05/25/2026
22,468 password hashes.
12,016 recovered.
One afternoon.
After landing Domain Admin on a client network, we dumped every NTLM hash in Active Directory and fed them to our hashcat cluster. Before the day was out, we'd recovered the plaintext credentials for 53.48% of the domain. More than twelve thousand accounts, wide open.
The part that stings: nearly every recovered password was technically compliant. Eight characters minimum. Upper, lower, number, symbol. The audit tool never blinked once while we had the keys to the kingdom.
Here's where the policy fell apart:
-18.5% of recovered passwords hit exactly the 8-character floor, nothing more.
-49.8% had full complexity: letters, a special character, and a digit.
-Only 36% cleared the 12-character bar recommended by PCI DSS 4.0.
-Just 7.6% met the NIST 800-63B Rev 4 single-factor threshold of 15 characters.
Phase 1 used pure mask attacks against the policy requirements: 0.10% recovered. Phase 2 added rockyou with no rules: 1.50% cumulative. Phase 3 layered in the public d3ad0ne ruleset (34,000+ transformations): 13.91%. Phase 4 brought our internal wordlist and custom rules: 50.20% of accounts were unique, for a total of 53.48%.
That proprietary tooling delta tells the whole story. Off-the-shelf public tools left 7,621 passwords standing. Our internal corpus knocked them down in a single phase. No compliance scan, NIST checklist, or audit dashboard can see that gap.
The complete analysis is in the comments: all four phases with full hashcat syntax, length and pattern breakdowns, crack-time projections across five hardware tiers (from a single laptop GPU to our 12-GPU, 4.3 TH/s rig), and framework mapping.
When was the last time someone actually cracked your AD hashes? Not just reviewed the policy. Not just running an audit. Cracked the hashes.
