I have passwords that are stored by:

  • Generating a random, 36-character "string" in the range of CHAR(1) to CHAR(256)
  • Appending this to the entered password
  • Retrieving the SHA512 hash of the result

So, 'password' could have the string ³{ó‘#«,IýD÷¸Eâ‘Óá appended to it (hex representation: 0x04B37BF39123AB2C49FD44F7B845E291D3E1004DB8B2E460AE6E2438FB27B70AF5E1C709)

And then hashed. This is all done in SQL Server, if it matters, but the point is that the hash is a string that will (frequently) contain junk characters that aren't well represented and I think are messing with hashcat reading the input file in.

I then end up with:


as the generated, salted, hashed representation of "password".

I'm struggling to work out how to present this form of salt to hashcat; the examples I can find and have tried to run through hashcat, have worked and if I put a "simple" salt in and generate it, it'll correctly work out the result.

so, my input file looks like:


and a dictionary file containing just "password" -- it retrieves #1 but not #2.

Can anyone advise?

1 Answer 1


So, I've figured this out. Hoping leaving it her helps someone as stupid as me in the future.

In hashcat, you can convert the salt string to it's binary values and present it in hexadecimal form, with the --hex-salt option.

So the input file would look like:


which then, correctly, comes out with the result. :joy:

  • You can accept your own answers, by the way. You have to wait a bit, but it'll mark this question as answered (which it is)
    – anon
    Jul 10, 2019 at 16:53

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .