Add autocrack payload suite (alert + user tools)

[sinXne0]

Summary

• add auto_crack alert payload under library/alerts/handshake_captured/
• add handshake_cracker user payload under library/user/exfiltration/
• add wordlist_manager user payload under library/user/general/
• include README files for usage, configuration, and requirements
• use placeholder URLs (example.com) for staged wordlist downloads in wordlist_manager

Notes

• payload scripts are executable and follow existing repo folder conventions
• tested for shell syntax and path consistency before submission

[hak5darren]

There is potential in high traffic environments for this payload to run multiple times concurrently -- which will not be good performance wise. I highly recommend adding a check here at the top to see if aircrack is currently running, and if it is to exit 0. Since alert payloads execute automatically based on triggers from the wifi airspace, as it stands currently this payload can exhaust system resources if multiple handshakes are captured in a short period of time.

[sinXne0]

I appreciate the feed back and I will work on it thank you Sent from my iPhoneOn Feb 24, 2026, at 4:56 PM, Darren Kitchen ***@***.***> wrote: @hak5darren requested changes on this pull request. In library/alerts/handshake_captured/auto_crack/payload.sh:

+# $_ALERT_HANDSHAKE_TYPE - EAPOL or PMKID

+# $_ALERT_HANDSHAKE_COMPLETE - true/false +# $_ALERT_HANDSHAKE_CRACKABLE - true/false +# $_ALERT_HANDSHAKE_PCAP_FILE - Path to PCAP +# $_ALERT_HANDSHAKE_HASHCAT_FILE - Path to hashcat format + +# ============================================ +# MAIN EXECUTION +# ============================================ + +# Check if handshake is crackable +if [ "$_ALERT_HANDSHAKE_CRACKABLE" != "true" ]; then + LOG red "Handshake not crackable, skipping..." + exit 0 +fi + There is potential in high traffic environments for this payload to run multiple times concurrently -- which will not be good performance wise. I highly recommend adding a check here at the top to see if aircrack is currently running, and if it is to exit 0. Since alert payloads execute automatically based on triggers from the wifi airspace, as it stands currently this payload can exhaust system resources if multiple handshakes are captured in a short period of time. —Reply to this email directly, view it on GitHub, or unsubscribe.You are receiving this because you authored the thread.Message ID: ***@***.***>