Openwall GNU/*/Linux - a small security-enhanced Linux distro for servers
[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Date: Thu, 28 Feb 2019 07:08:14 -0900
From: Royce Williams <royce@...ho.org>
To: john-users@...ts.openwall.com
Subject: prepending and appending salts in dynamic formats

This Stack Exchange question:

https://security.stackexchange.com/questions/204439/best-tool-for-cracking-sha-1s-with-unique-pre-and-post-salts

... led me to discover that the dynamic format language has a way to
prepend two different salts, but apparently no explicitly append a salt?
(Is this correct?)

Naively, with hashcat formats, if an algorithm is listed as ($p.$s) but you
need to prepend instead of appen, you can just "swap" the order of the
candidate password and the salt in your hash list or attack.

In other words, if you'd normally express your algorithm as

    sha1($s.$p.$s2)

... instead, you'd have to say

    sha1($p.$s.$s2)

Would this work for john? Are there other considerations?

-- 
Royce

Powered by blists - more mailing lists

Your e-mail address:

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.