[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-ID: <20190325180701.GA25539@openwall.com>
Date: Mon, 25 Mar 2019 19:07:01 +0100
From: Solar Designer <solar@...nwall.com>
To: john-users@...ts.openwall.com
Subject: Re: how to crack pbkdf2-sha256, MD5, SHA256
Dear community, please help ensure we're not leaving any questions
without a reply. I was hoping someone would take care of this one.
On Thu, Feb 21, 2019 at 01:27:31PM +0000, Aiza Gabion wrote:
> "how do I crack this hash using Hashcat or John the ripper?
>
> $pbkdf2-sha256$8000$XAuBMIYQQogxRg$tRRlz8hYn63B9LYiCd6PRo6FMiunY9ozmMMI3srxeRE
>
> It is salted pbkdf2 generated using this library: https://passlib.readthedocs.io/en/1.6.5/lib/passlib.hash.pbkdf2_digest.html#passlib.hash.pbkdf2_sha256
I am puzzled why you're asking this since it's trivially tested.
Here's how:
[solar@...er run]$ echo '$pbkdf2-sha256$8000$XAuBMIYQQogxRg$tRRlz8hYn63B9LYiCd6PRo6FMiunY9ozmMMI3srxeRE' > pw
[solar@...er run]$ ./john pw
Warning: detected hash type "PBKDF2-HMAC-SHA256", but the string is also recognized as "PBKDF2-HMAC-SHA256-opencl"
Use the "--format=PBKDF2-HMAC-SHA256-opencl" option to force loading these as that type instead
Using default input encoding: UTF-8
Loaded 1 password hash (PBKDF2-HMAC-SHA256 [PBKDF2-SHA256 128/128 AVX 4x])
Cost 1 (iteration count) is 8000 for all loaded hashes
Will run 32 OpenMP threads
Proceeding with single, rules:Single
Press 'q' or Ctrl-C to abort, almost any other key for status
Almost done: Processing the remaining buffered candidate passwords, if any
Proceeding with wordlist:./password.lst, rules:Wordlist
password (?)
1g 0:00:00:00 DONE 2/3 (2019-03-25 19:01) 2.325g/s 1190p/s 1190c/s 1190C/s 123456..crawford
Use the "--show --format=PBKDF2-HMAC-SHA256" options to display all of the cracked passwords reliably
Session completed
And there you have the password, which happens to be "password".
> I am also interested in buy and distributed hash cracker that can crack MD5 and SHA256"
We're not selling one, but you can crack these hashes with JtR jumbo.
As to it needing to be "distributed", you can use JtR's "--node" option
to split the workload across a few nodes manually.
Alexander
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
