I am writing a basic Unix password cracker in Python that would work for MD5, SHA-1 and SHA512.

I know that the salt in MD5 correspond to the 2 first chars of the encrypted password, and thus I assumed that it would be the same for SHA.

But after looking at some answers on SO (here for example), it seems that a Salt can be any string you want.
So, my question is how can I determine the salt part from a hashed password in SHA in the /etc/shadow file ?

I think it is between two $ but I am not completely sure.

I wondered in which SO site it would be the most usefull (Unix or Security) so pardon me in advance if I mischoose.


  • 2
    Simply said, you cannot. However, the salt is in most cases no secret so your cracker should have an option to specify the salt. See f.e. hashcat hashcat.net/wiki/doku.php?id=hashcat – bayo Aug 24 '15 at 8:56

On most modern distributions, the salts and the hashed passwords are stored in the shadow file /etc/shadow (which is only readable by root), not the /etc/passwd file. For each user record in /etc/shadow, the salt is between the 2nd $ and the third $. See answer by mti2935 in https://stackoverflow.com/questions/18035093/given-a-linux-username-and-a-password-how-can-i-test-if-it-is-a-valid-account for more info.

  • Thank you, that what I thought, but I prefered to be sure (and passwd instead of shadow was a mistake). – P1kachu Aug 24 '15 at 11:37

Since you are talking about Unix, and since you are rather talking about /etc/passwd file instead of /etc/shadaw, I presume you are talking either about a Unix system (as you said) or an old based distribution, so I prefer to quote you this directly as it answers your question:

Earlier versions of Unix used a password file (/etc/passwd) to store the hashes of salted passwords (passwords prefixed with two-character random salts). In these older versions of Unix, the salt was also stored in the passwd file (as cleartext) together with the hash of the salted password.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.