Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
I have a question about John the Ripper and it's incremental mode. As far as I know, the incremental mode is a brute-force mode, and it tries to get the password by systematic combining all possibilities for a password.
Depending on the password type it takes longer, that's clear. But let it be a md5 salted password hash. Is John automatically using the salt which is written in cleartext on /etc/shadow file to crack the password? or is it also guessing a valid salt?
Most attacks on salted hashes assume that the salt directly accompanies the hash, usually directly in the hash format itself, or in a "hash:salt" format.
If you know the plaintext and you're trying to figure out the salt, you can use methods like the ones in my answer here.
If you know neither the plaintext nor the salt, that's trickier. MDXfind can generate short salts for you and also accept wordlists as plain text, so if it's a short static salt shared among many passwords, you can discover the salt.
But out of the box, most tools aren't going to try to guess both the plaintext and the salt simultaneously unless you do something to explicitly make that happen.
