From 8ee36d0eabf9ba2348c9512e9fe8f0e7ce4c934e Mon Sep 17 00:00:00 2001 From: Justin Bollinger Date: Tue, 21 Jul 2026 18:16:32 -0400 Subject: [PATCH] docs: move version history from README into CHANGELOG.md Consolidate the release notes into a single dedicated CHANGELOG.md (Keep a Changelog format) and replace the README's inline Version History with a pointer, so the two no longer drift. Co-Authored-By: Claude Opus 4.8 --- CHANGELOG.md | 125 +++++++++++++++++++++++++++++++++++++++++++++++++++ README.md | 102 +---------------------------------------- 2 files changed, 126 insertions(+), 101 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 3049ae8..0c48d04 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -5,6 +5,8 @@ All notable changes to this project are documented here. The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html). +Dates are omitted for releases predating this file; see the git tags for exact timing. + ## [2.10.8] - 2026-07-21 ### Fixed @@ -29,3 +31,126 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0 on the fly, so downloads are decompressed before saving — the resulting file is usable directly with `hashcat -r`. Exposed via the interactive Hashview menu ("Download Rule") and the CLI: `hate_crack.py --hashview download-rules --rules-id [--output ]`. + +## [2.10.7] + +- Auto-upgrade (`hate_crack --update` / the in-menu upgrade) now survives the historical `master` → `main` default-branch rename. Old clones made before the rename sit on a local `master` whose upstream (`branch.master.merge`) still points at the now-deleted `refs/heads/master`, so a bare `git pull` failed with "Your configuration specifies to merge with the ref 'refs/heads/master' from the remote, but no such ref was fetched" — and `_run_upgrade()`'s `git checkout main` also failed on stale clones that had never fetched `origin/main`. The updater now fetches from `origin` *before* switching branches, checks out `main` via `git checkout -B main origin/main` (creating/resetting it from the remote regardless of local state), repairs the upstream with `git branch --set-upstream-to=origin/main main` so future manual `git pull`s work too, and pulls explicitly with `git pull origin main` so it never consults the dangling `branch.*.merge` config. Existing safety guards (dirty-branch bail, detached-HEAD skip) are unchanged. + +## [2.10.6] + +- Fixed the Hashview integration calling API routes that don't exist in Hashview (verified against v0.8.3-dev), which 404'd as soon as a customer ID was entered ("Could not list hashfiles"). The customer→hashfile listing relied on a phantom `GET /v1/hashfiles` list-all route; it now enumerates via the real `GET /v1/hashfiles/hash_type/` endpoint where available — the download flow sweeps common hashcat modes to display a customer's uploaded hashfiles. That listing route only exists on Hashview builds from 2026-06-08+ (the `v0.8.3-dev` branch); on `main`/older servers there is no hashfile-listing API at all, so the flow now degrades gracefully to entering the hashfile ID directly (looked up in the Hashview web UI) and resolving its type via `GET /v1/getHashType/`. Additional client-side route fixes: hashfile hash-type lookup now uses `GET /v1/getHashType/`; "left" (uncracked) hash download uses `GET /v1/hashfiles/`; `delete_job` uses `DELETE /v1/jobs/`; `start_job` uses `POST`. Hashview exposes no stop-job route, so `stop_job` now raises with guidance to use `delete_job`; and no bulk cracked-hash export exists, so the best-effort "found" merge degrades gracefully. +- The Hashview CLI now honours `HASHVIEW_URL` / `HASHVIEW_API_KEY` environment variables as overrides for the `config.json` values, so the client can be pointed at a different Hashview instance (e.g. a local dev stack) without editing the persisted config. +- Added an opt-in local Hashview integration-test harness: `HASHVIEW_TEST_LOCAL=1` (with `HASHVIEW_REPO=`) spins up and seeds a local Hashview docker stack, runs the live Hashview tests against it, and tears it down (`HASHVIEW_KEEP=1` keeps it). This is what surfaced and verified the route fixes above against `v0.8.3-dev`. See the README testing section for details. + +## [2.10.5] + +- Pipal analysis no longer corrupts its input when cracked passwords contain `$HEX[...]` rows. `binascii.unhexlify().decode()` returned the bytes without the trailing newline that normal rows inherit from `password[-1]`, so every HEX-encoded password got concatenated with the next one in the `.passwords` file fed to pipal (e.g. three cracks → two lines, one of them a bogus mashup). Pipal then under-counted entries and reported wrong top base words. The HEX branch now re-appends `\n` so each cracked password lands on its own line. + +## [2.10.4] + +- Pushover notifications fire correctly for Quick Crack, Loopback, Combinator, PRINCE-LING, and N-gram attacks (#110). The handlers prompted the user under one name (e.g. "Quick Crack") while the underlying hashcat wrapper passed a different `attack_name` to `_should_fire` ("Quick Dictionary"), so the per-run consent lookup always missed. The prompt name now flows down to `_run_hcat_cmd` for both the job-done summary and the per-crack tailer. + +## [2.10.3] + +- Auto-upgrade no longer loops infinitely when invoked from a non-main branch (e.g. `dev`). Release tags live on main-side merge commits, so `git pull` on `dev` was a no-op and setuptools-scm kept regenerating the version as `X.Y.Z.postN.devM` — the update check then re-fired forever. `_run_upgrade()` now switches to `main` before pulling, with safety guards: refuses to clobber uncommitted work, surfaces clear errors when `main` is checked out in another worktree, and leaves detached-HEAD checkouts untouched. + +## [2.10.2] + +- Fingerprint Attack no longer launches hashcat against empty wordlists when no candidates exist; prints a "no candidates to expand" message and skips the attack (plus the secondary hybrid pass that previously fired six wasted hashcat sessions). +- Forced `LC_ALL=C` on every `sort -u` subprocess (fingerprint expander pipeline, `_write_field_sorted_unique`, LM-to-NT combinator dedupe) — fixes "sort: Illegal byte sequence" on macOS when cracked passwords contain non-UTF-8 bytes, which was silently emptying the fingerprint candidate list. + +## [2.10.1] + +- Bumped `HashcatRosetta` submodule to v0.2.0, dropping a vulnerable transitive `pytest` (< 9.0.3, GHSA tmpdir handling) from its requirements. +- Added `click>=8.0.0` to runtime dependencies (now required by HashcatRosetta v0.2.0's formatting module). + +## [2.9.3] + +- Transmission daemon now watches `/tmp/hate_crack/` for new `.torrent` files; wordlist content still downloads to the configured wordlist directory. +- Suppressed `transmission-daemon` stdout/stderr so daemon log output no longer appears in the terminal. +- Increased watch-dir polling window to 30s to account for transmission's ~10s scan interval. +- Store downloaded `.torrent` files in `/tmp/hate_crack/` instead of `/tmp/` root. + +## [2.5.0] + +- Added tab autocomplete to all file and directory path prompts in the Wordlist Tools submenu (option 80). +- Restored `hcatOptimizedWordlists` config key (directory for pre-optimized wordlists); defaults to `./optimized_wordlists`, falls back to `hcatWordlists` if not found. +- Quick Crack now defaults to `hcatOptimizedWordlists` instead of `hcatWordlists`. + +## [2.0+] + +- Added Random Rules Attack (option 20) using `generate-rules.bin` to generate random mutation rules (#87). +- Added Ad-hoc Mask Attack (option 17) for user-typed hashcat masks with optional custom character sets. +- Added Markov Brute Force Attack (option 18) using `hcstat2` statistical tables for password generation. +- Consolidated Combinator Attacks (formerly options 10/11/12) into interactive submenu under option 6. +- Markov attack supports training from cracked passwords or any wordlist, with table reuse/regeneration menu. +- Fixed OMEN attack failing silently when model files were incomplete or enumNG errors occurred. +- OMEN attack now validates all 5 required model files, captures enumNG stderr, and provides a train/use/cancel menu with wordlist picker. +- Filtered `.7z`, `.torrent`, and `.out` files from wordlist selection menus (#80). +- Parallelized Hashmob rule downloads using a thread pool with success/failure summary (#81). +- Added dynamic optimized kernel (`-O`) flag per attack type via `optimizedKernelAttacks` config (#82). +- Replaced `uv tool install` with a bash shim for reliable config and asset resolution from any working directory. +- Fixed config resolution to search the repo root and package directory in addition to CWD. +- Fixed bare NTLM hash detection failing when hash files contain leading blank lines, BOM characters, or null bytes from UTF-16 encoding. +- Improved error message for unrecognized hash formats to show the actual first-line content and list expected formats. +- Fixed rule file path construction in Quick Crack and Loopback Attack using `os.path.join()` instead of string concatenation. +- Added automatic update checks on startup (check_for_updates config option). +- Added `packaging` dependency for version comparison. +- Added OMEN Attack (option 16) using statistical model-based password generation. +- Added OMEN configuration keys (omenTrainingList, omenMaxCandidates). +- Added LLM Attack (option 15) using Ollama for AI-generated password candidates. +- Added Ollama configuration keys (ollamaModel, ollamaNumCtx). +- Auto-versioning via setuptools-scm from git tags. + +## [2.0] + +- Modularized codebase into CLI/API/attacks modules. +- Unified CLI options with config overrides (hashview, hashcat, wordlists, pipal). +- Added Hashview API integration. +- Added Weakpass torrent download helpers and Hashmob download wrapper. +- Improved test coverage and snapshot-based menu validation. +- Updated documentation and versioning. + +## [1.9] + +- Revamped the hate_crack output to increase processing speed exponentially; `combine_ntlm_output` function for combining. +- Introducing new attack mode "Bandrel Methodology". +- Updated pipal function to output top x number of basewords. + +## [1.08] + +- Added a Pipal menu option to analyze hashes. https://github.com/digininja/pipal + +## [1.07] + +- Minor bug fixes with pwdump formatting and unhexify function. + +## [1.06] + +- Updated the quick crack and recycling functions to use user-customizable rules. + +## [1.05] + +- Abstraction of rockyou.txt so that you can use whatever dictionary you would like, specified in the config.json. +- Minor change to quickcrack that allows you to specify 0 for the number of times best64 is chained. + +## [1.04] + +- Two new attacks: Middle Combinator and Thorough Combinator. + +## [1.03] + +- Introduction of new feature to use session files for multiple concurrent sessions of hate_crack. +- Minor bug fix. + +## [1.02] + +- Introduction of new feature to export the output of pwdump-formatted NTDS outputs to Excel with clear-text passwords. + +## [1.01] + +- Minor bug fixes. + +## [1.00] + +- Initial public release. diff --git a/README.md b/README.md index 87a1373..0c0d322 100644 --- a/README.md +++ b/README.md @@ -943,104 +943,4 @@ Interactive menu for downloading and managing wordlists from Weakpass.com via Bi ------------------------------------------------------------------- ### Version History -Version 2.10.7 - - Auto-upgrade (`hate_crack --update` / the in-menu upgrade) now survives the historical `master` → `main` default-branch rename. Old clones made before the rename sit on a local `master` whose upstream (`branch.master.merge`) still points at the now-deleted `refs/heads/master`, so a bare `git pull` failed with "Your configuration specifies to merge with the ref 'refs/heads/master' from the remote, but no such ref was fetched" — and `_run_upgrade()`'s `git checkout main` also failed on stale clones that had never fetched `origin/main`. The updater now fetches from `origin` *before* switching branches, checks out `main` via `git checkout -B main origin/main` (creating/resetting it from the remote regardless of local state), repairs the upstream with `git branch --set-upstream-to=origin/main main` so future manual `git pull`s work too, and pulls explicitly with `git pull origin main` so it never consults the dangling `branch.*.merge` config. Existing safety guards (dirty-branch bail, detached-HEAD skip) are unchanged - -Version 2.10.6 - - Fixed the Hashview integration calling API routes that don't exist in Hashview (verified against v0.8.3-dev), which 404'd as soon as a customer ID was entered ("Could not list hashfiles"). The customer→hashfile listing relied on a phantom `GET /v1/hashfiles` list-all route; it now enumerates via the real `GET /v1/hashfiles/hash_type/` endpoint where available — the download flow sweeps common hashcat modes to display a customer's uploaded hashfiles. That listing route only exists on Hashview builds from 2026-06-08+ (the `v0.8.3-dev` branch); on `main`/older servers there is no hashfile-listing API at all, so the flow now degrades gracefully to entering the hashfile ID directly (looked up in the Hashview web UI) and resolving its type via `GET /v1/getHashType/`. Additional client-side route fixes: hashfile hash-type lookup now uses `GET /v1/getHashType/`; "left" (uncracked) hash download uses `GET /v1/hashfiles/`; `delete_job` uses `DELETE /v1/jobs/`; `start_job` uses `POST`. Hashview exposes no stop-job route, so `stop_job` now raises with guidance to use `delete_job`; and no bulk cracked-hash export exists, so the best-effort "found" merge degrades gracefully - - The Hashview CLI now honours `HASHVIEW_URL` / `HASHVIEW_API_KEY` environment variables as overrides for the `config.json` values, so the client can be pointed at a different Hashview instance (e.g. a local dev stack) without editing the persisted config - - Added an opt-in local Hashview integration-test harness: `HASHVIEW_TEST_LOCAL=1` (with `HASHVIEW_REPO=`) spins up and seeds a local Hashview docker stack, runs the live Hashview tests against it, and tears it down (`HASHVIEW_KEEP=1` keeps it). This is what surfaced and verified the route fixes above against `v0.8.3-dev`. See the README testing section for details - -Version 2.10.5 - - Pipal analysis no longer corrupts its input when cracked passwords contain `$HEX[...]` rows. `binascii.unhexlify().decode()` returned the bytes without the trailing newline that normal rows inherit from `password[-1]`, so every HEX-encoded password got concatenated with the next one in the `.passwords` file fed to pipal (e.g. three cracks → two lines, one of them a bogus mashup). Pipal then under-counted entries and reported wrong top base words. The HEX branch now re-appends `\n` so each cracked password lands on its own line - -Version 2.10.4 - - Pushover notifications fire correctly for Quick Crack, Loopback, Combinator, PRINCE-LING, and N-gram attacks (#110). The handlers prompted the user under one name (e.g. "Quick Crack") while the underlying hashcat wrapper passed a different `attack_name` to `_should_fire` ("Quick Dictionary"), so the per-run consent lookup always missed. The prompt name now flows down to `_run_hcat_cmd` for both the job-done summary and the per-crack tailer - -Version 2.10.3 - - Auto-upgrade no longer loops infinitely when invoked from a non-main branch (e.g. `dev`). Release tags live on main-side merge commits, so `git pull` on `dev` was a no-op and setuptools-scm kept regenerating the version as `X.Y.Z.postN.devM` — the update check then re-fired forever. `_run_upgrade()` now switches to `main` before pulling, with safety guards: refuses to clobber uncommitted work, surfaces clear errors when `main` is checked out in another worktree, and leaves detached-HEAD checkouts untouched - -Version 2.10.2 - - Fingerprint Attack no longer launches hashcat against empty wordlists when no candidates exist; prints a "no candidates to expand" message and skips the attack (plus the secondary hybrid pass that previously fired six wasted hashcat sessions) - - Forced `LC_ALL=C` on every `sort -u` subprocess (fingerprint expander pipeline, `_write_field_sorted_unique`, LM-to-NT combinator dedupe) — fixes "sort: Illegal byte sequence" on macOS when cracked passwords contain non-UTF-8 bytes, which was silently emptying the fingerprint candidate list - -Version 2.10.1 - - Bumped `HashcatRosetta` submodule to v0.2.0, dropping a vulnerable transitive `pytest` (< 9.0.3, GHSA tmpdir handling) from its requirements - - Added `click>=8.0.0` to runtime dependencies (now required by HashcatRosetta v0.2.0's formatting module) - -Version 2.9.3 - - Transmission daemon now watches `/tmp/hate_crack/` for new `.torrent` files; wordlist content still downloads to the configured wordlist directory - - Suppressed `transmission-daemon` stdout/stderr so daemon log output no longer appears in the terminal - - Increased watch-dir polling window to 30s to account for transmission's ~10s scan interval - - Store downloaded `.torrent` files in `/tmp/hate_crack/` instead of `/tmp/` root - -Version 2.5.0 - - Added tab autocomplete to all file and directory path prompts in the Wordlist Tools submenu (option 80) - - Restored `hcatOptimizedWordlists` config key (directory for pre-optimized wordlists); defaults to `./optimized_wordlists`, falls back to `hcatWordlists` if not found - - Quick Crack now defaults to `hcatOptimizedWordlists` instead of `hcatWordlists` - -Version 2.0+ - - Added Random Rules Attack (option 20) using `generate-rules.bin` to generate random mutation rules (#87) - - Added Ad-hoc Mask Attack (option 17) for user-typed hashcat masks with optional custom character sets - - Added Markov Brute Force Attack (option 18) using `hcstat2` statistical tables for password generation - - Consolidated Combinator Attacks (formerly options 10/11/12) into interactive submenu under option 6 - - Markov attack supports training from cracked passwords or any wordlist, with table reuse/regeneration menu - - Fixed OMEN attack failing silently when model files were incomplete or enumNG errors occurred - - OMEN attack now validates all 5 required model files, captures enumNG stderr, and provides a train/use/cancel menu with wordlist picker - - Filtered `.7z`, `.torrent`, and `.out` files from wordlist selection menus (#80) - - Parallelized Hashmob rule downloads using a thread pool with success/failure summary (#81) - - Added dynamic optimized kernel (`-O`) flag per attack type via `optimizedKernelAttacks` config (#82) - - Replaced `uv tool install` with a bash shim for reliable config and asset resolution from any working directory - - Fixed config resolution to search the repo root and package directory in addition to CWD - - Fixed bare NTLM hash detection failing when hash files contain leading blank lines, BOM characters, or null bytes from UTF-16 encoding - - Improved error message for unrecognized hash formats to show the actual first-line content and list expected formats - - Fixed rule file path construction in Quick Crack and Loopback Attack using `os.path.join()` instead of string concatenation - - Added automatic update checks on startup (check_for_updates config option) - - Added `packaging` dependency for version comparison - - Added OMEN Attack (option 16) using statistical model-based password generation - - Added OMEN configuration keys (omenTrainingList, omenMaxCandidates) - - Added LLM Attack (option 15) using Ollama for AI-generated password candidates - - Added Ollama configuration keys (ollamaModel, ollamaNumCtx) - - Auto-versioning via setuptools-scm from git tags - -Version 2.0 - Modularized codebase into CLI/API/attacks modules - Unified CLI options with config overrides (hashview, hashcat, wordlists, pipal) - Added Hashview API integration - Added Weakpass torrent download helpers and Hashmob download wrapper - Improved test coverage and snapshot-based menu validation - Updated documentation and versioning - -Version 1.9 - Revamped the hate_crack output to increase processing speed exponentially combine_ntlm_output function for combining - Introducing New Attack mode "Bandrel Methodology" - Updated pipal function to output top x number of basewords - -Version 1.08 - Added a Pipal menu Option to analyze hashes. https://github.com/digininja/pipal - -Version 1.07 - Minor bug fixes with pwdump formating and unhexify function - -Version 1.06 - Updated the quick crack and recylcing functions to use user customizable rules. - -Version 1.05 - Abstraction of rockyou.txt so that you can use whatever dictionary that you would like to specified in the config.json - Minor change the quickcrack that allows you to specify 0 for number of times best64 is chained - -Version 1.04 - Two new attacks Middle Combinator and Thorough Combinator - -Version 1.03 - Introduction of new feature to use session files for multiple concurrent sessions of hate_crack - Minor bug fix - -Version 1.02 - Introduction of new feature to export the output of pwdump formated NTDS outputs to excel with clear-text passwords - -Version 1.01 - Minor bug fixes - -Version 1.00 - Initial public release +The full, per-release changelog now lives in [CHANGELOG.md](CHANGELOG.md).