0

Simple question for y'all as i'm having some trouble identifying the hash type of this from a http digest file that I have setup for rutorrent on a apache2 server.

Here's an example of what it looks like:

user:rutorrent:*MD5-HASH*

The first two are in plain text while the password is entirely hashed...and not knowing what kind of hashing was used on this, I did some research but haven't found any concrete answers as to what this is. Seeing it's in the form of a HA1 (Part of the process of Auth Digest), that's my only clue as to what it is...but i'm unaware of what kind of hash the password is.

I used john-the-ripper to determine and see what kind of hash-type it is but that didn't work out.

This hash was generated by rutorrent (I believe) and is placed in the file named "htpasswd" from "/etc/apache2". Maybe some of y'all might know what it may be? Please do help me if you can...I'm stuck on figuring out what this could be heh.

Improve this question
4
  • Why do you need to do this?
    – Neil Smithline
    Commented Aug 18, 2015 at 18:35
  • 1
    To see how secure and strong this hash-type is as I learned a variety of different hash-types, how strong they are against cracking and more. With this one, I never seen such a hash-type before until now and thought someone on here might know what it is.
    – Hash-Wonderer
    Commented Aug 19, 2015 at 0:29
  • htaccesstools.com/articles/htpasswd
    – Neil Smithline
    Commented Aug 19, 2015 at 0:47
  • So about that link (thanks for helping btw), I already know what encryption that is as it's the apache2 "$apr1" but the one i'm asking about is different and I've already given an example of what it looks like. It's in this format: username:realm:hashed-password Both username and realm are in plain-text, but for some reason the password is hashed in some MD5 encryption and I believe it's created by rutorrent. If you want, I can send you an actual sample privately (for security reasons) of what it looks like. Anyways thanks for helping, if anyone knows what this could be...please reply!
    – Hash-Wonderer
    Commented Aug 23, 2015 at 10:02

2 Answers 2

Reset to default
1

32-hex hashes are impossible to indirectly verify, programatically or heuristically. The only way to verify is directly - by actually cracking at least one.

For future searchers, according to this Arch Linux page, ruTorrent password hashes are straight MD5, and not some kind of nested/truncated/salted variant:

$ echo -n "tom:rtorrent:secret_pass" | md5sum | cut -b -32
6a4aaa1091eb2d1d025bbd692dee3f0c
Improve this answer
0

I don't know what a "http digest file" is. If you mean a password validation database created with htaccess, then the format of the hashed password entries is very well documented, and is very unlikely to use a md5 function directly (it may use smd5). The point of hashing a password is to make it hard to recover the plaintext.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .