NTLMRain

Recover NT hashes from NetNTLMv1 responses using local WebGPU computation and remote table lookup.

For more information on this tool, refer to the Outflank blog.

Your browser/system does not expose a WebGPU adapter. You can try to use the CLI tool instead, which also supports CPU-based recovery.

On Linux? Try enabling chrome://flags/#enable-unsafe-webgpu and chrome://flags/#enable-vulkan (paste in the location bar) and restart the browser.

Choose the input type

The selected mode changes how many table lookups run and what can be recovered.

Full NetNTLMv1 response48 hex characters · DES1 and DES2 table lookups + local DES3 · produces an NT hash Single DES ciphertext16 hex characters · one table lookup · produces one 7-byte plaintext chunk and its DES key

NetNTLMv1 response

What do I enter here?

DES1 and DES2 use the tables. DES3 is recovered locally.

Continue automatically through remote lookup and local verification

Idle0.00%

Elapsed0s

ETA—

Current—

Average—

DES steps0 / 0

Endpoints0 / 0

Dispatch—

Waiting for WebGPU.

NTLMRain

Choose the input type

Endpoint files created in this browser

Run the remote table lookup

Files downloaded from the service

Verify candidates locally

Recovered material