Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I need to extract a password from a hash. This hash was generated by prepending and appending two different predefined strings to the password:

Hash(PredefinedString1+Password+PredefinedString2)

Given both predefined strings and the resultant hash of the concatenation, is it possible to use a tool such as rtgen to create a rainbow table based on knowledge of these strings?

share|improve this question
1  
Do you only want to unhash one password? Then creating a rainbow table is pointless –  Longpoke Feb 7 '13 at 20:55

2 Answers 2

up vote 3 down vote accepted

You would have to either find a tool which already handles exactly this kind of hashing, or modify one to suit your needs. For instance, this project seems to contain an opensource rainbow table generation implementation.

Of course, such a table would be produced for specific values of "PredefinedText1" and "PredefinedText2" and would be useless to attack hashes which were computed with distinct text values. If you have only one password to crack, or if you have several but all in one go, then it would be more efficient to do a direct dictionary attack on the password. Rainbow tables, like all kinds of precomputed tables, are interesting only if you plan to attack several hashes at distinct times.

share|improve this answer
    
Great suggestion. I decided to find an opensource project (mrtg) and modify it for my needs.. –  Lexicon Feb 7 '13 at 21:27

This should be an easy change. The reduction function is almost always variable in some way so you can select whether you're reducing to all number, varying letters and symbols, etc. All you have to do is a last line before the reduction function returns which includes concatenating your starting and ending strings.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.