Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I have a hashed password and the plaintext password and i want to know the exact algorithm that's been used. I have the input and the output of the hash/encription algorithm. How would I know what algorithm is used?

share|improve this question
    
Sometimes a hash identification tool does not work because of pre-hash salt addition. Adding a random or even a non-random string to the password (or in some cases doing a mathematical operation on the password where that operation is only known to the system developers or owners) before hashing it secures it against against rainbow tables and makes it difficult to even detect what type of hashing algorithm was used apart from the obvious length of the hash. So if you have a salted hash, not really much can be done. –  Fahad Yousuf Aug 29 '13 at 22:41
add comment

2 Answers

There is only one solution: try all known algorithms on your input until you find your output.

share|improve this answer
    
I know. I was hoping there is a program that would do that for me. Do you know where I can find a list of all known algorithms or a program that will hash smth many times with many algorithms –  user30162 Aug 29 '13 at 22:08
    
You may be able to narrow down the possibilities with a hash identifier tool. –  paraxor Aug 29 '13 at 22:10
    
I've tried it.That's only linux tool right?I've used it with kali, but hash id don't recognize most of my hashes –  user30162 Aug 29 '13 at 22:16
add comment

I've never really tried to do this, but I've hung around with people who do that all the time. What I gather is that it is a bit of an art.

In some cases you can tell by length. For example SHA1 will produce 20 byte hashes (plus salt). Other schemes will have different outputs. Also you might find this hashes with separators in them (for things like salts and so on). Different systems for creating passwords have various conventions.

The people behind John the Ripper have a list of samples, but it isn't very complete. But you should at least be able to use it to eliminate some possibilities.

If you have a large dump of hashes, try testing them with some of the plausible formats using just the top 500 or so most common passwords. ()'123456', "Password1', etc). Once you break one of the hashes with something like that, you will know what scheme is used.

If you want to get some idea of how the experts do this (often with very tricky hashes) you should read some of the write-ups from the teams who have competed in Korelogic's "Crack Me If You Can" competitions.

You might try search or posting to the john-users mailing list. I have found them extremely helpful in these kinds of things. There is also an active community of haschat users as well.

But because this is an art, most people will need to know more about your hash (where it came from, what it looks like) before they can give you specific help.

share|improve this answer
    
Well thank you for the answers, they really helped me much, and I'm gratefull, but I won't be able to crack most of my hashes, I'm new to this and I thought it would be easier. If you could help me further or crack some hash for me that will be nice and I'll donate some BTC too. –  user30162 Aug 30 '13 at 21:18
    
$1$0t4.Ht1.$.0a.IHEMtCkcV52rnD6E./ $1$0t4.Ht1.$5QRdGjQ14n2X87BIg5ykr/ 351683ea4e19efe34874b501fdbf9792:9b 85c9b16a1223fd97976dc7c9dfccb1f2:c2 51c2d0c55aca2e9690f0ca2ea0924f998cb6eaf64f6c81e920cad6a66c7a1ead8dbd8f42de73f4ac‌​8952e76b48c430caaf43f51cf1c75b14223401bf –  user30162 Aug 30 '13 at 21:29
    
00a6f3e6 21ce1c5b8073f555457eff1f84ed9ef4751f2838c35e01112ec2b2c39edebe219fd94c7001f25e6a‌​5c4a44c5c8d7f386bf8194926a2de14db3c8690b2e511b82 200b1ac97ce04b5f34b47ad2b0957bd5a95f6d9359f7c1a6fb3f3e75ae4aef213d55a703ef9d8fc3‌​382e73fe1764ffea735ab5d788db60217812679a1b086b62 *13F84CC62636F799FE455B4B4BD45DB6C02F599B *BE8871D5BA47C6C91924D9AA1690F6B5CFA24140 *6BB4837EB74329105EE4568DDA7DC67ED2CA2AD9 2f2119395b88c55448ca1c8a26022af28b6uMg#@MG 2f2119395b88c55448ca1c8a26022af28b6uMg#@MG 30aec92beed3dd31eb8eebfa81b6ba4cSvUGFThKhY b04ec0ade3d49b4a079f0e207d5e2821 –  user30162 Aug 30 '13 at 21:29
    
e2653e33fc8e0879c05eb3a9a11cc0f2 a5efa3fa19a6569b6044c9f82c9388d4 $P$BrJ/Ii4AQBJP4f9aOR5xgDd7BzKNJP1 $P$B0m7P/lXoVzQFLRy06gyPfgSCnWinO/ c3cc8da63bed638717a36ceb599ea9bea5b3d080 2229fbbca24bc9c3561cd06cd03ebbf060a16695 5259f675ee5c92c1ac23ce6744fdab2839230244 7886d05720cc2c59923631ef00804c9d3e3492f4 2d77425afcb566a11fd401c5860046db50d929f6 6f50fa58dfa1c46abcd9d74d3f122477b0c81851 05dcd592d1a1ea4849504076cfb810938d9d0525 7886d05720cc2c59923631ef00804c9d3e3492f4 c1a46a82bed3313c59e31247e4cf5fa6386ee3d6 –  user30162 Aug 30 '13 at 21:30
    
8u2CCrVkl1rtPprKw5InxjZW9qZx9DbqSzM9YbgYyvQ= ETplcrIIlod+oF2qKHMQeGGfobDT3RCt5m8RZF9kJA8= m2KCQz8KfuL6c/3PnEhVojuvowBWhTFpxbAQLB9f8uA= wcFKZ2wECNVP2wtRCKlkebGSRzcfq/2/nCLLuFMY/TY= –  user30162 Aug 30 '13 at 21:31
show 4 more comments

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.