Add a new attack mode that uses a local LLM via Ollama to generate
password candidates, converts them into hashcat .hcstat2 Markov
statistics via hcstat2gen, and runs a Markov-enhanced mask attack.
Two generation sub-modes:
- Wordlist-based: feeds sample from an existing wordlist to the LLM
as pattern context (config-selectable default with Y/N override)
- Target-based: prompts for company name, industry, and location
for contextual password generation
Pipeline: Ollama API -> candidate file -> hcstat2gen -> LZMA compress
-> hashcat -a 3 --markov-hcstat2
Config additions: ollamaUrl, ollamaModel, markovCandidateCount,
markovWordlist. No new pip dependencies (uses stdlib urllib/lzma).
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
hcatPath now exclusively points to the hashcat install directory and is
auto-discovered from PATH when not configured. hate_path is resolved
from the package directory (installed) or repo root (development) with
no auto-discovery. Extracted vendor-assets/clean-vendor Makefile targets
to deduplicate the install logic.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
The download_found option downloads already-cracked hashes (with cleartext
passwords). These cannot be used for cracking, so the 'Switch to this hashfile
for cracking?' prompt is inappropriate and confusing.
The switch prompt is kept for download_left since those are uncracked hashes
that can be cracked.
- Remove the switch-to-cracking prompt from download_found flow
- Add clarifying message that found hashes are already cracked
- Align with intended behavior: download_left prompts to switch, download_found just downloads
- Add HashcatRosetta and hashcat-utils to mypy exclude patterns in pyproject.toml
- Update .github/workflows/mypy.yml to exclude submodule directories
- Update pre-push hook to exclude submodules and use consistent mypy flags
- Set ignore_missing_imports=true to handle external dependencies gracefully
- Ensure pre-push hook permissions are set correctly (executable)
Fixes mypy check failures caused by missing hashcat_rosetta.formatting stub.
- Fix line length and formatting in hate_crack/api.py
- Fix line wrapping and f-string formatting in hate_crack/attacks.py
- Apply code style improvements in hate_crack/main.py
- Format test files for consistency
- All changes applied via 'ruff check --fix'
- Create separate workflow files for Python 3.9, 3.10, 3.11, 3.12, 3.13, 3.14
- Each Python version gets its own status badge
- Easily track which version(s) are failing tests
- Update README to display all 6 Python version badges
- Badges are clickable and link to individual workflow results
- Maintain pytest.yml as combined multi-version workflow
- Create individual workflow files for ruff, mypy, and pytest
- Each workflow has its own status badge for independent monitoring
- Ruff badge shows code quality status
- Mypy badge shows type checking status
- Pytest badge shows multi-version testing status
- Update README with all three badges and clear status documentation
- Remove combined tests.yml in favor of granular workflows
- Separate lint job for ruff and mypy checks on Python 3.13
- Add pytest matrix strategy to test Python 3.9 through 3.14
- Add GitHub Actions status badge to README
- Document CI/CD pipeline and what each check does
- Include pass/fail criteria for linting, type checking, and testing
- Link to Actions tab for detailed workflow results
- Add server reachability check before attempting connection
- Test skips if Hashview server is not available on localhost:5000
- Prevents test failures when HASHVIEW_TEST_REAL env var is set but server isn't running
- Allows test to succeed when Docker/server is available and configured
- Add server reachability check before attempting connection
- Test skips if Hashview server is not available on localhost:5000
- Prevents test failures when HASHVIEW_TEST_REAL env var is set but server isn't running
- Allows test to succeed when Docker/server is available and configured
The Hashview menu has been updated:
- Old: 'Available Customers'
- New: 'What would you like to do?'
Updated test to check for the current menu text that displays
when using the --hashview flag.
- Add 'make dev-install' to install project with [dev] dependencies
- Add 'make dev-reinstall' to uninstall and reinstall with dev deps
- Convenient way for developers to get linters and type checkers
- Document how to install dev dependencies
- Provide commands for running ruff and mypy locally
- Include pre-push hook example for automated checks
- List all included dev dependencies
- Help contributors run checks before pushing
- Add optional [dev] dependency group with mypy, ruff, pytest, and type stubs
- Include types-requests, types-beautifulsoup4, and types-openpyxl
- Add mypy config to exclude submodule directories
- Update GitHub workflow to install with optional dev dependencies
- Remove --ignore-missing-imports flag from mypy for stricter type checking
Instead of automatically running 'make' when binaries are missing,
now provides clear instructions for users to manually build utilities.
This gives users more control and makes the build process explicit.
Users will see: 'Please build the utilities by running: cd <dir> && make'
Tests now verify that hashcat-utils are loaded from hate_crack repo
even when hcatPath points to a different directory (like /opt/hashcat).
Why previous tests didn't catch this bug:
- config.json.example has hcatPath = "" (empty)
- Code has fallback: hcatPath = config.get('hcatPath', '') or hate_path
- So hcatPath accidentally defaulted to hate_path during testing
- This masked the bug where utilities incorrectly used hcatPath
Added tests that would have caught this:
- test_hashcat_utils_uses_hate_path_not_hcat_path
- test_config_with_explicit_hashcat_path
- test_readme_documents_correct_usage
Also added code comment documenting the fallback behavior.
BREAKING CHANGE: Corrected understanding of hcatPath configuration
- hcatPath should point to hashcat binary location (or omit if in PATH)
- hashcat-utils and princeprocessor are located in hate_crack repo
- Changed code to use hate_path for utilities instead of hcatPath
- Updated error messages to guide users correctly
- Updated README with correct configuration examples
- Asset discovery now properly uses HATE_CRACK_HOME environment variable
This fixes the issue where users had hcatPath pointing to hashcat
installation but the code was looking there for hashcat-utils.
- Add directory existence check in ensure_binary() before attempting make
- Provide clear error message when build directory doesn't exist
- Add troubleshooting section to README.md explaining common hcatPath mistakes
- Add tests for invalid hcatPath scenario and installed tool execution
- Helps users distinguish between hashcat path and hate_crack path
Fixes issue where users set hcatPath to hashcat installation directory
instead of hate_crack repository directory, causing confusing errors.
