Hashcat Maskprocessor Intruder Payloads
Summary: PortSwigger's BApp Store lists a Burp Intruder extension, version 1.0 by author Quahac, that integrates Hashcat Maskprocessor, a word generator with a per-position configurable charset. The listing gives usage examples such as Password?d generating Password0, Password1 and Password3, and Password?1 -1 0A@ generating Password0, PasswordA and Password@, and notes the extension was last updated on 16 October 2020.
Bottom line: The extension is third-party code that PortSwigger explicitly makes no warranty about for quality or usefulness, and it has sat unupdated since October 2020 - so anyone running it in Burp is trusting a five-year-old payload generator inside their testing toolchain.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026