How can I identify the salt value used in a password hash?

Question

I'm currently learning about password cracking, and I have a set of passwords with their respective hash values. I used Hashcat to crack the hash values, just to see how it works, but I got different passwords. After some research, I found out that salts are used while hashing, and I don't know the salt values used.

Is there a way to identify the salt value used in a password hash? I've heard that John the Ripper can extract salt values from password hashes, but I'm not sure how to use it. Can someone provide a step-by-step guide on how to use John the Ripper to extract salt values from password hashes?

I'm also open to any other suggestions or tools that can help me identify the salt value used in a password hash.

One example: Cracked using MD5 Gives

e10adc3949ba59abbe56e057f20f883e => 123456

But actual password is: experthead

Answer 1

No tool can extract a portion of a string from a hash. If a tool could, then hashing would be utterly useless for passwords.

What you may be referring to is that some hash strings include the salt in plaintext, like:

 01dfae6e5d4d90d9892622325959afbe:7050461

where 7050461 is the salt. But if you didn't have the salt, there would be no way to extract 7050461 from 01dfae6e5d4d90d9892622325959afbe.

Answer 2

I've heard that John the Ripper can extract salt values from password hashes

You just used not precise wording. It is impossible to extract salt from the hash. I think you mean not has, but all the information related to hash. For instance, here is an example of how Linux stores hashes in /etc/shadow: root:$6$bSRbIaVwNNW3DF2p$WF0unbZCKh8GBfwdpseak...

• "$": A separator
• "6": The code of hashing method "yescrypt"
• "bSRbIaVwNNW3DF2p": Salt
• "WF0unbZCKh8GBfwdpseak...": Hash

Only the last part is hash. But some people incorrectly call "hash" the whole string that includes method, salt, and hash. John the Ripper can extract salt from such string. If some people incorrectly call the whole string "hash", then extracting a salt from such string sounds "extract salt from hash". This is just wrong misleading wording.