I found a pattern password generation that works like that:

sha1("very long static prefix text blablabla "+password+" very long static suffix text");

I tried hashcat combined attack or rules, but the size rule limit and only two wordlist combined stopped me.

What's the best approach to crack it?

1 Answer 1


The static prefix and suffix text can be considered a salt before and after the password. Fortunatly, when taking a look at the Hashcat example hashes, they provide a hash mode for our needs.

19300   sha1($salt1.$pass.$salt2)   630d2e918ab98e5fad9c61c0e4697654c4c16d73:18463812876898603420835420139870031762867:4449516425193605979760642927684590668549584534278112685644182848763890902699756869283142014018311837025441092624864168514500447147373198033271040848851687108629922695275682773136540885737874252666804716579965812709728589952868736177317883550827482248620334

The hash needs to be provided to Hashcat in the following pattern very long static prefix text blablabla:hash:very long static suffix text and with the flag -m 19300 to specify the correct Hash mode.

After that, attacks can be launched normally, without the need of providing the static text in a rules file etc.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .