Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Fri, 29 Sep 2017 16:10:31 -0800
From: Royce Williams <>
Subject: Re: RFC: Hashkiller Rosetta Stone

(I apologize for the duplicate post; I'll treat this one as the "correct"

On Fri, Sep 29, 2017 at 1:58 PM, Solar Designer <> wrote:

> On Fri, Sep 29, 2017 at 07:20:31AM -0800, Royce Williams wrote:
> > I'm working on a Hashkiller Rosetta Stone (a list of upload formats
> > supported by Hashkiller, and how to use those modes in hashcat, john, and
> > MDXfind.)
> >
> > A draft is here:
> >
> >
> >
> > Any help/tips appreciated. I don't know the underlying algorithm of many
> > product-specific formats, so I'm almost certainly missing some obvious
> ones.
> It'd help if you list example hashes, preferably all for a fixed
> password like "password", so that you don't need to list the
> corresponding different plaintext passwords as well.

That's a really good idea. I will do this.

> JtR supports command-line dynamic formats now (and has been for a couple
> of years, due to work by Jim), so most if not all of your "unsupported"s
> are actually supported at least in this way.

Cool. I will investigate this.

> Those command-line dynamics typically allow for a higher password
> length, too.  For example, when experimenting with Update 2 from
> I found that "--external=Repeats"
> cracks plenty of passwords of lengths up to 109 (and I've just tested
> that it cracks 110 too, but not 111 - as expected) with
> "--format=dynamic='sha1($p)'", whereas "--format=raw-sha1" only goes up
> to length 55 (also as expected).

Indeed. For completeness, I'll try to make such differences explicit
somehow in the table.

> > My future ambition is to expand this concept to be a Rosetta Stone for
> the
> > superset of all formats supported by any known product. Small steps
> first.
> > :)
> Cool.  With JtR's command-line dynamics, its list of supported formats
> is sort of "infinite", though. ;-)  But I guess you'll list only those
> actually seen in use somewhere.

Heh, fair enough.

> BTW, I found that the command-line dynamics are much easier to use than
> having to remember the old numeric dynamics.

That makes sense.

Powered by blists - more mailing lists

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.