I am doing a password strength audit (I have permission). I'm using Hashcat. It supports formats like sha-256(password.salt) and sha-256(salt.password) but my hashes are generated by sha-256(username+"|"+password+"|"+salt).

So, ideally:

  1. I would provide a file in the format username,salt,hash
  2. hashcat would concatenate username, [password guess], salt,
  3. hashcat would hash that string and compare it to the hash.

Is there a tool in hashcat that helps me define how the parts of the hash are concatenated, to add to the algorithm options provided?


Hashcat supports rules for modifying word lists on the fly.

You can prepend the username and append the salt in a rule file (save as something.rule):

^username $salt

and use -r in Hashcat to call the rule file.

  • 1
    hashcat's append/prepend rules are actually one character at a time. So this would be something more like ^e ^m ^a ^n ^r ^e ^s ^u ^| $| $s $a $l $t. – Royce Williams Jan 29 '18 at 7:25

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.