Is it possible to crack a salt from hash with or without cleartext?

[dadver]

Hi,

I'm wondering if it's possible to crack a salt for a hash given the hash and possibly the cleartext.
Say for instance I have an appearant MD5 hash list that does not resolve and I suspect it's salted with a static salt in for instance PHP code, is it possible to bruteforce the salt given a good wordlist for which I suspect some salts should resolve to, or if I know the cleartext and hash and be able to bruteforce the salt?

Hope you understand my question. 

Best regards,

[Xanadrel]

Yes.

[dadver]

Yes.

Mind giving a hint as to how? Thought that was implied.

[TofuBoy22]

is it possible to bruteforce the salt 

I don't think you quite know what you're doing...

[Xanadrel]

Yes.

Mind giving a hint as to how? Thought that was implied.

Yes, it's about logic/common sense, like thinking a bit.
It's exactly the same as cracking a hash to recover a password, except for this case you switch the salt with the password.

[dadver]

I don't think you quite know what you're doing...

Well no shit, hence I'm asking.

Yes, it's about logic/common sense, like thinking a bit.
It's exactly the same as cracking a hash to recover a password, except for this case you switch the salt with the password.

I think I understand that I need to provide the cleartext as a salt instead of the salt and then reverse the order of the hash type (i.e. if the hash algo used is md5($p.$s) I reverse it to md5($s.$p)), which works good in my tests, but I can't seem to understand how I'm supposed to do it in the case of working against a wordlist rather than brute forcing from a known cleartext?

If you'd be so kind and explain it to me rather than acting all high and mighty that would be cool.

[Xanadrel]

I think I understand that I need to provide the cleartext as a salt instead of the salt and then reverse the order of the hash type (i.e. if the hash algo used is md5($p.$s) I reverse it to md5($s.$p)), which works good in my tests, but I can't seem to understand how I'm supposed to do it in the case of working against a wordlist rather than brute forcing from a known cleartext?

If you'd be so kind and explain it to me rather than acting all high and mighty that would be cool.

I don't even get what you don't understand here, if you figured out it's just about switching plaintext/salt.
After that it's just a matter of basic hashcat usage, go look a bit at the --help and check the wiki.

Also, don't be a bitch, it's not about "acting all high and mighty", it's more about not doing hand holding, and end up with dumb users lamely copy pasting commands.

Got a brain ? Use it.

[dadver]

I don't even get what you don't understand here, if you figured out it's just about switching plaintext/salt.
After that it's just a matter of basic hashcat usage, go look a bit at the --help and check the wiki.

Also, don't be a bitch, it's not about "acting all high and mighty", it's more about not doing hand holding, and end up with dumb users lamely copy pasting commands.

Got a brain ? Use it.

What I'm not getting is how I'm supposed to tell hashcat that I want to try <hash>:<wordlistword> and do a bruteforce of that.

For your information I'd suffice with an explanation as to how it's done, not a command excerpt.

Now I've figured out how to bruteforce the salt if the cleartext is given, but I've asked for further help as to how I would go about to use a dictionary to substitute an unknown cleartext and how I would go about and do that.
If you don't know, fine, either write so or don't write in the thread at all. But if you're only aim is to act tough because you don't want "dumb users lamely copy pasting commands", please leave my thread.

Got humility? Use it.

[epixoip]

For simple salt+pass concatenation, -a 1, -a 6, -a 7 can all be leveraged.