Podcast #128: We chat with Kent C Dodds about why he loves React and discuss what life was like in the dark days before Git. Listen now.

All Questions

Tagged with
Filter by
Sorted by
Tagged with
0
votes
1answer
2k views

hashcat - cracking a salted sha256

Given a SHA512 hash, a salt, and username I am trying to crack the hash using hashcat. Every example I've found used a hashfile as input, is there way to provide salt and hash via commandline without ...
-1
votes
1answer
140 views

Best tool for cracking SHA-1s with unique pre and post salts? [closed]

I can't find a tool that supports cracking SHA-1s with different pre and post salts. Any suggestions?
3
votes
3answers
213 views

Can one find the value of a “constant salt” if they can set the password and get the hash?

Saying we have an oracle that an attacker can use as many time as they want. The attacker can send a non-empty password to this Oracle. The Oracle hashes the password using sha256(password + pepper), ...
2
votes
2answers
234 views

Does having a salted password hash make cracking an unsalted hash of the same password easier?

I've been asked to implement a system to prevent reusing passwords on the same account. The most secure way I know to do this is to compare hashes of the password + a known salt. bcrypt.hash(sha256(...
27
votes
1answer
10k views

How does the attacker know what algorithm and salt to use in a dictionary attack?

I am curious about password cracking methods like dictionary and brute force attacks. Nowadays passwords are stored as hashes and not plaintext on the server. Then how can the plaintext passwords in ...
11
votes
3answers
553 views

Why do salts for hashing passwords need to be globally unique, not just system/site-unique?

I was reading an answer by Terry Chia to another question about the requirements for a salt, in which he/she (among others) specified that salts need to be globally unique, but don't go into any ...
1
vote
1answer
123 views

Does the length of Salt data influence how hard or easy it would be to crack/match a hashed password?

Does any guidelines or best practices exist when it come to choose the length of the Salt data. Does it matter in the effort a hack has to put to match the dictionary (or rainbow) table with the ...
0
votes
3answers
114 views

Are Salt strings stored by application? [duplicate]

1) As storing passwords in plain text in databases are not secure and so is not a good practice. password stored in db = "abcde" (plain text) 2) To avoid this, passwords are stored after being hashed ...
1
vote
1answer
794 views

John the Ripper and incremental mode

I have a question about John the Ripper and it's incremental mode. As far as I know, the incremental mode is a brute-force mode, and it tries to get the password by systematic combining all ...
20
votes
5answers
19k views

How to crack a password given its hash and its salt using a more efficient method than brute force?

I have been able to crack passwords, given their salts and their hashes, by using brute force. In the first place, the length of passwords was 3 and the salt length 2: e.g., hash: rrVo/xC.s5/hQ, ...
1
vote
3answers
767 views

By how much does the addition of a salt slow down a rainbow table attack?

I understand that the addition of a salt provides some protection, because the attacker can no longer just look up the hash value in a rainbow table. However, it is still feasible to write a cracking ...
54
votes
3answers
10k views

Secret salts; why do they slow down attacker more than they do me?

When studying Dan Boneh's slides for 'Session Management and User Authentication' (2011) he mentions 'secret salts' on the slide 'Further defences' (slide 48 out of 58). He suggest to store in the ...
2
votes
4answers
851 views

How to figure about the total amount of password combinations possibles that have salt values?

I'm reading this book about Computer Security to better prepare me for my role, however, this question is just not clicking to me. I've figured out half of it, but cannot figure out this last part. If ...
-1
votes
2answers
3k views

What type of hashes are these and what are salts? [closed]

These are hashes and salts but I don't know what the salt is. The salts are under the hashes and theyre short. Also, I don't know how to crack these hashes, can anyone help? --------------+----------...
0
votes
5answers
1k views

Why can salts be public? [duplicate]

From what I understand, salts are called "salts" rather than "keys" because they are allowed to be public. I understand that applying a random salt makes it difficult for rainbow table attacks because ...
3
votes
1answer
4k views

Find salt from md5 hash if password is known

I have a salted MD5 hash and I also know the password. How can I recover the salt using tools like John The Ripper (I have JTR jumbo installed)?
0
votes
1answer
760 views

Encrypt password with salt

Can anyone explain why formula 1 is safer than formula 2?I don't get it even I get the answer. According to 2, it says as s is in plaintext form, the attacker can decrypt the password by (y.s). Isn'...
1
vote
3answers
4k views

How to use password salt the right way [duplicate]

I understand the basic idea of password salts. You generate a 'random' string of data prepend this data to a user password store password and salt (salt maybe even in 'clear' form) Like in the ...
4
votes
3answers
52k views

Is it possible to crack hash with known salt? If yes how?

If the salt in the hash is known to us, then is it possible to crack to extract the password from the hash? If yes, how?
1
vote
2answers
373 views

Hashing password with salt [duplicate]

I read from wiki: The attacker has access to both the hashed password and the salt, so when running the dictionary attack, the attacker can simply use the known salt when attempting to crack the ...
2
votes
3answers
3k views

My friend hashes passwords with SHA512 algorithm without salt. How do I convince him that he needs to add salt?

Today I discovered something incredibly stupid - my friend hashes user passwords with sha512 algorithm without a salt. I immediately raised this issue to him but he said he wants to see anyone crack a ...
2
votes
1answer
1k views

MySQL Authentication Hash Cracking

I'm currently conducting research regarding MySQL server remote authentication. I've captured unencrypted, uncompressed authentication packets between the client and the server where the username is ...
-1
votes
3answers
726 views

help me about salting passwords

Eve has just discovered and decrypted the file that associates each userid with its 32-bit random salt value, and she has also discovered and decrypted the password file, which contains the salted-and-...