Posts: 2
Threads: 1
Joined: Nov 2014
I kinda understand hashes i think, but I haven't got a clue how I'm meant to find them.
If I want to gain access to a specific website I used to have an account for, how do I know what hash to use for an attack. It seems like I'm missing something obvious because no guides seem to mention it at all, they all just assume that I have a hash to crack.
Any help is gratefully received.
Posts: 2,936
Threads: 12
Joined: May 2012
Generally you need to have access to the password database to obtain hashes. This generally involves compromising a system at some level. The exception to this is e.g. network protocols (WPA, NetNTLM, Kerberos, etc.) and non-hash formats (MS Office, TrueCrypt, etc.)
Posts: 13
Threads: 0
Joined: Nov 2014
Once you've actually gotten your hands on a hash or list of hashes,
HashTag.py is really good at determining the hash's algorithm. The same guy runs
OnlineHashCrack but my personal experience is that HashTag.py is better.
Posts: 2
Threads: 1
Joined: Nov 2014
Interesting. I had thought that this was a system where you could point it at a login field and it was just try every password possible through aaaaa - zzzzz assuming it knew the username.
Posts: 2,936
Threads: 12
Joined: May 2012
(11-25-2014, 05:11 AM)_NSAKEY Wrote: HashTag.py is really good at determining the hash's algorithm.
No, it isn't.
Posts: 2,936
Threads: 12
Joined: May 2012
(11-25-2014, 06:40 PM)jimbob57566 Wrote: Interesting. I had thought that this was a system where you could point it at a login field and it was just try every password possible through aaaaa - zzzzz assuming it knew the username.
No. What you are describing is an online brute force attack. Hashcat is for offline attacks.
Posts: 13
Threads: 0
Joined: Nov 2014
(11-25-2014, 11:45 PM)epixoip Wrote: (11-25-2014, 05:11 AM)_NSAKEY Wrote: HashTag.py is really good at determining the hash's algorithm.
No, it isn't.
Can you recommend a better solution? HashTag.py hasn't let me down yet, but I'm always open to using something better.
Posts: 2,936
Threads: 12
Joined: May 2012
tools like HashTag.py are worthless at best, and at worse are very misleading and may cause you to waste a ton of time.
if the hash has an identifier, then you already know what it is and you don't need some piece of software to tell you what it is.
if the hash doesn't have an identifier, then there is no way to determine what algorithm was used unless you already know in advance what algorithm was used. you can only guess.
