Home

Introducing HAT

Note - I am not re-inventing the wheel here, I'm simple using fantastic toolsets that already exist and bringing them together.

The run down of this tool is to allow you to get on with other tasks whilst creds come in.

Imagine the scenario, your running an internal assessment in a Windows based domain environment. You run Responder or similar and gather a few NetNTLMv2 hashes. That's great, but now you need to crack them..

So you startup hashcat, go through the manual put the syntax in and wait... No show.. You then start to think about what permutations might be needed and how the users / admins are thinking about passwords. Try a few wordlists with a few rules... No Show.. This goes on and takes a while finding new rule sets and hoping for something to happen, eventually you get hits back!

What this tool does is try to automate all of this and make life a bit easier, so that you can get on with looking at other avenues.

Once you get your hashes, copy them into the hash_upload directory, and run HAT.

HAT goes through 14 various permutations and testing areas, that can be run individually or automatically one after another. This includes known breach lists, rulesets and wordlists tests commonly found from employees.

Extra functionality, using Rsmangler, looks at using a singular word, such as a firm name or a software package that is listed in the English Oxford dictionary and adds various permutations around the word changing case.

Next we use Cewl also integrated to gather words from a specific site to try to catch a few new passwords in the same as well.

Once a hash is discovered and added into the pot file, a new pot file is created that sorts all of the hashes into a clean alphabetical format so that its easy to see which hashes have been compromised when explaining the findings to management.