2

I've been playing with John The Ripper (JtR) to try to crack/audit a salted password that was hashed with SHA-512, with 20 interactions according to the source (for the curious, this is a Rails app, with the authlogic gem).

If I understood things correctly, JtR expects its hashes in a file, where each hash follows certain format. For SHA512, this format appears to be:

username:$6$SALT$HASH

which seems to be a format that is compatible with the passwd/shadow files.

My problem is that the hash I have in my DB is a hexdigest while it seems that the hash that JtR expects its in Base64.

Am I right in this ascertion? Is there a way to tell JtR to recognize a hexdigest hash (composed of password + salt) that was 'stretched' 20 times?

Thank you.

2
  • This might help you adding your own dynamic function for this "format": blog.thireus.com/…
    – Disenchant
    Mar 2, 2014 at 16:33
  • 1
    That looks like a custom algorithm. So I'd guess that you'd need to modify JtR to add support for this kind of hash. Mar 3, 2014 at 14:26

1 Answer 1

2

From your description it is not clear how the salt and the hash are encoded into the hexdigest in your DB. First, you have to extract the salt and the hash from the digest. Than, you can create the sha512-crypt which is described at http://www.vidarholen.net/contents/blog/?p=33.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .