I have a working script done with python to do dictionary attack on a few hashes
import hashlib
def main():
print("Starting...")
users = []
with open('users.txt') as f:
for line in f:
splitted = line.split()
users.append(User(splitted[1], splitted[2], splitted[3]))
with open("hashes.txt", 'w') as f:
for user in users:
f.write(user.hash + '\n')
for user in users:
print(user.name, user.salt, user.hash)
print()
i = 0
with open("10-million-password-list-top-1000000.txt") as f:
for pwd in f:
pw = pwd.rstrip()
i += 1
if i % 100000 == 0:
# Still running
print(i)
for user in users:
newHash = get32Hash(pw, user.salt)
if newHash == user.hash:
print("Password found: " + pw + " for user "+ user.name)
with open('crakked.txt', 'a') as f:
f.write(user.name + ' : ' + pw + '\n')
users.remove(user)
def get32Hash(pwd, salt):
return hashlib.sha256(b"[generic_salt]" + str.encode(pwd) + str.encode(user_salt)).hexdigest()[0:32]
class User:
def __init__(self, name, salt, _hash):
self.name = name
self.salt = salt
self.hash = _hash
main()
All the hashes and their custom salts are marked in users.txt
How can I use John-the-Ripper with the custom limited 32-bit length hash from get32Hash-function? It would be much more efficient to be able to use mangling etc. from John.