2

I am doing a password strength audit (I have permission). I'm using Hashcat. It supports formats like sha-256(password.salt) and sha-256(salt.password) but my hashes are generated by sha-256(username+"|"+password+"|"+salt).

So, ideally:

  1. I would provide a file in the format username,salt,hash
  2. hashcat would concatenate username, [password guess], salt,
  3. hashcat would hash that string and compare it to the hash.

Is there a tool in hashcat that helps me define how the parts of the hash are concatenated, to add to the algorithm options provided?

Improve this question

1 Answer 1

Reset to default
3

Hashcat supports rules for modifying word lists on the fly.

You can prepend the username and append the salt in a rule file (save as something.rule):

^username $salt

and use -r in Hashcat to call the rule file.

Improve this answer
1
  • 1
    hashcat's append/prepend rules are actually one character at a time. So this would be something more like ^e ^m ^a ^n ^r ^e ^s ^u ^| $| $s $a $l $t.
    – Royce Williams
    Commented Jan 29, 2018 at 7:25

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .