I can't find a tool that supports cracking SHA-1s with different pre and post salts. Any suggestions?
closed as off-topic by Steffen Ullrich, Sjoerd, Xander, AndrolGenhald, A. Hersean Feb 28 at 17:29
This question appears to be off-topic. The users who voted to close gave this specific reason:
- "Questions seeking product recommendations are off-topic as they become obsolete quickly. Instead, describe your situation and the specific problem you're trying to solve." – Sjoerd, Xander, AndrolGenhald, A. Hersean
John the ripper (current bleeding-edge community version), can handle this easily. Simply use the command line switch
--format=dynamic=sha1($s.$p.$s2) (note the single quotes are required), and it can easily handle the data. you WILL have to put the data into proper input format for this to be read by the dynamic format within john.
Ok, here is an example listing how you will have to format the input data:
salt=e0b88e64 salt2= 35644f9d password=passweird
input hash file (inp): @dynamic=sha1($s.$p.$s2)@6fedfebd8127ad6c10ddb25e8584f4d24412259e$e0b88e64$$235644f9d
wordlist file (pw) abc password passweird something_else
Now running the command:
$ ../run/john '--format=dynamic=sha1($s.$p.$s2)' --wordlist=pw inp Using default input encoding: UTF-8 Loaded 1 password hash (dynamic=sha1($s.$p.$s2) [128/128 SSE2 4x1]) Warning: no OpenMP support for this hash type, consider --fork=2 Press 'q' or Ctrl-C to abort, almost any other key for status Warning: Only 4 candidates left, minimum 24 needed for performance. passweird (?) 1g 0:00:00:00 DONE (2019-02-28 11:08) 8.264g/s 33.05p/s 33.05c/s 33.05C/s abc..something_else Use the "--show --format=dynamic=sha1($s.$p.$s2)" options to display all of the cracked passwords reliably Session completed
This shows the password being found. Note, for john to properly read the data, it will have to be formatted similar to what I show in the 'inp' file for this example hash.
John (current bleeding jumbo), can be found at: https://github.com/magnumripper/JohnTheRipper