KrakenHashes is a distributed password cracking system designed for security professionals and red teams. The platform coordinates GPU/CPU resources across multiple agents to perform high-speed hash cracking using tools like Hashcat through a secure web interface.
This project is currently in early alpha development as a personal research project. Key considerations:
- Not production-ready: Core functionality is incomplete/unstable
- No external contributions: We are not accepting pull requests until version 1 is released. This is a passion project that I would like to take to ready before getting outside help.
- Breaking changes guaranteed: Database schema and API contracts will change as I want to prevent every minor schema change to add a new migration file.
- Zero stability guarantees: Features may disappear or break without warning
- Not for testing: Core security/auth systems remain unimplemented
Until v1.0 release:
- No compatibility between versions
- No migration path for existing data
- No documented upgrade process
- No stability in configuration formats
Post v1.0:
We plan to implement proper database migration tooling and versioned API contracts once core feature development stabilizes. Until then, consider this codebase a moving target.
Use at your own risk - This software may eat your data, catch fire, or summon a digital Kraken. You've been warned.
- Job scheduler with adaptive load balancing
- REST/gRPC API endpoints with JWT authentication
- PostgreSQL interface for job storage/results
- Redis-based task queue with priority levels
- Prometheus metrics exporter
- Hardware resource manager (GPU/CPU/RAM allocation)
- Hashcat wrapper with automatic checkpointing
- Safety mechanisms for temperature/usage limits
- Distributed work unit management
- Healthcheck system with self-healing capabilities
- Real-time job progress visualization
- Hash type detection and configuration wizard
- Team management dashboard for admins
- MFA configuration and recovery flow
- Interactive reporting and analytics
- Automatic session invalidation on IP change
- Role-based access control (RBAC) system
- Encrypted job payloads (AES-256-GCM)
- Certificate-pinned agent communications
- Audit-quality logging with chain-of-custody
- Penetration testing teams coordinating attacks
- Forensic investigators recovering protected evidence
- Red teams executing credential stuffing attacks
- Research analyzing hash vulnerabilities
- Security training environments
License: AGPLv3 (See LICENSE.md)
Status: Actively in development, there will be bugs and major braking changes
Instructions for setting up and running each component can be found in their respective directories.
- Implement TLS support
- Self-signed certificate support
- User-provided certificate support (Not Tested - Should work)
- Certbot integration (Written but not tested - Please open an issue if you have issues)
- Docker containerization
- Environment variable configuration
- Database initialization handling
- Deployment to DockerHub with documentation
- Email notification system
- Security event notifications (template)
- Job completion notifications (template)
- Admin error notifications (template)
- Email-based MFA (template)
- Enhanced user management
- User groups (Admin/User roles)
- MFA implementation
- Email-based authentication
- Backup codes (based on admin auth settings)
- Admin MFA override capability
- Password change functionality
- Account management features
- Hashlist management
- Comprehensive hashcat hash type support
- Hash configuration database
- Salt status tracking
- Performance characteristics (slow/fast)
- Agent-side validation with error parsing
- Task management
- Multi-level priority system
- FIFO within priority levels
- Pre-defined task templates
- Intelligent job distribution
- Team-based routing
- Agent availability tracking
- Owner priority handling
- Progress tracking
- Result storage
- Multi-level priority system
- Resource management
- Wordlist upload/management
- Rules file management
- Tool version management
- Job processing
- Hashcat integration
- Command generation based on hash type
- Error handling and reporting
- Benchmark system
- Dynamic workload calculation
- Hashcat integration
- Advanced monitoring
- GPU/CPU temperature tracking
- Resource usage history
- Performance metrics
- Scheduling system
- On/Off toggle
- Daily schedule configuration
- Resource usage limits
- Dashboard
- User-specific job status
- Performance statistics
- System health indicators
- Task management interface
- Job creation/modification
- Priority level assignment
- Task template management
- Progress monitoring
- Result viewing
- Resource management pages
- Wordlist management
- Rules management
- Tool configuration
- Admin panel
- System configuration
- User management
- MFA management
- Security settings
- Account management
- Profile settings
- Security settings
- MFA setup/recovery
- API documentation
- Deployment guides
- User manual
- Priority system guidelines
- Hash type reference
- Best practices
- Administrator guide
- Team management guidelines
- Security recommendations
- Passkey support for MFA
- Additional authentication methods
- Team resource quotas
- Advanced job dependencies
- Team system implementation
- Team management infrastructure
- Team manager roles
- User-team assignments
- Team-based agent access control
- Frontend team interfaces
- Team management UI
- Team assignment system
- Team management infrastructure