WaveCrack(Wavestone) : web interface for password cracking with hashcat

Written by Mubassir patel



A user-friendly Web interface to share an hashcat cracking box among multiple users with some pre-defined options.

Screenshots of Wavecrack(Wavestone)

  • Seeing the results and some stats wavecrack


  • Wavecrack is  Web application can be used to launch asynchronous password cracks with hashcat.
  • The interface tries to be as user-friendly as possible and facilitates the password cracking method choice and to automate the succession of various attack modes.
  • It also displays statistics regarding the cracked passwords and allows to export the cracked password list in CSV.
  • The application is designed to be used in a multi-user environment with a strict segregation between the cracking results of different users: the user authentication can be done through an LDAP directory or basic auth.


Wavecrack can be used to do the following:

  • Add new password hashes, choose the attack mode and the crack duration
  • View the past and current cracks for your user with statistics and graphs
  • View the overall load of the platform
  • Upload a password-protected file and extract its hash

The attack modes are followed in the order they are displayed on the hash submit form.
It is also possible to stop a crack. However, every cancelation is final.

Don’t Miss:

1. Boopsuite : A Wireless Pentesting Suite

2.  List of Commands Used in Kali Linux


  • hashcat: follow these instructions for CPU only usage on a Kali linux host
  • flask (>=0.10.1)
  • celery (>=3.1.18)
  • SQLite (>=
  • rabbitmq-server (>= 3.4.3)
  • Rules for hashcat (examples)
  • Wordlists (examples)


  • Install the RabbitMQ server and python-ldap requirements
$ apt-get install libsasl2-dev libldap2-dev libssl-dev rabbitmq-server
  • Install the python requirements
$ pip install -r requirements.txt
  • Create a cracker/ configuration file from the cracker/ file and notably edit the Mandatory settings section:
    • The path of hashcat
    •  SQLite database
    •  hashcat rules
    •  wordlists
    • The LDAP parameters:
      • IP address
      • port
      • LDAP database for the users
      • Base DN
  • Initialize the local database linked in the cracker/ configuration file
$ sqlite3 base.db < base_schema.sql
  • Start the RabbitMQ server
$ sudo service rabbitmq-server start
  • Start Celery from the application folder
$ celery worker -A cracker.celery
  • Launch the Flask Web server
    • Directly from the file: this mode is not suitable for production purpose
    $ python
    • With a wsgi script: an example of app.wsgi.example is provided
    • Similarly, supervisorctl can be used to manage celery with a configuration file example in supervisorcelery.conf.example
  • In order to stop the cracks after a certain amount of time, you can use the provided cron script.
  • If you want to update the list of hashes supported in wavecrack, you can use the dedicated script which will parse hashcat’s wiki and generate an updated To do so, you need to have BeautifulSoup installed on your system.

Finally, if you don’t want to setup your own VM, you can use the Docker-based process described in the docker folder.

About the author

Mubassir patel

Mubassir is a founder and developer of this site. He is a computer science engineer. He has a very deep interest in ethical hacking, penetration testing, website development and including all technology topic.

Leave a Comment