Cracking passwords is nice, but chatting with your GPUs is fun.
On internal penetration tests and Red Team assignments, we know from experience that obtaining password hashes is almost a guarantee. But what good is a password hash, if it cannot be (ab)used as is? That's where the password cracking rig comes into play.
The obvious answer
Cracking passwords is not a science with the right tools. There are online services such as https://crackstation.net/, which will simply output the password of your provided hash. Sounds great, right? And it is! It just has a ton of caveats, such as which password hash types are supported, and only using lookup tables.
Another option is using tools which have been available to everyone for at least a decade, such as hashcat and John the Ripper jumbo. These tools are practically industry standards and are extremely well-supported on consumer hardware. They are also really easy to use.
My place of work provided me with a laptop, so let's crack some passwords!
Well yes, but also no. Although hashcat will basically run on your phone or your Texas Instruments TI-81, performance matters a ton when it comes to cracking passwords.
As an example, here is me trying to brute-force an 8-character NTLM password on my laptop with an Intel Core Ultra 9 185H:
Session..........: hashcat
Status...........: Running
Hash.Mode........: 1000 (NTLM)
Hash.Target......: 556d1e4c703d8d6411d5f2258aa4a8bb
Time.Started.....: Fri Sep 18 06:58:16 2026 (1 sec)
Time.Estimated...: Mon Oct 26 08:27:30 2026 (38 days, 1 hour)
Kernel.Feature...: Optimized Kernel (password length 0-27 bytes)
Guess.Mask.......: ?a?a?a?a?a?a?a?a [8]
Guess.Queue......: 1/1 (100.00%)
Speed.#01........: 2017.4 MH/s (10.50ms) @ Accel:1024 Loops:1024 Thr:1 Vec:8
Recovered........: 0/1 (0.00%) Digests (total), 0/1 (0.00%) Digests (new)
Progress.........: 1829836800/6634204312890625 (0.00%)
Rejected.........: 0/1829836800 (0.00%)
Restore.Point....: 202752/735091890625 (0.00%)
Restore.Sub.#01..: Salt:0 Amplifier:0-1024 Iteration:0-1024
Candidate.Engine.: Device Generator
Candidates.#01...: $HEX[7320344c36202020] -> $HEX[5b2a457b38202020]
Figure 1 - Estimated time 38 days
Let's also look at hashes from Kerberoasting, which are notorious for being a lot slower to crack:
Session..........: hashcat
Status...........: Running
Hash.Mode........: 13100 (Kerberos 5, etype 23, TGS-REP)
Hash.Target......: $krb5tgs$23$*sql-service$CORP.LOCAL$MSSQLSvc/db01.c...3e3f40
Time.Started.....: Fri Sep 18 07:04:49 2026 (0 secs)
Time.Estimated...: Tue Jun 23 05:02:23 2043 (16 years, 277 days)
Kernel.Feature...: Optimized Kernel (password length 0-55 bytes)
Guess.Mask.......: ?a?a?a?a?a?a?a?a [8]
Guess.Queue......: 1/1 (100.00%)
Speed.#01........: 12542.6 kH/s (94.30ms) @ Accel:53 Loops:1024 Thr:1 Vec:8
Recovered........: 0/1 (0.00%) Digests (total), 0/1 (0.00%) Digests (new)
Progress.........: 5969920/6634204312890625 (0.00%)
Rejected.........: 0/5969920 (0.00%)
Restore.Point....: 0/7737809375 (0.00%)
Restore.Sub.#01..: Salt:0 Amplifier:5120-6144 Iteration:0-1024
Candidate.Engine.: Device Generator
Candidates.#01...: ^ILerane -> Qjap1999
Figure 2 - 16 years, 277 days
Now, most of my engagements do not run for 38+ days, and definitely not for 16 years, so although it is functional, and it should finish at some point, it is not feasible for the type of testing I do.
So, what are my options?
Limited.
Since I am not invited to the table when Jensen Huang and Nvidia are allocating their top-of-the-line GPUs, and I am not smart enough to replicate how we made rocks do computations, I decided on the most powerful, readily available (at the time), consumer GPU. This was two RTX 5090s:
The full hardware list is here:
- GPU: 2x Gainward GeForce RTX 5090 Phantom GS
- CPU: AMD Ryzen 5 9600X
- CPU cooler: Noctua NH-D15
- RAM: 4x 32GB G.Skill Flare X5 DDR5-6000 CL28
- Motherboard: GIGABYTE B850 AI TOP
- PSU: GIGABYTE UD1600PM PG5 AI TOP
- SSD: 2TB Samsung 990 Pro
So, what can this baby do? (He is named Bambino for anyone wondering)
Session..........: hashcat
Status...........: Running
Hash.Mode........: 1000 (NTLM)
Hash.Target......: 556d1e4c703d8d6411d5f2258aa4a8bb
Time.Started.....: Fri Sep 18 10:49:09 2026 (0 secs)
Time.Estimated...: Fri Sep 18 11:07:43 2026 (18 mins, 34 secs)
Kernel.Feature...: Pure Kernel (password length 0-256 bytes)
Guess.Mask.......: ?1?1?1?1?1?1?1?1 [8]
Guess.Charset....: -1 ?l?u?d, -2 N/A, -3 N/A, -4 N/A, -5 N/A, -6 N/A, -7 N/A, -8 N/A
Guess.Queue......: 1/1 (100.00%)
Speed.#01........: 98840.7 MH/s (5.21ms) @ Accel:3 Loops:1024 Thr:1024 Vec:1
Speed.#02........: 96942.1 MH/s (5.31ms) @ Accel:3 Loops:1024 Thr:1024 Vec:1
Speed.#*.........: 195.8 GH/s
Recovered........: 0/1 (0.00%) Digests (total), 0/1 (0.00%) Digests (new)
Progress.........: 105885204480/218340105584896 (0.05%)
Rejected.........: 0/105885204480 (0.00%)
Restore.Point....: 0/916132832 (0.00%)
Restore.Sub.#01..: Salt:0 Amplifier:102400-103424 Iteration:0-1024
Restore.Sub.#02..: Salt:0 Amplifier:100352-101376 Iteration:0-1024
Candidate.Engine.: Device Generator
Candidates.#01...: Jcwerane -> pVJcDous
Candidates.#02...: ASh2W100 -> awk6Cron
Hardware.Mon.#01.: Temp: 53c Fan: 51% Util:100% Core:2857MHz Mem:13801MHz Bus:8
Hardware.Mon.#02.: Temp: 48c Fan: 50% Util: 23% Core:2940MHz Mem:13801MHz Bus:8
Figure 4 - 18 mins, 34 secs
Session..........: hashcat
Status...........: Running
Hash.Mode........: 13100 (Kerberos 5, etype 23, TGS-REP)
Hash.Target......: $krb5tgs$23$*sql-service$CORP.LOCAL$MSSQLSvc/db01.c...3e3f40
Time.Started.....: Fri Sep 18 10:50:25 2026 (1 sec)
Time.Estimated...: Sun Sep 27 05:37:40 2026 (8 days, 18 hours)
Kernel.Feature...: Optimized Kernel (password length 0-55 bytes)
Guess.Mask.......: ?a?a?a?a?a?a?a?a [8]
Guess.Queue......: 1/1 (100.00%)
Speed.#01........: 4421.3 MH/s (96.12ms) @ Accel:307 Loops:256 Thr:32 Vec:1
Speed.#02........: 4321.3 MH/s (98.43ms) @ Accel:307 Loops:256 Thr:32 Vec:1
Speed.#*.........: 8742.6 MH/s
Recovered........: 0/1 (0.00%) Digests (total), 0/1 (0.00%) Digests (new)
Progress.........: 10260971520/6634204312890625 (0.00%)
Rejected.........: 0/10260971520 (0.00%)
Restore.Point....: 0/7737809375 (0.00%)
Restore.Sub.#01..: Salt:0 Amplifier:3072-3328 Iteration:0-256
Restore.Sub.#02..: Salt:0 Amplifier:3072-3328 Iteration:0-256
Candidate.Engine.: Device Generator
Candidates.#01...: MGUerane -> 1yl#$``1
Candidates.#02...: MGU=k`1 -> 1yl_rss
Hardware.Mon.#01.: Temp: 54c Fan: 51% Util: 99% Core:2865MHz Mem:13801MHz Bus:8
Hardware.Mon.#02.: Temp: 53c Fan: 51% Util:100% Core:2910MHz Mem:13801MHz Bus:8
Figure 56 - 8 days, 18 hours
From 38 days to 18 minutes, and 16 years to 8 days seems more doable. It is also worth remembering that brute-force is not generally how this would be done, but just to give an idea of the timelines. The full hashcat benchmark can be seen here:
hashcat -d 1,2 -b
hashcat (v7.0.0) starting in benchmark mode
Benchmarking uses hand-optimized kernel code by default.
You can use it in your cracking session by setting the -O option.
Note: Using optimized kernel code limits the maximum supported password length.
To disable the optimized kernel code in benchmark mode, use the -w option.
Failed to initialize the AMD main driver HIP runtime library. Please install the AMD HIP SDK.
Failed to initialize AMD HIP RTC library. Please install the AMD HIP SDK.
CUDA API (CUDA 13.0)
====================
* Device #01: NVIDIA GeForce RTX 5090, 30840/32606 MB, 170MCU
* Device #02: NVIDIA GeForce RTX 5090, 30840/32606 MB, 170MCU
OpenCL API (OpenCL 2.1 AMD-APP (3640.0)) - Platform #1 [Advanced Micro Devices, Inc.]
=====================================================================================
* Device #03: AMD Radeon(TM) Graphics, skipped
OpenCL API (OpenCL 3.0 CUDA 13.0.78) - Platform #2 [NVIDIA Corporation]
=======================================================================
* Device #04: NVIDIA GeForce RTX 5090, skipped
* Device #05: NVIDIA GeForce RTX 5090, skipped
Benchmark relevant options:
===========================
* --backend-devices=1,2
* --backend-devices-virtmulti=1
* --backend-devices-virthost=1
* --optimized-kernel-enable
-------------------
* Hash-Mode 0 (MD5)
-------------------
Speed.#01........: 218.4 GH/s (77.34ms) @ Accel:128 Loops:1024 Thr:768 Vec:8
Speed.#02........: 220.7 GH/s (76.48ms) @ Accel:128 Loops:1024 Thr:768 Vec:8
Speed.#*.........: 439.1 GH/s
----------------------
* Hash-Mode 100 (SHA1)
----------------------
Speed.#01........: 67778.8 MH/s (83.42ms) @ Accel:64 Loops:1024 Thr:512 Vec:1
Speed.#02........: 68593.7 MH/s (82.47ms) @ Accel:64 Loops:1024 Thr:512 Vec:1
Speed.#*.........: 136.4 GH/s
---------------------------
* Hash-Mode 1400 (SHA2-256)
---------------------------
Speed.#01........: 27545.7 MH/s (90.01ms) @ Accel:14 Loops:1024 Thr:1024 Vec:4
Speed.#02........: 27872.7 MH/s (88.77ms) @ Accel:14 Loops:1024 Thr:1024 Vec:4
Speed.#*.........: 55418.4 MH/s
---------------------------
* Hash-Mode 1700 (SHA2-512)
---------------------------
Speed.#01........: 9952.1 MH/s (88.80ms) @ Accel:8 Loops:1024 Thr:640 Vec:1
Speed.#02........: 10039.9 MH/s (87.90ms) @ Accel:8 Loops:1024 Thr:640 Vec:1
Speed.#*.........: 19992.0 MH/s
-------------------------------------------------------------
* Hash-Mode 22000 (WPA-PBKDF2-PMKID+EAPOL) [Iterations: 4095]
-------------------------------------------------------------
Speed.#01........: 3414.7 kH/s (94.75ms) @ Accel:10 Loops:1024 Thr:768 Vec:1
Speed.#02........: 3460.1 kH/s (93.49ms) @ Accel:10 Loops:1024 Thr:768 Vec:1
Speed.#*.........: 6874.8 kH/s
-----------------------
* Hash-Mode 1000 (NTLM)
-----------------------
Speed.#01........: 327.9 GH/s (84.77ms) @ Accel:192 Loops:1024 Thr:896 Vec:8
Speed.#02........: 329.2 GH/s (83.70ms) @ Accel:192 Loops:1024 Thr:896 Vec:8
Speed.#*.........: 657.1 GH/s
---------------------
* Hash-Mode 3000 (LM)
---------------------
Speed.#01........: 203.1 GH/s (56.26ms) @ Accel:416 Loops:1024 Thr:256 Vec:1
Speed.#02........: 205.9 GH/s (55.55ms) @ Accel:416 Loops:1024 Thr:256 Vec:1
Speed.#*.........: 409.0 GH/s
--------------------------------------------
* Hash-Mode 5500 (NetNTLMv1 / NetNTLMv1+ESS)
--------------------------------------------
Speed.#01........: 198.4 GH/s (71.05ms) @ Accel:96 Loops:1024 Thr:896 Vec:1
Speed.#02........: 200.2 GH/s (70.16ms) @ Accel:96 Loops:1024 Thr:896 Vec:1
Speed.#*.........: 398.5 GH/s
----------------------------
* Hash-Mode 5600 (NetNTLMv2)
----------------------------
Speed.#01........: 15676.2 MH/s (88.18ms) @ Accel:8 Loops:1024 Thr:1024 Vec:1
Speed.#02........: 15842.7 MH/s (87.14ms) @ Accel:8 Loops:1024 Thr:1024 Vec:1
Speed.#*.........: 31518.8 MH/s
--------------------------------------------------------
* Hash-Mode 1500 (descrypt, DES (Unix), Traditional DES)
--------------------------------------------------------
Speed.#01........: 8683.3 MH/s (81.57ms) @ Accel:4 Loops:1024 Thr:1024 Vec:1
Speed.#02........: 8683.0 MH/s (81.42ms) @ Accel:4 Loops:1024 Thr:1024 Vec:1
Speed.#*.........: 17366.3 MH/s
------------------------------------------------------------------------------
* Hash-Mode 500 (md5crypt, MD5 (Unix), Cisco-IOS $1$ (MD5)) [Iterations: 1000]
------------------------------------------------------------------------------
Speed.#01........: 98506.4 kH/s (94.74ms) @ Accel:57 Loops:1000 Thr:1024 Vec:1
Speed.#02........: 99108.0 kH/s (93.82ms) @ Accel:57 Loops:1000 Thr:1024 Vec:1
Speed.#*.........: 197.6 MH/s
----------------------------------------------------------------
* Hash-Mode 3200 (bcrypt $2*$, Blowfish (Unix)) [Iterations: 32]
----------------------------------------------------------------
Speed.#01........: 303.5 kH/s (90.89ms) @ Accel:7 Loops:32 Thr:24 Vec:1
Speed.#02........: 308.2 kH/s (89.37ms) @ Accel:7 Loops:32 Thr:24 Vec:1
Speed.#*.........: 611.6 kH/s
--------------------------------------------------------------------
* Hash-Mode 1800 (sha512crypt $6$, SHA512 (Unix)) [Iterations: 5000]
--------------------------------------------------------------------
Speed.#01........: 1590.6 kH/s (85.39ms) @ Accel:4 Loops:1000 Thr:1024 Vec:1
Speed.#02........: 1591.5 kH/s (85.36ms) @ Accel:4 Loops:1000 Thr:1024 Vec:1
Speed.#*.........: 3182.2 kH/s
--------------------------------------------------------
* Hash-Mode 7500 (Kerberos 5, etype 23, AS-REQ Pre-Auth)
--------------------------------------------------------
Speed.#01........: 4580.3 MH/s (96.07ms) @ Accel:318 Loops:256 Thr:32 Vec:1
Speed.#02........: 4594.8 MH/s (95.43ms) @ Accel:318 Loops:256 Thr:32 Vec:1
Speed.#*.........: 9175.2 MH/s
-------------------------------------------------
* Hash-Mode 13100 (Kerberos 5, etype 23, TGS-REP)
-------------------------------------------------
Speed.#01........: 4397.2 MH/s (96.19ms) @ Accel:306 Loops:256 Thr:32 Vec:1
Speed.#02........: 4430.6 MH/s (95.33ms) @ Accel:306 Loops:256 Thr:32 Vec:1
Speed.#*.........: 8827.8 MH/s
---------------------------------------------------------------------------------
* Hash-Mode 15300 (DPAPI masterkey file v1 (context 1 and 2)) [Iterations: 23999]
---------------------------------------------------------------------------------
Speed.#01........: 582.1 kH/s (92.78ms) @ Accel:10 Loops:1000 Thr:768 Vec:1
Speed.#02........: 588.9 kH/s (91.72ms) @ Accel:10 Loops:1000 Thr:768 Vec:1
Speed.#*.........: 1171.0 kH/s
---------------------------------------------------------------------------------
* Hash-Mode 15900 (DPAPI masterkey file v2 (context 1 and 2)) [Iterations: 12899]
---------------------------------------------------------------------------------
Speed.#01........: 346.0 kH/s (86.45ms) @ Accel:6 Loops:1024 Thr:384 Vec:1
Speed.#02........: 347.8 kH/s (86.00ms) @ Accel:6 Loops:1024 Thr:384 Vec:1
Speed.#*.........: 693.8 kH/s
------------------------------------------------------------------
* Hash-Mode 7100 (macOS v10.8+ (PBKDF2-SHA512)) [Iterations: 1023]
------------------------------------------------------------------
Speed.#01........: 4359.1 kH/s (88.66ms) @ Accel:9 Loops:512 Thr:512 Vec:1
Speed.#02........: 4376.7 kH/s (88.21ms) @ Accel:9 Loops:512 Thr:512 Vec:1
Speed.#*.........: 8735.9 kH/s
---------------------------------------------
* Hash-Mode 11600 (7-Zip) [Iterations: 16384]
---------------------------------------------
Speed.#01........: 3174.4 kH/s (92.11ms) @ Accel:16 Loops:4096 Thr:512 Vec:1
Speed.#02........: 3172.7 kH/s (91.26ms) @ Accel:16 Loops:4096 Thr:512 Vec:1
Speed.#*.........: 6347.1 kH/s
------------------------------------------------
* Hash-Mode 12500 (RAR3-hp) [Iterations: 262144]
------------------------------------------------
Speed.#01........: 373.2 kH/s (10.80ms) @ Accel:18 Loops:16384 Thr:256 Vec:1
Speed.#02........: 376.7 kH/s (10.71ms) @ Accel:18 Loops:16384 Thr:256 Vec:1
Speed.#*.........: 749.9 kH/s
--------------------------------------------
* Hash-Mode 13000 (RAR5) [Iterations: 32799]
--------------------------------------------
Speed.#01........: 342.6 kH/s (91.85ms) @ Accel:6 Loops:1024 Thr:1024 Vec:1
Speed.#02........: 346.5 kH/s (90.81ms) @ Accel:6 Loops:1024 Thr:1024 Vec:1
Speed.#*.........: 689.1 kH/s
--------------------------------------------------------------------------------
* Hash-Mode 6211 (TrueCrypt RIPEMD160 + XTS 512 bit (legacy)) [Iterations: 1999]
--------------------------------------------------------------------------------
Speed.#01........: 2633.9 kH/s (91.69ms) @ Accel:6 Loops:500 Thr:1024 Vec:1
Speed.#02........: 2655.7 kH/s (90.74ms) @ Accel:6 Loops:500 Thr:1024 Vec:1
Speed.#*.........: 5289.6 kH/s
-----------------------------------------------------------------------------------
* Hash-Mode 13400 (KeePass 1 (AES/Twofish) and KeePass 2 (AES)) [Iterations: 24569]
-----------------------------------------------------------------------------------
Speed.#01........: 447.3 kH/s (80.56ms) @ Accel:5 Loops:1024 Thr:1024 Vec:1
Speed.#02........: 453.2 kH/s (79.52ms) @ Accel:5 Loops:1024 Thr:1024 Vec:1
Speed.#*.........: 900.6 kH/s
-------------------------------------------------------------------
* Hash-Mode 6800 (LastPass + LastPass sniffed) [Iterations: 100099]
-------------------------------------------------------------------
Speed.#01........: 114.2 kH/s (93.03ms) @ Accel:12 Loops:1024 Thr:512 Vec:1
Speed.#02........: 115.4 kH/s (92.09ms) @ Accel:12 Loops:1024 Thr:512 Vec:1
Speed.#*.........: 229.6 kH/s
--------------------------------------------------------------------
* Hash-Mode 11300 (Bitcoin/Litecoin wallet.dat) [Iterations: 200459]
--------------------------------------------------------------------
Speed.#01........: 45634 H/s (77.61ms) @ Accel:4 Loops:1024 Thr:1024 Vec:1
Speed.#02........: 45648 H/s (77.45ms) @ Accel:4 Loops:1024 Thr:1024 Vec:1
Speed.#*.........: 91281 H/s
Started: Tue Aug 19 16:48:42 2025
Stopped: Tue Aug 19 16:54:11 2025
Show all 208 linesShow fewer lines
Absolutely no complaints about this setup. It is fast, it is simple, it is Bambino. What it is not though, is utilised. When we are not on assignments where cracking is relevant or necessary, what does it do? Well, in the beginning it did nothing. This bothered me more than it should have, but mostly on account of me having a worse GPU at home for gaming, which saw way more utilisation than these 2 monster GPUs.
The big shift
So in early 2026, I started experimenting with open-weight models on my GPU at home, and I was honestly pretty impressed. It was no Mythos or GPT-Sol, but I thought it was really neat that this (limited) capability was now available at home. So the logical next step for anyone is of course to abuse employer benefits, such as having access to powerful hardware (although bringing it home for gaming was off the table).
There are many reasons for wanting a local LLM box, and in our situation, one of the main cases is privacy. Customer data is precious for not only our customers, but us as well. What kind of cyber security company would we be if we couldn't keep our customers' data safe? Even though we do not do any kind of hosting, we have reports, password hashes, and a ton of other potentially sensitive information. Although most data is only kept temporarily while we are doing assignments, uploading confidential or sensitive data to third-party tools, such as aforementioned crackstation or even worse, frontier LLM labs like Anthropic or OpenAI, takes that out of our control, so it is not even an option we have.
Another point is those pesky safeguards. What we do is one of the biggest red flags to these frontier models. They do not want to do what I need it to do out of the box.
So our solution became, frontier labs for development where possible, and Bambino for everything else.
Okay sure, but what does it do?
So, so, so much.
At home I was using OpenWebUI and Ollama for the backend, as these seemed by far the most plug-and-play, and the same worked for Bambino, since Ollama supports multi-GPU, and has an OpenAI API compatible endpoint.
So while compute is important for cracking passwords, VRAM is king for LLM workloads. With a whopping (I really wanted to use that word) 32GB VRAM per card, we can run some pretty capable models with a ton of context, all sitting cosy in VRAM.
Take qwen3.8 at Q8 as an example:
docker exec ollama ollama ps
NAME ID SIZE PROCESSOR CONTEXT UNTIL
qwen3.8-27b:q8_0 8ca963fccb89 45 GB 100% GPU 245759 4 minutes
docker exec ollama nvidia-smi
| GPU Name | Fan Temp Perf Pwr:Usage/Cap | Memory-Usage | GPU-Util |
|=========================================+========================+=============|
| 0 NVIDIA GeForce RTX 5090 | 71% 51C P1 248W / 600W | 22195MiB / 32607MiB | 44% |
| 1 NVIDIA GeForce RTX 5090 | 68% 49C P1 274W / 600W | 23826MiB / 32607MiB | 48% |
+-----------------------------------------+------------------------+-------------+
At this configuration we get a very lively chat, with very fast token generation:
slot print_timing: id 0 | task 0 | n_gen = 392, tg = 32.72 t/s, tg_3s = 48.57 t/s
slot print_timing: id 0 | task 0 | n_gen = 539, tg = 35.97 t/s, tg_3s = 48.89 t/s
slot print_timing: id 0 | task 0 | n_gen = 686, tg = 38.12 t/s, tg_3s = 48.80 t/s
slot print_timing: id 0 | task 0 | n_gen = 833, tg = 39.66 t/s, tg_3s = 48.88 t/s
slot print_timing: id 0 | task 0 | n_gen = 980, tg = 40.81 t/s, tg_3s = 48.86 t/s
slot print_timing: id 0 | task 0 | n_gen = 1127, tg = 41.71 t/s, tg_3s = 48.88 t/s
And even faster token evaluation:
prompt eval time = 1450.19 ms / 6288 tokens ( 0.23 ms per token, 4335.98 tokens per second)
Of course, chatting is one thing, but what everybody wants is agentic workflows, and I gotta say, the agents do be working and flowing. The 265k context with a capable model has proved to be quite useful for parsing and aggregating data, as well as building new tools, setting up infrastructure, and streamlining some internal processes regarding these themes.
A practical example is parsing file share data. Don't get me wrong, I love spending days going through every interesting file a company has accrued over decades by hand (I'm not crying, you're crying) but the speed at which Bambino can do it, just makes it seem silly. It also lets us focus on more niche and creative tasks, and attack paths.
So what's the catch?
Yeah well what is the catch. Besides the initial cost, there are no downsides to utilising the hardware we already have. The models also aren't frontier level, but still very capable and they are only getting better.
Due to the capabilities of a system like this, we also do not use it for anything offensive/automated attack related. We can only control its actions on our own systems, so that is where it stays.
Those pesky safeguards/guardrails are still present, although convincing them that an arbitrary client agreed to the arbitrary scope is a lot easier, and the same models can be downloaded without any guardrails at all at the cost of some tokens/s, so this is practically a non-issue.
These days we try to use LLMs where they make sense, and Bambino (it's not child labour, I swear) is cranking out tokens almost 24/7, and I expect we, as a company, will be getting more GPU power before we get less.
Sources
https://crackstation.net/- hashcat:
https://hashcat.net/hashcat/ - John the Ripper jumbo:
https://github.com/openwall/john https://openwebui.comhttps://ollama.com/
