Boot from USB. GPU drivers load. Tor hidden service starts. Your .onion address and token appear on screen. Paste into any NHH tool — distributed cracking over Tor, behind WireGuard, with zero open ports.
Paste .onion + token into any NHH GUI tool → Crack tab
You need a GPU server. Install CUDA — if the version matches your driver. Install hashcat. Open a port (now your box is publicly visible). Set up an SSH tunnel. Copy wordlists. Figure out the flags. Do it again for the AMD box.
None of it integrates with your workflow. Cracked passwords don't auto-appear in your credential vault or pre-fill your pass-the-hash templates. Every tool is a separate manual step.
Same concept as ethOS or PIMP OS for GPU mining — purpose-built bootable Linux image. Pre-configured, pre-installed, pre-integrated. The OS exists to serve one purpose: give your toolkit maximum GPU power, invisibly.
Everything happens automatically. The only user action required is plugging in the USB drive.
performance. cgroups: 80% CPU/IO to crack slice, 20% to system.Token is auto-generated on first boot. WireGuard key auto-generated. GPU drivers auto-detected. Everything works with a blank drive — no configuration required.
Optionally drop a crack.conf on the USB's /boot/ to pre-set a token, SSH key, WG peers, or GPU power limit.
Every tool is callable by the server API. You don't install anything, configure paths, or manage versions.
NHH Crack Server doesn't replace hashcat — it contains hashcat, and wraps it with everything that makes distributed cracking actually usable in a professional engagement.
| Capability | hashcat standalone |
john standalone |
Hydra / Medusa |
Hashtopolis distributed |
L0phtCrack / Ophcrack |
NHH Crack Server ✦ |
|---|---|---|---|---|---|---|
| Zero-config boot from USB Plug in, boot, server running |
— | — | — | — | — | ✓ |
| Tor hidden service — no IP exposed No visible IP, no open ports on host |
— | — | — | — | — | ✓ |
| WireGuard VPN — API accessible only over VPN Must establish WireGuard to reach the API |
— | — | — | — | — | ✓ |
| NVIDIA CUDA GPU acceleration | ✓ | ✓ | — | ✓ | Win only | ✓ |
| AMD ROCm / OpenCL acceleration | ✓ | ✓ | — | ✓ | — | ✓ |
| 80% resource auto-allocation to cracking cgroups, performance governor, IRQ pinning, hugepages |
— | — | — | Manual | — | ✓ Auto |
| Network brute-force — SSH, FTP, RDP, SMB… | — | — | ✓ | — | — | ✓ |
| Exotic formats — KeePass, PDF, ZIP, SSH keys john jumbo handles what hashcat skips |
— | ✓ | — | — | — | ✓ |
| Web fuzzing — directory, vhost, API, params | — | — | — | — | — | ✓ ffuf+wfuzz |
| WiFi WPA2 cracking — aircrack-ng + hashcat | hash only | — | — | hash only | — | ✓ |
| GUI integration — submit jobs from pentest tools Direct API from all 8 NHH Sidekick tools |
— | — | — | Web UI | Standalone | ✓ All 8 |
| Credential vault auto-push Cracked passwords appear in all NHH tools instantly |
— | — | — | — | — | ✓ |
| Multiple nodes, auto load balancing | — | — | — | ✓ | — | ✓ ∞ nodes |
| Open source server code | ✓ | ✓ | ✓ | ✓ | — | ✓ GitHub |
| ISO download — write to USB, boot, go | — | — | — | — | — | ✓ |
✦ NHH Crack Server wraps hashcat, john, hydra, medusa, ffuf, wfuzz, and aircrack-ng. All individual capabilities plus the integration layer, zero-config deployment, and Tor-first security model none of them have alone.
Hashtopolis and Fitcrack are excellent — but they assume you're running on controlled infrastructure with a web server, a database, and agents deployed manually. For an engagement, that's hours of setup and a web UI you have to remember to tear down after.
NHH assumes you have a spare machine and 30 seconds. No database. No web UI. No public ports. No IP address exposed to anyone.
L0phtCrack, Ophcrack, and Cain & Abel are Windows-only GUI tools around LM/NTLM cracking. Underlying cracking is orders of magnitude slower than GPU mask attacks (rainbow tables vs CUDA).
NHH CredDump Sidekick extracts the hashes; Crack Server runs hashcat -m 1000 (NTLM). Results auto-push to your credential vault. Cross-platform, orders of magnitude faster.
No IP. No open ports. No attack surface. The only path in is through WireGuard, reachable only through Tor.
WG_ONLY_MODE=1 by default. Listening address is the WireGuard interface IP, never 0.0.0.0.X-Crack-Token header. Auto-generated on first boot, persisted to USB.Min: 4-core CPU · 8 GB RAM · 16 GB USB · network connection. Recommended: RTX 3080+ or RX 6800+ · 16 GB RAM · 32 GB USB.
Feature-complete, being hardened. RC builds available to NHH license holders and early access requesters. Server binary and ISO build scripts are open source.