CPU vs GPU - What to choose to 'crack' passwords?
Choosing the right hardware for password cracking can significantly affect the efficiency and the time it takes to recover data. Is it worth relying on the traditional computing power of the processor (CPU), or should you instead take advantage of the powerful capabilities of graphics cards (GPU)? In this article we take a look at how both solutions work in the context of password-cracking tools such as Hashcat, and which of them performs better in practice. How do you use Hashcat? Find out how to speed up the password-recovery process and which hardware to use to get the best results.
What is the Hashcat tool?
Hashcat works as a password-cracking tool that uses brute-force, dictionary and combinator attack techniques to recover passwords from hashes. Where does its main strength lie? In the ability to speed up computation through parallel data processing using central processing units (CPU) and graphics cards (GPU). If you want to start recovering passwords, for example from a handshake file during a WiFi network audit, from zip files, encrypted documents and so on, it is worth doing it as efficiently as possible, as far as the hardware you work on allows.
For this purpose I use a well-known and well-liked tool that its own creators call the "Swiss army knife of password recovery" – Hashcat. A common mistake among people starting out with this topic is running Hashcat or other tools on virtual machines. This is not efficient, because Hashcat can offload computation from the processor (CPU) onto a graphics card or cards (GPU), which multiplies the speed and therefore the efficiency of password recovery.
Check out this SAPSAN blog post too: Password generator – does it make sense?
How does Hashcat work?
-
Hashcat starts with the input data. The user supplies the hash to be cracked and chooses the attack method, e.g. brute-force or a dictionary attack (which checks passwords from a ready-made list of the most commonly used passwords). Hashcat supports many encryption algorithms, such as MD5, SHA-1 and WPA/WPA2.
-
Next comes the computation – Hashcat uses the computing power of the processor (CPU) or the graphics card (GPU) to test different combinations as fast as possible.
-
The next stage is of course finding the password – the program compares the generated combinations against the hash. If it finds a matching combination, it means it has guessed the password.
Hashcat runs fast, especially when it uses a GPU, and it is a popular tool in password-security audits. Thanks to GPU support and support for many algorithms, Hashcat is one of the fastest password-cracking tools on the market. If you are just getting started with Hashcat and are looking for detailed tips, it is worth checking out the guides available online or on YouTube (search for them by typing, for example, hashcat tutorial), which explain step by step how to configure the tool and launch different kinds of password attacks.
It is worth mentioning that professional pentesters often use several graphics cards connected together in a computing cluster, which lets them crack passwords even faster. This way they can process huge amounts of data in a very short time. Hashcat combined with the right hardware is therefore one of the most powerful tools in a security specialist's arsenal.
Hashcat – GPU or CPU?
Why isn't using virtual machines efficient? Well, VBox or VMware only emulate the graphics card and do not allow full use of the hardware capabilities. And why is it worth offloading computation from the CPU to the GPU? It's simple: the weakest graphics card will always be more efficient than the most powerful processor. In the screenshots below you can see the GPU performance gain relative to the CPU on the same laptop with a Pentium i3 gen8 processor and a not-very-impressive GeForce MX 150 card – bearing in mind that the processor has 6 cores taking part in the computation, whereas this graphics-card model has 384 CUDA graphics cores (the latest GPUs have several thousand of them).
Hashcat – CPU:
Hashcat – GPU:
To better illustrate the difference in time, I used a 15.4 GB dictionary. That is exactly why it is worth making full use of Hashcat's capabilities. If you want to experiment this way, it is worth booting a full Linux system, e.g. from a USB stick with persistence or from a disk.
Does Hashcat work on Windows?
Yes, Hashcat is available on Windows as well. It is a cross-platform tool, which means you can use it on various operating systems, including Windows, Linux and macOS. Hashcat is available in a Windows version for both processors (CPU) and graphics cards (GPU). Regardless of the system, we will have to install the latest drivers for our card. How do you sort that out? I encourage you to read the documentation on the project website:
If you care about cracking passwords quickly, choosing a GPU is by far the best solution. Thanks to their architecture, graphics cards beat processors hands down at parallel data processing. Interestingly, the latest GPUs, such as those in the Nvidia RTX series, can have several thousand cores, which makes them incredibly efficient. That is why, if you want to make full use of Hashcat's potential, investing in the right graphics card may be a sound choice.
Post author: Rafał Sulikowski:
Rafał's Instagram: LINK
SAPSAN Instagram: LINK
FB group for Pentesters: LINK