0

pbkdf2:sha256:600000$m28HtZYwJYMjkhJ5$2d481c9f3fe597390e4c4192f762188bf311e834030a11e069019015fb336c14

This is the format in which I have the hash. I also have a dictionary which consists of the actual password. How do I use some tool (like john the ripper or hashcat) to crack this hash?

2
  • Please clarify your specific problem or provide additional details to highlight exactly what you need. As it's currently written, it's hard to tell exactly what you're asking.
    – Community Bot
    Commented May 24 at 15:13
  • Have you looked up john's documentation? I found the duplicate as the top hit when googling "crack pbkdf2 sha256 with john". Please make sure to do a little research yourself before posting questions.
    – schroeder
    Commented May 24 at 21:24

1 Answer 1

0

John expects hashes to be in a specific format in order to crack them. You can use the --list=format-details option to show an example hash:

$ john --format=PBKDF2-HMAC-SHA256 --list=format-details
[...] $pbkdf2-sha256$1000$b1dWS2dab3dKQWhPSUg3cg$UY9j5wlyxtsJqhDKTqua8Q3fMp0ojc2pOnErzr8ntLE

Although actually John often supports multiple different variants of the format (often with slightly different encodings or suchlike), which you can see if you dig into the source code:

https://github.com/openwall/john/blob/bleeding-jumbo/src/pbkdf2_hmac_common_plug.c#L546

So you need to convert your hash to a format that matches what John in looking for. In your case, that means restructuring the bit at the start to match what John expects, and converting the body of the hash from hex to base64.

4
  • If I have == at the end of the base64 do I include it? Also is the salt also base64 encoded? Commented May 24 at 14:40
  • None of the example hashes appear to have trailing = as padding, so I would guess not. But you can try both with and without, and see which John accepts.
    – Gh0stFish
    Commented May 24 at 15:11
  • Okay thanks for your help! Commented May 24 at 17:36
  • it is Base64 encoded, so even double = is possible in the end
    – kelalaka
    Commented May 24 at 17:41

Not the answer you're looking for? Browse other questions tagged .