How was my password found?

computer_freak_8 · #1 11-10-2008

Hello,
The problem I have mentioned in this thread is the result of a weak (found in wordlists) password. I have since changed it.

But I would like to test my current passwords for crackibility. I look in the /etc/shadow file for an account I made recently, specifically made to be vunerable to a dictionary attack. I would like know how to use the information before the hash to generate hashes to compare to the password hash.

The first few characters are of the string are $2a$05$ which I have read means the Blowfish algorithm (2a) and salted using 05.

How would I generate hashes (with Blowfish and using the salt) from a wordlist?

Thanks,

computer_freak_8

drendeah · #2 11-13-2008

You kind of going about that backwards, looking at, or decoding the hash is basically impossible. What you should do is look at the hash of dictionary words, and then compare the has of those to your hash.

See this link for an automated way to do that:
http://www.linuxsecurityforum.org/f5...words-t23.html

computer_freak_8 · #3 11-14-2008

Quote:

Originally Posted by drendeah

You kind of going about that backwards, looking at, or decoding the hash is basically impossible. What you should do is look at the hash of dictionary words, and then compare the has of those to your hash.

Yes, yes, I'm sorry; this is what I had in mind. Will the link you gave me work with the Blowfish and salt, though? Or is it strictly MD5 without salt?

Thanks,
computer_freak_8

drendeah · #4 11-15-2008

Quote:

Originally Posted by computer_freak_8

Yes, yes, I'm sorry; this is what I had in mind. Will the link you gave me work with the Blowfish and salt, though? Or is it strictly MD5 without salt?

Thanks,
computer_freak_8

It should work, use the flag:

Code:

--format=BF

computer_freak_8 · #5 1 Week Ago

Quote:

Originally Posted by drendeah

It should work, use the flag:

Code:

--format=BF

Thanks.

I know this is an old thread; I had forgotten I had posted it.
I was recently searching for an answer to this very thing, when I noticed this in my subscribed threads. Now to see what else I've forgotten about...

I'll try to remember to post back after I get the time and am able to try this.

Thanks again,
computer_freak_8