claude Code skills documentation · loads skills from .claude/skills/
Install the "crack-hashcat" agent skill from https://github.com/AgentSecOps/SecOpsAgentKit/tree/main/skills/offsec/crack-hashcat into .claude/skills/crack-hashcat/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "crack-hashcat", then confirm the skill loads.Claude Code copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$skill-installer install https://github.com/AgentSecOps/SecOpsAgentKit/tree/main/skills/offsec/crack-hashcatType this inside Codex. $skill-installer <name> installs a curated skill from openai/skills. The installer writes to $CODEX_HOME/skills (default ~/.codex/skills). Restart Codex if the skill does not show up.
$ npx skills add AgentSecOps/SecOpsAgentKit --skill crack-hashcat -a codexProject install goes to .agents/skills/; add -g for ~/.codex/skills/.
$ gh skill install AgentSecOps/SecOpsAgentKit crack-hashcat --agent codexProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/AgentSecOps/SecOpsAgentKit.git skills-src && mkdir -p .agents/skills && cp -r skills-src/skills/offsec/crack-hashcat .agents/skills/crack-hashcat && rm -rf skills-srcUse ~/.agents/skills/ instead of .agents/skills for a personal install.
Codex skills documentation · loads skills from .agents/skills/
Install the "crack-hashcat" agent skill from https://github.com/AgentSecOps/SecOpsAgentKit/tree/main/skills/offsec/crack-hashcat into .agents/skills/crack-hashcat/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "crack-hashcat", then confirm the skill loads.Codex copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ npx skills add AgentSecOps/SecOpsAgentKit --skill crack-hashcat -a cursorProject install goes to .agents/skills/; add -g for ~/.cursor/skills/.
$ gh skill install AgentSecOps/SecOpsAgentKit crack-hashcat --agent cursorProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/AgentSecOps/SecOpsAgentKit.git skills-src && mkdir -p .cursor/skills && cp -r skills-src/skills/offsec/crack-hashcat .cursor/skills/crack-hashcat && rm -rf skills-srcUse ~/.cursor/skills/ instead of .cursor/skills for a personal install.
Cursor skills documentation · loads skills from .cursor/skills/, .agents/skills/, .claude/skills/, .codex/skills/
Install the "crack-hashcat" agent skill from https://github.com/AgentSecOps/SecOpsAgentKit/tree/main/skills/offsec/crack-hashcat into .cursor/skills/crack-hashcat/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "crack-hashcat", then confirm the skill loads.Cursor copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ gemini skills install https://github.com/AgentSecOps/SecOpsAgentKit.git --path skills/offsec/crack-hashcat--scope user (default) or --scope workspace; --path is the subfolder of the repo that holds the skill; --consent skips the security confirmation prompt.
$ npx skills add AgentSecOps/SecOpsAgentKit --skill crack-hashcat -a gemini-cliProject install goes to .agents/skills/; add -g for ~/.gemini/skills/.
$ gh skill install AgentSecOps/SecOpsAgentKit crack-hashcat --agent gemini-cliProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/AgentSecOps/SecOpsAgentKit.git skills-src && mkdir -p .gemini/skills && cp -r skills-src/skills/offsec/crack-hashcat .gemini/skills/crack-hashcat && rm -rf skills-srcUse ~/.gemini/skills/ instead of .gemini/skills for a personal install, then run /skills reload.
Gemini CLI skills documentation · loads skills from .gemini/skills/, .agents/skills/
Install the "crack-hashcat" agent skill from https://github.com/AgentSecOps/SecOpsAgentKit/tree/main/skills/offsec/crack-hashcat into .gemini/skills/crack-hashcat/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "crack-hashcat", then confirm the skill loads.Gemini CLI copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ gh skill install AgentSecOps/SecOpsAgentKit crack-hashcatInstalls for Copilot at project scope by default; add --scope user for a personal install. Preview a skill first with gh skill preview. Needs GitHub CLI 2.90.0 or later (public preview).
$ npx skills add AgentSecOps/SecOpsAgentKit --skill crack-hashcat -a github-copilotProject install goes to .agents/skills/; add -g for ~/.copilot/skills/.
$ git clone --depth 1 https://github.com/AgentSecOps/SecOpsAgentKit.git skills-src && mkdir -p .github/skills && cp -r skills-src/skills/offsec/crack-hashcat .github/skills/crack-hashcat && rm -rf skills-srcUse ~/.copilot/skills/ instead of .github/skills for a personal install. Commit .github/skills so cloud agent and code review can use it.
GitHub Copilot skills documentation · loads skills from .github/skills/, .claude/skills/, .agents/skills/
Install the "crack-hashcat" agent skill from https://github.com/AgentSecOps/SecOpsAgentKit/tree/main/skills/offsec/crack-hashcat into .github/skills/crack-hashcat/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "crack-hashcat", then confirm the skill loads.GitHub Copilot copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ npx skills add AgentSecOps/SecOpsAgentKit --skill crack-hashcat -a opencodeOpenCode documents no install command of its own. Project install goes to .agents/skills/; add -g for ~/.config/opencode/skills/.
$ gh skill install AgentSecOps/SecOpsAgentKit crack-hashcat --agent opencodeProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/AgentSecOps/SecOpsAgentKit.git skills-src && mkdir -p .opencode/skills && cp -r skills-src/skills/offsec/crack-hashcat .opencode/skills/crack-hashcat && rm -rf skills-srcUse ~/.config/opencode/skills/ instead of .opencode/skills for a personal install.
OpenCode skills documentation · loads skills from .opencode/skills/, .claude/skills/, .agents/skills/
Install the "crack-hashcat" agent skill from https://github.com/AgentSecOps/SecOpsAgentKit/tree/main/skills/offsec/crack-hashcat into .opencode/skills/crack-hashcat/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "crack-hashcat", then confirm the skill loads.OpenCode copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
Facts
- Skill name
crack-hashcat- GitHub stars
- 219
- Used in
- 1 other repo
- Token cost
- ~3.3k tokens
- SKILL.md length
- 596 words
- Files
- 6 (incl. references, assets)
- Skills in repo
- 24
- Repo updated
- First seen
- Licence
- Custom licence
At a glance
Guides authorized password-hash recovery with hashcat for security audits, forensic cases and policy testing, starting with an explicit authorization check before any cracking runs.
- Works in 8 steps: Authorization Verification → Hash Identification → Hash File Preparation → …
- Running an authorized password policy audit that needs to show how weak passwords really are
- SKILL.md covers Overview, Quick Start, Core Workflow and Security Considerations, plus 3 more sections
- Instructions only: no scripts, shell commands, URLs or credentials in SKILL.md
What it does
This skill wraps hashcat, described as supporting hundreds of hash algorithms and several attack approaches, into a checklist aimed at people who already have the right to crack the hashes in front of them: a security auditor testing password policy strength, a forensic investigator recovering a password from a captured hash under a documented chain of custody, or a researcher validating an encryption implementation. It states plainly that cracking a hash without authorization is illegal and makes verifying that authorization, in writing, the first step of its workflow, before any hash is even identified.
The rest of the checklist follows in order: identify the hash algorithm, prepare the hash file and wordlists, choose an attack approach suited to the case, run the operation, analyze what was recovered, document any password-policy weakness it reveals for a report, and finally delete the hash files and results securely rather than leaving them on disk. A references folder includes a worked example and a workflow checklist, and asset templates cover a CI configuration and a cracking-rule file for repeatable use in an audit pipeline.
The skill frames its output as evidence for a penetration-testing report or a policy review, not as an end in itself, and keeps secure handling and deletion of recovered credentials as an explicit, required step rather than an afterthought.
When your agent uses it
- Running an authorized password policy audit that needs to show how weak passwords really are
- Recovering a password from a hash in a forensic investigation with documented authorization
- Validating that an application's password hashing is implemented as intended
- Writing a penetration test report section on password weaknesses
Example prompts
- “We have written authorization to audit this client's password hashes. Walk me through the checklist.”
- “Help me document the chain of custody before we start recovering this forensic password hash.”
- “Explain which attack approach fits a policy audit where we only need to prove passwords are weak.”
- “Once we're done, walk me through securely deleting the hash files and results.”
Requirements
- hashcat installed, ideally with GPU acceleration
- Written authorization to crack the hashes in scope
Workflow steps
8 steps, taken from the step headings in SKILL.md.
- Authorization Verification
- Hash Identification
- Hash File Preparation
- Attack Modes
- Performance Optimization
- Rules and Mutations
- Session Management
- Results and Reporting
What it can do on your machine
Read from SKILL.md and the folder at commit 6e25a4b. It shows what the files ask for, not the result of running them.
Tool permissions
Pre-approves nothing: there is no allowed-tools line, so your agent's usual permission prompts apply.
From allowed-tools in the SKILL.md frontmatter.
Runs code
No scripts in the folder and no shell commands in SKILL.md (its code samples are bash).
From the folder's file list and the shell code blocks in SKILL.md.
Network
Links to these hosts (documentation or services it may open):
hashcat.netattack.mitre.orgpages.nist.govcheatsheetseries.owasp.org
From URLs in SKILL.md, links to its own repository left out.
Credentials
Names no API keys, tokens, secrets or passwords.
From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.
Context cost
Hashcat Password Recovery Workflow loads about 3.3k tokens when it runs, and up to ~9.4k if it reads all its reference files. Until then it costs about 124 tokens; SKILL.md has 596 words of instructions outside code blocks.
Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.
Safety
Auto-check: notes
The automated check noted patterns worth knowing about, such as sudo or a known installer.
- NoteRuns commands with sudoSKILL.md:120
sudo cat /etc/shadow | grep -v "^#" | grep -v ":\*:" | grep -v ":!:" > shadow_hashes.txt - NoteRuns commands with sudoSKILL.md:342
sudo unshadow /etc/passwd /etc/shadow > linux_hashes.txt
Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); files beside SKILL.md are not scanned.
SKILL.md
Its licence (Custom licence) doesn't allow us to republish the file, so here is its outline and opening line. It has 596 words (~3,343 tokens).
“Hashcat is the world's fastest password recovery tool, supporting over 300 hash algorithms and multiple attack modes. This skill covers authorized password auditing, forensic password recovery, and security research applications.”
- name
- crack-hashcat
- version
- 0.1.0
- maintainer
- sirappsec@gmail.com
- category
- offsec
- tags
- password-cracking, hashcat, forensics, password-audit, cryptography
- frameworks
- MITRE-ATT&CK, NIST
- dependencies.packages
- hashcat
- dependencies.tools
- opencl, cuda
- references
- https://hashcat.net/wiki/, https://hashcat.net/hashcat/, https://attack.mitre.org/techniques/T1110/
Files
SKILL.md and 5 other files (references, assets) in skills/offsec/crack-hashcat of AgentSecOps/SecOpsAgentKit.
- SKILL.md
- assets/.gitkeep
- assets/ci-config-template.yml
- assets/rule-template.yaml
- references/EXAMPLE.md
- references/WORKFLOW_CHECKLIST.md
Open the folder on GitHubat commit 6e25a4b
Used in 1 other repository
We found 1 copy of this SKILL.md (exact, near-identical or edited) in other folders, from 1 other GitHub owner. This page covers the copy in AgentSecOps/SecOpsAgentKit, which our catalogue first saw on October 7, 2026.
Compare with similar skills
Hashcat Password Recovery Workflow next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.
| Skill | Stars | Used in | Tokens | Auto-check | Licence | Repo updated |
|---|---|---|---|---|---|---|
| Hashcat Password Recovery Workflow this skillAgentSecOps/SecOpsAgentKit | 219 | 1 repos | ~3.3k | Automated safety check: Notes | Custom licence | |
| Adcs AttacksADScanPro/Claude-AD | 209 | — | ~3.6k | Automated safety check: Pass | MIT | |
| Senior Securitydavila7/claude-code-templates | 32k | 2 repos | ~1.1k | Automated safety check: Notes | MIT | |
| Cryptographytransilienceai/communitytools | 559 | — | ~465 | Automated safety check: Pass | MIT | |
| API Security EngineerFerroxLabs/wayland | 608 | — | ~3.1k | Automated safety check: Pass | Apache-2.0 | |
| Bom Explorecdxgen/cdxgen | 1.1k | — | ~1.2k | Automated safety check: Pass | Apache-2.0 |
Similar skills
Senior Security
davila7/claude-code-templates
Comprehensive security engineering skill for application security, penetration testing, security architecture, and compliance auditing.
Cryptography
transilienceai/communitytools
Cryptanalysis techniques — lattice attacks, padding oracles, weak-RNG exploitation, signature forgery, secret-sharing recovery.
API Security Engineer
FerroxLabs/wayland
API security expertise covering OWASP API Security Top 10, API authentication and authorization patterns, API key management, rate limiting and throttling, JWT security best practices, OAuth 2.0…
Bom Explore
cdxgen/cdxgen
Explores and triages a CycloneDX BOM interactively with the cdxi REPL, using built-in commands for dependency trees, licenses, services, cryptographic assets, audit findings, evidence occurrences…
Webcrypt MCP
putervision/state-memory-mcp
Teaches the agent to use the WebCrypt MCP server for AES-256-GCM symmetric encryption, RSA-4096 hybrid encryption, key generation, digital signatures, hashing, and post-quantum cryptography.
More from AgentSecOps/SecOpsAgentKit
All 24 skills in this repoSast Semgrep
AgentSecOps/SecOpsAgentKit
Static application security testing (SAST) using Semgrep for vulnerability detection, security code review, and secure coding guidance with OWASP and CWE framework mapping.
Secrets Gitleaks
AgentSecOps/SecOpsAgentKit
Hardcoded secret detection and prevention in git repositories and codebases using Gitleaks.
DefectDojo Vulnerability Management
AgentSecOps/SecOpsAgentKit
Aggregates scanner results into DefectDojo, deduplicates findings, tracks remediation SLAs and prepares compliance reports across products and pipelines.
TShark Traffic Analysis
AgentSecOps/SecOpsAgentKit
Guides authorized packet capture and analysis with TShark, Wireshark's command-line tool, for security investigations, malware detection and forensic examination of network traffic.
Container Scanning with Grype
AgentSecOps/SecOpsAgentKit
Scans container images, filesystems and SBOMs with Grype for known vulnerabilities, ranks them by CVSS, EPSS and CISA KEV, and wires scans into CI/CD thresholds.
Hadolint Dockerfile Security Linting
AgentSecOps/SecOpsAgentKit
Lints Dockerfiles with Hadolint for security misconfigurations and best-practice violations, locally and in CI, with strict, balanced and permissive rule templates.
Related
Categories
Questions about Hashcat Password Recovery Workflow
What does Hashcat Password Recovery Workflow do?
Guides authorized password-hash recovery with hashcat for security audits, forensic cases and policy testing, starting with an explicit authorization check before any cracking runs. This skill wraps hashcat, described as supporting hundreds of hash algorithms and several attack approaches, into a checklist aimed at people who already have the right to crack the hashes in front of them: a security auditor testing password policy strength, a forensic investigator recovering a password from a captured hash under a documented chain of custody, or a researcher validating an encryption implementation. It states plainly that cracking a hash without authorization is illegal and makes verifying that authorization, in writing, the first step of its workflow, before any hash is even identified.
When should I use Hashcat Password Recovery Workflow?
Hashcat Password Recovery Workflow fits situations like: running an authorized password policy audit that needs to show how weak passwords really are; recovering a password from a hash in a forensic investigation with documented authorization; validating that an application's password hashing is implemented as intended; writing a penetration test report section on password weaknesses.
How do I install Hashcat Password Recovery Workflow in Claude Code?
Run `npx skills add AgentSecOps/SecOpsAgentKit --skill crack-hashcat -a claude-code`. Or copy the skill folder (skills/offsec/crack-hashcat in AgentSecOps/SecOpsAgentKit) into .claude/skills/crack-hashcat in your project. Claude Code loads it when a task matches its description.
How do I install Hashcat Password Recovery Workflow in Codex?
Run `npx skills add AgentSecOps/SecOpsAgentKit --skill crack-hashcat -a codex`. Or copy the skill folder (skills/offsec/crack-hashcat in AgentSecOps/SecOpsAgentKit) into .agents/skills/crack-hashcat in your project. Codex loads it when a task matches its description.
Can I use Hashcat Password Recovery Workflow in Cursor, Gemini CLI or GitHub Copilot?
Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add AgentSecOps/SecOpsAgentKit --skill crack-hashcat -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/crack-hashcat, .gemini/skills/crack-hashcat, .github/skills/crack-hashcat and .opencode/skills/crack-hashcat in your project.
What does Hashcat Password Recovery Workflow need to run?
SKILL.md names no scripts, command-line tools or credentials: Hashcat Password Recovery Workflow is instructions for the agent only. Our summary lists: hashcat installed, ideally with GPU acceleration; Written authorization to crack the hashes in scope.
Does Hashcat Password Recovery Workflow access the network?
SKILL.md names 4 domains. As links in the text: hashcat.net, attack.mitre.org, pages.nist.gov and cheatsheetseries.owasp.org. This is read from the text; nothing was executed.
Is Hashcat Password Recovery Workflow safe to install?
Our automated static check of SKILL.md found notes only (runs commands with sudo), nothing it rates as a warning. It is not a guarantee. Review the folder before installing.
What licence does Hashcat Password Recovery Workflow use?
Hashcat Password Recovery Workflow has a licence file (the repository's licence) that doesn't match a standard licence. Read it on GitHub before reusing the skill.
How many tokens does Hashcat Password Recovery Workflow use?
About 3.3k tokens (SKILL.md is roughly 13k characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full. Its references folder adds about 6k tokens, read only when the agent opens those files.
What are the alternatives to Hashcat Password Recovery Workflow?
Skills that share tags, products or a category with Hashcat Password Recovery Workflow: Adcs Attacks (ADScanPro/Claude-AD, 209 stars), Senior Security (davila7/claude-code-templates, 32k stars), Cryptography (transilienceai/communitytools, 559 stars) and API Security Engineer (FerroxLabs/wayland, 608 stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.
Who maintains Hashcat Password Recovery Workflow?
AgentSecOps (a GitHub organization) maintains it in AgentSecOps/SecOpsAgentKit, which has 219 GitHub stars. The repository holds 24 skills in this directory. The repository was last updated on April 15, 2026.
Source: AgentSecOps/SecOpsAgentKit on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.