GPU Cracking: Putting It All Together

Analyzes cracked NTLM domain hashes from a year of penetration tests to publish the top ten password masks, dominated by seasonal patterns like Spring15 and Fall2015.

NetSPI's Q3 2014 cracking report: of 26,692 collected domain hashes, 82.25% cracked, with eight-character passwords peaking, 348 blank passwords found, and the top mask pattern seen 1,415 times.

Are rainbow tables still worth it for LM hashes? NetSPI compares table lookups with GPU brute force, explaining the format's two case-insensitive seven-character halves that favor GPU cracking.

A walkthrough for building a headless GPU cracking server: installing Ubuntu 12.10, AMD drivers, oclHashcat-plus, and John the Ripper, tailored to AMD cards since Linux driver support lags Windows.

NetSPI built a GPU cracking rig with four Radeon HD 7950 cards running oclHashcat, hitting about 25 billion NTLM guesses per second, and shares hardware, cooling, and cabling lessons.

NetSPI reviews its 2014 cracking stats: of 90,977 collected Windows domain hashes, 85.52% cracked, with seasonal patterns like Spring2014, Password1, and company-name variants dominating the hits.