1

I have a working script done with python to do dictionary attack on a few hashes


import hashlib

def main():
    print("Starting...")

    users = []
    with open('users.txt') as f:
        for line in f:
            splitted = line.split()
            users.append(User(splitted[1], splitted[2], splitted[3]))

    with open("hashes.txt", 'w') as f:
        for user in users:
            f.write(user.hash + '\n')

    for user in users:
        print(user.name, user.salt, user.hash)
    print()
    i = 0
    with open("10-million-password-list-top-1000000.txt") as f:
        for pwd in f:
            pw = pwd.rstrip()
            i += 1
            if i % 100000 == 0:
                # Still running
                print(i)
            for user in users:
                newHash = get32Hash(pw, user.salt)
                if newHash == user.hash:
                    print("Password found: " + pw + " for user "+ user.name)
                    with open('crakked.txt', 'a') as f:
                        f.write(user.name + ' : ' + pw + '\n')
                    users.remove(user)

def get32Hash(pwd, salt):
    return hashlib.sha256(b"[generic_salt]" + str.encode(pwd) + str.encode(user_salt)).hexdigest()[0:32]

class User:
    def __init__(self, name, salt, _hash):
        self.name = name
        self.salt = salt
        self.hash = _hash

main()

All the hashes and their custom salts are marked in users.txt

How can I use John-the-Ripper with the custom limited 32-bit length hash from get32Hash-function? It would be much more efficient to be able to use mangling etc. from John.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.