This question is about how efficient it is to bruteforce SASL authentication in the XMPP protocol.

I read the XMPP SASL authentication steps (stackoverflow link in case the first one breaks), and reimplemented a script that parses a network capture and extracts the parameters, and recalculates what the client and the server should respond for a given password, and initial negociated parameters (salt, nonces etc.), from what I understand:

Two messages are interesting for an attacker (contain hashes that can be bruteforced), these are: The client reply that includes the clientProof, and the server reply, that includes the serverSignature.

this is the relevant cryptographic part (I'm taking SHA1 as an example hash function):

// s, i are parameters communicated in earlier messages
// password is the authentication password
// authMessage is a message of the form "n=#{n},r=#{r1},r=#{r2},s=#{s},i=#{i},c=biws,r=#{r2}", #{} being used for string interpolation, n the username used for authentication, r1 the clientNonce and r2 the serverNonce

saltedPassword = PBKDF2-HMAC-SHA1(password: password, salt: s, iterations: i, length: 20, hash: 'sha1')
clientKey = HMAC-SHA1(key: saltedPassword, data: "Client Key")

clientProof = clientKey ^ HMAC-SHA1(key: SHA-1( clientKey ), data: authMessage)

clientProof is the p parameter that gets sent by the client.

If authentication succeeds, the server responds with a v parameter, which is:

saltedPassword = PBKDF2-HMAC-SHA1(password: password, salt: s, iterations: i, length: 20, hash: 'sha1')
serverKey = HMAC-SHA1(key: saltedPassword, data: 'Server Key')

serverSignature = HMAC-SHA1(key: serverKey, data: authMessage)

serverSignature is v.

As an attacker, it seems to me that I can bruteforce either p or v using a wordlist, the latter seems to have less operations involved, but it seems that the salt, and the full authMessage are needed for this operation.

Hashcat supports the XMPP SCRAM PBKDF2-SHA1 (23200) hash format, but I can't find a way to include authMessage (which should be needed for computing hashes), looking at an example hash (taken from https://hashcat.net/wiki/doku.php?id=example_hashes):


It looks like they included only a salt, and a hash. Also, no indications on which of the two hashes bruteforce is implemented.

How can hashcat be used to crack hashes obtained from network captures of XMPP traffic?


You must log in to answer this question.

Browse other questions tagged .