From cryptographic theory to a measured demonstration, on an isolated lab
This project complements the honeypot lab with the 'compromised password' angle: how a password is actually stored, why it cannot be 'decrypted', and how industry-standard tools (John the Ripper, Hashcat) automate testing thousands of candidates per second.
Everything ran on the lab's attacker machine (Kali Linux), with no network or external target — only hashes generated locally for the demonstration.
Hashcat requires a working OpenCL backend even for CPU-only use, absent by default on this GPU-less VM. Resolving it took several steps: the expected package (pocl-opencl-icd) did not exist in Kali's repositories, so the mesa-opencl-icd alternative (llvmpipe software rendering) was installed instead.
The OpenCL platform then remained invisible to Hashcat (0 devices exposed) until explicitly enabled via the RUSTICL_ENABLE environment variable. A first attempt at making this persistent failed because it was placed in ~/.bashrc, while Kali's default shell is Zsh, which does not read that file.
Once the device was detected, the benchmark still failed with a memory allocation error, resolved by raising the VM's allocated RAM from ~2 GB to 8 GB in VMware settings.
