6

To keep it short I've recently been learning about hashing and password hash cracking on TryHackMe. I was tasked to crack the following hash: $2y$10$0veO/JSFh4389Lluc4Xya.dfy2MF.bZhz0jVMw.V.d3p12kBtZutm

When trying to crack with hashcat I used the following command to attempt to crack the hash:

hashcat.exe -a 0 -m 3200 hashes.txt ./rockyou.txt

During the attempt hashcat reported a speed of: 52 H/s (3.91ms).

When cracking the hash with john the ripper I used the following command:

john --format=bcrypt --wordlist=rockyou.txt hashes.txt

During the attempt JTR reported a speed of: 111.4p/s 111.4c/s 111.4C/s

JTR was able to crack that hash in 7 min, 3 secs, whilst hashcat tool 15 mins, 11 secs. That makes JTR more than twice as fast as indicted by the hashing speeds. So my question is, why is JTR so superior in this scenario? As I understand both methods were using CPU over GPU since its bcrypt. Is it simple a matter of a more refined algorythm for JTR? If so any deeper details would be greatly appreciated.

1
  • Hey, great first question! I edited the formatting for you to be more easily readable.
    – user163495
    Commented Jan 28, 2021 at 23:03

1 Answer 1

2

Most likely explanation: which implementation takes advantage of CPU-specific instruction optimizations.

  • For john, See john -list=build-info for which Build/SIMD options are enabled.
  • For hashcat, I'm not sure if there's a way to show which CPU instructions are used for a given algorithm, other than looking at the source code and the compiler output.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .