Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
If I know the password, the salt (supposed salt actually) and the output hash (sha1 format). How can I find the hash creation method ?
I tried basic stuff like
sha1(salt+password)
sha1(password+ salt)
sha1(salt +sha1(password))
sha1(sha1(password)+ salt)
... and a lot more, but all failed.
What is the correct tool to look for the hash creation method ? Is the only best option to decompile the software ?
Decompiling the software is probably easiest.
Passwords are typically hashed with many iterations (like 100,000) of the hash function to slow down brute-force attacks that are trying to guess the password. Typically the server-side hashing code looks like this:
hashval = password
count = 0
while(count++ < NUM_HASH_ITERATIONS):
hashval = sha1(hashval + salt)
return hashval
Depending on the software you are trying to break, you may be able to find the constant NUM_HASH_ITERATIONS in a config file somewhere, otherwise you'd either need to decompile the binary for it, or brute-force it. I don't know if off-the-shelf software exists to brute-force the number of iterations, but typical values, but it wouldn't be too difficult or CPU-intensive since you just try hashing it, and if it doesn't match, hash it again up to some limit like 1 million
hashval = "password"
count = 0
while(count++ < 1000000):
hashval = sha1(hashval + salt)
if (hashval == "3a58f2b..."):
// We win!
that should run in a few minutes, and try it a bunch of times with different permutations for how the hash and salt are combined. Note that there are lots of things whose output looks the same as SHA1, so unless you know for a fact that it's SHA1, you may need to try those variants with MD5, SHA2-256, SHA2-384, SHA2-512, PBKDF2, BCRYPT, SCRYPT, ...
login:5baa61e4c9b93f3f0682250b6cf8331b7ee68fd8 so definitely like a SHA1 hash (20 bytes). MD5 produces 16 bytes long hash, SHA2-256 32 bytes long, SHA2-384 48 bytes, SHA2-512 64 bytes. Of course hash could be truncated but it just sounds weird to truncate. And PBKDF2, BCRYPT, SCRYPT are still unknown to me but hashes look different.