Add support for user-uploaded rule files, UI cleanup.

Coalfire-Research / npk

A mostly-serverless distributed hash cracking platform

794 stars 154 forks source link

Add support for user-uploaded rule files, UI cleanup. #76

Open bzekanovic opened 4 years ago

bzekanovic commented 4 years ago

Hello,

Couple of things that would be very helpful with NPK.

Allow users to upload their own rule files.
Allow users to add additional Hashcat arguments for specific campaign.
Within the UI show helpful messages for end users. These messages can be embedded within helpful links next to the feature. This would eliminate you guys having to maintain additional docs.
The progress bar should show some kind of descriptive text based on the color (yellow, blue, green).

blincoln-bf commented 4 years ago

In particular, the --hex-salt option would make it possible to crack a number of additional hash types.

c6fc commented 3 years ago

Custom arguments and mask options are added in 874b074.

I like the idea of allowing users to upload rule files, but it likely won't make it into v2 to be honest. There's a lot built around the current design, and it will likely take a lot of effort to get this feature in. I'll see what I can do though.

I've been adding lots of tooltips all over the place to help with 3, and I hope to get 4 in as a part of the final polish before shipping v2 to master.

ArchitektApx commented 3 years ago

Regarding the UI Cleanup part:

Currently no error prompt is shown to the user if the password used in a password change does not comply with password policies and the process seems to be "stuck". The error message is just visible in the console.

Some kind of prompt visible to the user would be helpful I think

c6fc commented 3 years ago

Added user login errors in the password reset page to address @ArchitektApx 's comments. New in f2ca237

c6fc commented 3 years ago

Consider adding a link to the password reset email for quality of life.

bfnserra commented 3 years ago

I use NPK on many engagements and this is a great tool, thanks a lot for your hard work !

+1 for uploading our own rule file (as a non-admin user). For instance, I recently needed to use the toggles-lm-ntlm rules from Didier Stevens.
Also, uploading our own wordlist as a non-admin user could be really useful. For instance, when we want to run jobs with company-based patterns or if we already obtained cleartext passwords from other locations.