I have a working script done with python to do dictionary attack on a few hashes
import hashlib def main(): print("Starting...") users =  with open('users.txt') as f: for line in f: splitted = line.split() users.append(User(splitted, splitted, splitted)) with open("hashes.txt", 'w') as f: for user in users: f.write(user.hash + '\n') for user in users: print(user.name, user.salt, user.hash) print() i = 0 with open("10-million-password-list-top-1000000.txt") as f: for pwd in f: pw = pwd.rstrip() i += 1 if i % 100000 == 0: # Still running print(i) for user in users: newHash = get32Hash(pw, user.salt) if newHash == user.hash: print("Password found: " + pw + " for user "+ user.name) with open('crakked.txt', 'a') as f: f.write(user.name + ' : ' + pw + '\n') users.remove(user) def get32Hash(pwd, salt): return hashlib.sha256(b"[generic_salt]" + str.encode(pwd) + str.encode(user_salt)).hexdigest()[0:32] class User: def __init__(self, name, salt, _hash): self.name = name self.salt = salt self.hash = _hash main()
All the hashes and their custom salts are marked in
How can I use John-the-Ripper with the custom limited 32-bit length hash from get32Hash-function? It would be much more efficient to be able to use mangling etc. from John.