frontpage.
newsnewestaskshowjobs

Made with ♥ by @iamnishanth

Open Source @Github

fp.

Open in hackernews

Show HN: I Dedicated 4 Years to Mastering Offline Password Cracking

48•bojta-lepenye•3h ago
Hi everyone,

I am Bojta Lepenye, and first of all, I want to thank the core developers of Hashcat. In my experience, it is quite literally the most capable tool available for offline password cracking across a wide range of use cases.

I have spent the last 4 years (from age 14 to 18) extensively working with Hashcat and the tools surrounding it, and I have documented what I have learned throughout that time (since January 18, 2022) in my first book. During that period, I also had to continuously update and rewrite major sections as the field evolved. One example was the introduction of GPU support for Argon2 and other memory-hard password hashing algorithms, which significantly changed some cracking workflows.

My passion for this book, or its “quick starter,” if you will, came from an ethically conducted penetration test I performed with full authorization at my school. This is something I am both hesitant and quite proud to acknowledge.

At the beginning, I simply wrote down everything I had learned from YouTube videos and online blogs. However, not long after starting my project, I realized I practically knew nothing about password security, and that small 10 to 15 pages I had written would never be enough if someone was looking for a professional guide to cracking passwords.

The other main driving force behind the book was the fact that while researching online, browsing forums, reading academic papers and white papers, watching videos, exploring blogs, inspecting presentations, and examining infographics, I did not find a single source that comprehensively covers and explains everything one needs to understand about offline password cracking. Literally. Not one.

Therefore, I continued my research and learned about password hashing algorithms, the security properties of hash functions, advanced hash cracking techniques, password analysis, attack optimization, and much, much more.

From the very beginning, I wanted to share this knowledge with the community because having access to a resource like this would have helped me tremendously when I first started learning password cracking.

I sincerely hope this work will be useful to both beginners and experienced professionals alike, and I look forward to hearing your thoughts and feedback.

I have also put together a little video to give you a little sneak peek into it. It is on Google Drive. It is the official domain, and you do not need to download anything. Here it is: https://drive.google.com/file/d/13LeysSZO8Mx-LGKt8UQjUGBKOYH...

If you are interested, the book is now publicly available on Amazon, and can be read for free with a Kindle Unlimited subscription: https://www.amazon.com/dp/B0GX36XRCD

Comments

gabrielsroka•32m ago
Great job. The book is 427 pages.

Why not put the video on YouTube?

raphman•28m ago
Thanks for sharing. This looks interesting. Impressive achievement.

This book is currently not really relevant for me, so I just skimmed the samples on Amazon. I found the technical content to be reasonably accurate and interesting although sometimes a little bit verbose (e.g., the section about 'what is a password') or slightly imprecise. In general, I think this book might have benefited from a thorough copyediting pass. There are quite a few grammar errors and unpolished sentences in the book, e.g.:

> The reason why Linux is imperative is that well, for one, most of the tools we will use, while indeed have builds for other systems, like Windows, in this book we will work with Linux.

Wishing you success and keep on writing!

sijmen•20m ago
Congratulate on finishing such a big project on a complicated topic, and putting in all this effort so that others can learn as well. I enjoyed reading the first few pages on Amazon
andai•13m ago
Congratulations! The book looks great.

I would love to hear more about the process of writing and preparing it for publishing. It's self-published? How did you do the typesetting and the diagrams?

Flipper One – we need your help

https://blog.flipper.net/flipper-one-we-need-your-help/
632•sandebert•5h ago•288 comments

Python 3.15: features that didn't make the headlines

https://blog.changs.co.uk/python-315-features-that-didnt-make-the-headlines.html
189•rbanffy•5h ago•82 comments

We're testing new ad formats in Search and expanding our Direct Offers pilot

https://blog.google/products/ads-commerce/google-marketing-live-search-ads/
437•sofumel•6h ago•364 comments

Michael Keating has died

https://www.bigfinish.com/news/v/michael-keating-1947-2026
38•speckx•1h ago•21 comments

Indexing a year of video locally on a 2021 MacBook with Gemma4-31B (50GB swap)

https://blog.simbastack.com/indexed-a-year-of-video-locally/
49•asenna•2h ago•17 comments

Lost Images from the 1945 Trinity Nuclear Test Restored

https://spectrum.ieee.org/trinity-nuclear-test
125•pseudolus•5h ago•35 comments

Mounting Git commits as folders with NFS

https://jvns.ca/blog/2023/12/04/mounting-git-commits-as-folders-with-nfs/
17•pvtmert•2d ago•4 comments

FatGid: FreeBSD 14.x kernel local privilege escalation

https://fatgid.io/
44•WhyNotHugo•3h ago•11 comments

Google's Antigravity Bait and Switch

https://www.0xsid.com/blog/antigravity-bait-n-switch
232•ssiddharth•2h ago•120 comments

Get your passwords out of Bitwarden while you still can

https://www.osnews.com/story/145029/get-your-passwords-out-of-bitwarden-while-you-still-can/
97•speckx•1h ago•55 comments

AI is just unauthorised plagiarism at a bigger scale

https://axelk.ee/ai-is-just-unauthorised-plagiarism-at-a-bigger-scale/
506•speckx•2h ago•372 comments

GitHub confirms breach of 3,800 repos via malicious VSCode extension

https://www.bleepingcomputer.com/news/security/github-confirms-breach-of-3-800-repos-via-maliciou...
981•Timofeibu•1d ago•424 comments

Show HN: Rmux – A programmable terminal multiplexer with a Playwright-style SDK

https://github.com/helvesec/rmux
136•shideneyu•6h ago•64 comments

Cekura (YC F24) Is Hiring

https://www.ycombinator.com/companies/cekura-ai/jobs/AiWwUxI-forward-deployed-engineer-us
1•atarus•4h ago

Vivaldi 8.0

https://vivaldi.com/blog/vivaldi-on-desktop-8-0/
206•OuterVale•8h ago•137 comments

Who Wins and Who Loses in Prediction Markets? Evidence from Polymarket

https://papers.ssrn.com/sol3/papers.cfm?abstract_id=6443103
62•vcf•3h ago•45 comments

Magic the Gathering format: Fun 40 (2025)

https://fabiensanglard.net/mtg/fun//index.html
44•ibobev•2h ago•36 comments

A Bipartisan Amendment Would End Police License Plate Tracking Nationwide

https://www.wired.com/story/a-bipartisan-amendment-would-end-police-license-plate-tracking-nation...
99•cdrnsf•3h ago•17 comments

Show HN: I Dedicated 4 Years to Mastering Offline Password Cracking

50•bojta-lepenye•3h ago•4 comments

IBM invented semiconductor manufacturing automation

https://spectrum.ieee.org/semiconductor-fabrication
42•rbanffy•5h ago•1 comments

What Do Gödel's Incompleteness Theorems Mean?

https://www.quantamagazine.org/what-do-godels-incompleteness-theorems-truly-mean-20260518/
73•baruchel•2d ago•29 comments

We Reverse-Engineered Docker Sandbox's Undocumented MicroVM API

https://rivet.dev/blog/2026-02-04-we-reverse-engineered-docker-sandbox-undocumented-microvm-api/
7•yakkomajuri•1h ago•0 comments

Show HN: I reverse engineered Apple's video wallpapers

https://github.com/kageroumado/phosphene
366•kageroumado•16h ago•90 comments

No Slop Grenade

https://noslopgrenade.com/
248•napolux•6h ago•146 comments

Flipper One Tech Specs

https://docs.flipper.net/one/general/tech-specs
482•gregsadetsky•21h ago•159 comments

The Letter S, by Donald Knuth (1980) [pdf]

https://gwern.net/doc/design/typography/1980-knuth.pdf
239•bambax•16h ago•43 comments

An OpenAI model has disproved a central conjecture in discrete geometry

https://openai.com/index/model-disproves-discrete-geometry-conjecture/
1320•tedsanders•21h ago•953 comments

Haskell Foundation 2026 Update

https://discourse.haskell.org/t/haskell-foundation-2026-update/14136
158•azhenley•13h ago•54 comments

DOS Zone

https://dos.zone/
317•rglover•17h ago•72 comments

Anthropic is expanding to Colossus2. Will use GB200

https://twitter.com/nottombrown/status/2057194829986300375
262•aurareturn•19h ago•300 comments