I have a set of password hashes. Sample:
From the source code of the application generating this hash I learned that the salt is prepended as the first 6 characters and the overall algo producing the hash is:
salt + SHA256(salt + password)
Knowing the cleartext password for the above hash (helloworld) I was able to confirm my assumption gleaned from the source code on Linux command line (command + result):
printf 9e7443helloworld | sha256sum 7e97ff201ff38416138a22a7f3adfa3b9c10e947481bd94b16eed7df6b6e2806 -
Now as I said I have a set of those hashes and I'd like to set John The Ripper against them and use dictionary attack. I guess it can be done using
--rules flag and supplying custom configuration file with custom rules. But I'm not sure this is the right way and not familiar with JTR's mangling rules.
Can you please show me the way of achieving my goal with JTR?