Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
I found a pattern password generation that works like that:
sha1("very long static prefix text blablabla "+password+" very long static suffix text");
I tried hashcat combined attack or rules, but the size rule limit and only two wordlist combined stopped me.
What's the best approach to crack it?
The static prefix and suffix text can be considered a salt before and after the password. Fortunatly, when taking a look at the Hashcat example hashes, they provide a hash mode for our needs.
19300 sha1($salt1.$pass.$salt2) 630d2e918ab98e5fad9c61c0e4697654c4c16d73:18463812876898603420835420139870031762867:4449516425193605979760642927684590668549584534278112685644182848763890902699756869283142014018311837025441092624864168514500447147373198033271040848851687108629922695275682773136540885737874252666804716579965812709728589952868736177317883550827482248620334
The hash needs to be provided to Hashcat in the following pattern very long static prefix text blablabla:hash:very long static suffix text and with the flag -m 19300 to specify the correct Hash mode.
After that, attacks can be launched normally, without the need of providing the static text in a rules file etc.
