Hashcat vs. Titania Nipper

Any time you want to perform offline password cracking exercises, Hashcat is going to be able to do that for you. I can't think of any scenario where you have a password hash you need to crack where another tool would be more suited to the task. Hashcat, of course, works best when you have a GPU available, but you can even use it on a VM if you use the --force flag.

Incentivized

When critical networking gear, such as a main firewall needs to be quickly audited.

Incentivized

• GPU accelerated password cracking
• Rule based attacks
• Supports all the hash formats

Incentivized

• Easy to use tool, with a low impact in network traffic.
• Support from the vendor (for any enquiries or problems).
• Quick in creating the reports that we need.
• Licensing costs are low in comparison to other solution/vendors.

Incentivized

• When drivers for your GPU aren't working it can be very frustrating to get started
• Some 3rd party GUI exists for Hashcat, but having an official one could be nice

Incentivized

• We definitely need support for a wider range of smaller vendors of equipment
• Better summary of conflicting access control lists would help

Incentivized

Although Nipper from Titania helps in auditing accurately every device in the network and helps in prioritizing the fixies, it is really useful for the part of the firewall in a network and also for the quick making of reports which are also customizable. But from our experience, the Qualys solution for scanning the networks, although is more costly, it also has more features and options in regards to assessing a network and the elements connected to the network, though it is also somehow less powerful when it comes to creating quick reports. Qualys has a more interface and dashboard approach regarding the results of the scans.

Incentivized

• Hashcat is a free tool
• It can be used to test password policies
• Great tool for penetration testers doing offline password attacks

Incentivized

• Positive Return on Investment