gitea-mirror/hate_crack
1
0
Fork 0
mirror of https://github.com/trustedsec/hate_crack.git synced 2026-07-28 14:47:22 -07:00
Code Issues Packages Projects Releases Wiki Activity

docs: record UI polish and LLM mode additions under 2.12.0

Browse Source 
2.12.0 is not yet tagged (latest tag is v2.11.4), so this work folds into that
entry rather than cutting a new version.

Co-Authored-By: Claude <noreply@anthropic.com>
This commit is contained in:
Justin Bollinger
2026-07-24 18:53:39 -04:00
co-authored by Claude
parent a751342744
commit 119dc29da4
1 changed files with 28 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
CHANGELOG.md
+28
View File
@@ -22,9 +22,37 @@ Dates are omitted for releases predating this file; see the git tags for exact t
- **Wordlist (denylist) generation mode** for the LLM attack is now reachable from the - **Wordlist (denylist) generation mode** for the LLM attack is now reachable from the
menu: select the LLM attack (option 12), then choose "Wordlist" to derive basewords from menu: select the LLM attack (option 12), then choose "Wordlist" to derive basewords from
a sample wordlist. a sample wordlist.
- **Cracked-password generation mode** for the LLM attack. Once a session has recovered
plaintexts, option 3 feeds them back to the model, which infers the organization's own
password conventions and generates new candidates in that style. Offered only when
`<hashfile>.out` has content, and it uses a dedicated prompt that tells the model not to
re-emit passwords already cracked.
- **Target research pre-fills the industry and location prompts.** In target mode, entering
the company name asks the local model to recall that organization's industry and location,
then offers them as editable defaults (Enter accepts, typing overrides). Values are
labelled as model guesses rather than verified OSINT, whitespace-collapsed, and capped at
80 characters. Research runs entirely against the configured local Ollama server, so the
client name is never sent to a third party. Any failure or timeout falls back to blank
prompts and never blocks the attack. Disable with `ollamaAutoResearch: false`.
- **Live progress spinner** with an elapsed-seconds counter during Ollama generation, so a
model loading into VRAM is distinguishable from a hang. Automatically suppressed when
stdout is not a TTY.
- **`ollamaMaxSampleLines`** (default 500) caps how many sample passwords are sent to the
model, for both wordlist and cracked-password modes.
### Fixed ### Fixed
- **A large sample wordlist no longer stalls the LLM attack.** Wordlist mode read every line
into memory and pasted all of them into the prompt, so pointing it at `rockyou.txt`
materialized hundreds of megabytes and overran the model's context window — which looked
like a hang. The file is now streamed and evenly sampled across its whole length, and the
count actually used is reported (`Sampled 500 of 14,344,391 passwords from wordlist.`).
- **`HATE_CRACK_ARROW_MENU=1` now works in the LLM and OMEN submenus.** They hand-rolled
`print()` + `input()` instead of the shared menu helper, so arrow-key navigation silently
did nothing there.
- **A typo in a wordlist or generation-mode prompt no longer aborts the whole attack.** The
pickers and submenus re-prompt instead of dropping back to the main menu, and offer an
explicit cancel.
- **The LLM attack no longer hangs forever waiting on Ollama.** Generation requests are now - **The LLM attack no longer hangs forever waiting on Ollama.** Generation requests are now
bounded by a configurable timeout (`ollamaTimeout` in `config.json`, default 300 seconds). bounded by a configurable timeout (`ollamaTimeout` in `config.json`, default 300 seconds).
Previously, if Ollama accepted the connection but never replied — most commonly a large Previously, if Ollama accepted the connection but never replied — most commonly a large