Release Radar

Changelog

• show full url in expanded dir mode

Welcome to the hashcat v7.1.2 release!

This hotfix restores backward compatibility in machine-readable status view mode, which was broken in v7.1.0 and affected third-party overlays such as the Hashtopolis agent. It also fixes issues in the Argon2 libraries when used in multi-hash modes. If you are using hashcat v7.1.0+ with LUKS2 or KeePass KDBX4, updating is strongly recommended.

The release also introduces a new assimilation bridge plugin, the Rust bridge. Just like the Python bridge plugin, which lets you write hash-mode extensions in Python instead of C, you can now do the same in Rust. This is a valuable community contribution that will be covered in more detail in the next release notes. The feature is already fully functional and ready for early adoption, with initial documen...

This update brings significant new content, including dedicated pages for new vulnerability classes, fresh exploitation techniques for existing topics, and numerous quality-of-life improvements across the knowledge base.

📚 New Vulnerability Pages

• External Variable Modification: Complete new section covering PHP extract() function vulnerabilities, variable pollution, and security implications
• Reverse Proxy Misconfigurations: Covering common Nginx misconfigurations.

🔄 Enhanced Sections

• Command Injection:
  • Added worstfit technique for argument injection
  • Enhanced with fullwidth character bypass methods
• CSV Injection:
  • New Google Sheets exploitation section
  • Added formulas like IMPORTXML, IMPORTRANGE for data exfiltration
  • E...

Remove scapy usage (#500)

• removed arp and dns hunters usage due to it's violations of the scapy GPL2 license

• added installation of arp and dns hunters to Dockerfile

• added explicit new version to plugins in dockerfile installation

• ignore B020 flake8

Fix: Removed automatic import of handler object (#506)

• removed automatic import of handler object in events package and renamed handler.py to event_handler.py to solve name collision

• the last version of the rules before a general license switch to DRL 1.1 (Detection Rule License) https://github.com/SigmaHQ/sigma/blob/drl-1.1/LICENSE.Detection.Rules.md