1

So I felt the saga of my last post was getting too long (linked here: Unknown round length makes hash uncrackable?) so I would create a new one addressing the current problem as it stands. My new avenue is looking like the hashed passwords and salts I have collected are Peoplesoft hashes due to an identification from this tool: https://github.com/psypanda/hashID. To test if that is a false positive I planned to use hashcat to crack my known account hash, which I have the salt and plain text password to, but they only have a mode for unsalted PeopleSoft hashes.

There is a bit of old work done here (https://github.com/kholia/ReversingPeopleSoft) to reverse how PeopleSoft performs salted hash generation but that appears dead.

Does anyone have any leads on how the hash is performed so I can try and recreate my hash to check if it is a PeopleSoft variety or know of a way to coerce Hashcat into using it with a different mode?

Thank you.

Improve this question

1 Answer 1

Reset to default
1

Hashcat currently (Nov 2018) only supports unsalted PeopleSoft hashes - there's no way that I know of to get Hashcat to apply an arbitrary salt to them at speed. I also haven't been able to determine what the actual algorithm is yet, and neither John the Ripper nor MDXfind appear to have support yet for salted PeopleSoft hashes.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .