Have you ever imagined running hash-cracking directly in your browser? With Kraker-JS, this is now a (horrible) reality . This "mad" password-cracking tool allows you to perform wordlist and rules-based attacks for various hash types with just a few clicks. No installations, no dependencies, just your browser.
A pure JavaScript tool that lets you run multiple cracking tasks simultaneously. While the idea may sound unconventional, it offers some surprising advantages. For example, you can even use your smartphone as a powerful cracking tool. It supports a range of hash types and protocols, including crypt functions, JWT, Net-NTLMv2, and common hash algorithms like MD5, SHA1, and more.
One of its main advantages is its simplicity. You can start cracking hashes in three steps: select the hash list, choose a wordlist (you can download these from https://weakpass.com), and "Crack". Cracked hashes will immediately appear and can be downloaded as soon as they are revealed. The tool also provides speed benchmarks for different hash types. While its performance is hundreds or even thousands of times slower than specialised tools like Hashcat or John-the-Ripper, Kraker-JS still has own niche. It works everywhere, with no need for installation, drivers, or OpenCL. As long as you have a browser, you’re good to go because it’s just a static page with some JavaScript files.
I personally use it for CTF-like challenges where I need to crack a few MD5 hashes quickly, but can't use any of other tools, because of different reasons. Looking ahead, Kraker-JS has the potential to evolve into a comprehensive hash-cracking suite. But for now, the focus is on adding support for additional algorithms such as Kerberos, WPA, and archive formats.
Kraker-JS may not replace dedicated cracking tools, but its portability and simplicity make it a useful hackathon tool.
You can check it out https://weakpass.com/tools/kraker-js, and the source code could be found at https://github.com/zzzteph/weakpass!
By the way, I will do a presentation about it and other intersting tools during my talk at BlackHat Arsenal https://www.blackhat.com/eu-24/arsenal/schedule/index.html#weakpassjs---a-collection-of-tools-for-generation-bruteforce-and-hashcracking-41496
Hope to see you there!