0

I'm conducting tests using hashcat and find it very difficult if the hash is encoded.

See the below function which takes the plain text, converts that to the bytes, creates the SHA512 hash and then encode to string.

static string GetSHA512Hash(string message)
    {
        using (var sha512 = SHA512.Create())
        {
            byte[] hashedBytes = sha512.ComputeHash(Encoding.UTF8.GetBytes(message));
            return Encoding.UTF8.GetString(hashedBytes);
        }
    }

So the input "P@ssw0rd" (without quotes) would output below with unicode characters:

k??☻k_▬'???♣????gJ?▬?\t"?_?▬?▬0G?z▼BoOLk[PB?q?O?s►?[↑>?Y?'F♦

I cant find a way to crack the above password using hashcat. What Am I missing?

On the other hand, if I just hex convert the bytes of the hash, at least one can attempt cracking it using hashcat.

static string GetSHA512HashAsHex(string message)
    {
        using (var sha512 = SHA512.Create())
        {
            byte[] hashedBytes = sha512.ComputeHash(Encoding.UTF8.GetBytes(message));
            return BitConverter.ToString(hashedBytes).Replace("-", "");
        }
    }

So the input "P@ssw0rd" (without quotes) would output below and It can be cracked using hashcat (or at least one can attempt it) 6BFCC4026B5F162799A6DC8305C09DB9C1674AC616BD5C7422A45FBB6D0816AC163047C47A1F426F4F4C6B5B5042C671EABC4FDC7310FD5B183EEF59DC274604

When I try to decode the unicode output above and then hex it, It(obviously) outputs different hex for "P@ssw0rd"

static string GetSHA512HashAsOriginal(string message)
    {
        byte[] hashAsBytes = Encoding.UTF8.GetBytes(message);
        return BitConverter.ToString(hashAsBytes).Replace("-", "");
    }

6BEFBFBDEFBFBD026B5F1627EFBFBDEFBFBDDC8305EFBFBDEFBFBDEFBFBDEFBFBD674AEFBFBD16EFBFBD5C7422EFBFBD5FEFBFBD6D0816EFBFBD163047EFBFBD7A1F426F4F4C6B5B5042EFBFBD71EFBFBD4FEFBFBD7310EFBFBD5B183EEFBFBD59EFBFBD274604

Does it mean Encoding.UTF8.GetString(hashedBytes) (as in the GetSHA512Hash()) would make the cracking process very difficult OR there is a way to do it in this example?

Complete code to test here : https://dotnetfiddle.net/xpQ6lX

Output when "P@ssw0rd" is used as input to hash Complete code in case the dotnetfiddle does not work :

using System;
using System.Security.Cryptography;
using System.Text;
                    
public class Program
{
    public static void Main()
    {
        while (true)
        {
            Console.WriteLine("Enter the plain text password : \n");
            string plainTextPassword = Console.ReadLine();
            string Sha512Hash = GetSHA512Hash(plainTextPassword);
            string Sha512HashAsHex = GetSHA512HashAsHex(plainTextPassword);
            Console.WriteLine("SHA512 hash bytes encoded as string " + Sha512Hash);
            Console.WriteLine("SHA512 hash bytes encoded as Hex " + Sha512HashAsHex);
            Console.WriteLine("SHA512 hash bytes back to original " + GetSHA512HashAsOriginal(Sha512Hash));
        }
    }
    
    static string GetSHA512Hash(string message)
    {
        using (var sha512 = SHA512.Create())
        {
            byte[] hashedBytes = sha512.ComputeHash(Encoding.UTF8.GetBytes(message));
            return Encoding.UTF8.GetString(hashedBytes);
        }
    }

    static string GetSHA512HashAsHex(string message)
    {
        using (var sha512 = SHA512.Create())
        {
            byte[] hashedBytes = sha512.ComputeHash(Encoding.UTF8.GetBytes(message));
            return BitConverter.ToString(hashedBytes).Replace("-", "");
        }
    }
    static string GetSHA512HashAsOriginal(string message)
    {
        byte[] hashAsBytes = Encoding.UTF8.GetBytes(message);
        return BitConverter.ToString(hashAsBytes).Replace("-", "");
    }
}
5
  • This is pure programming question and is off topic on Security SE.
    – mentallurg
    Commented Jul 10, 2022 at 20:04
  • My question was around hashcat and if it could crack password with Unicode characters. The question just has the prep work to show the output of my tests and failures. Commented Jul 10, 2022 at 21:03
  • Actually, you are asking how to feed hashcat unicode strings, or you are asking how to convert unicode strings into a format that hashcat can handle. And your "unicode" example is actually a byte example. That's not a problem with "encoding" as you initially state,
    – schroeder
    Commented Jul 10, 2022 at 21:09
  • 1
    Have you looked at resources like: hashcat.net/forum/archive/index.php?thread-6251.html
    – schroeder
    Commented Jul 10, 2022 at 21:11
  • @schroeder Thank you. Yes. I did look at this. Having hard time how I can use those unicode characters to work with hashcat. Cant see any unicode characters file in the charset folder. Commented Jul 11, 2022 at 13:28

0

You must log in to answer this question.

Browse other questions tagged .