+- hashcat Forum (https://hashcat.net/forum)
+-- Forum: Support (https://hashcat.net/forum/forum-3.html)
+--- Forum: hashcat (https://hashcat.net/forum/forum-45.html)
+--- Thread: Unable to crack hashes - "Failed to parse hashes using the native hashcat format" (/thread-12994.html)
Unable to crack hashes - "Failed to parse hashes using the native hashcat format" - sashman - 05-06-2025
Seems like a basic question so please forgive me, but I've spent all morning looking at documentation and forum posts but to no avail.
I am doing an audit for any users who might be using one of our stock passwords given to them during onboard and am trying to crack the hashes, but every attempt to do so results in the error
Code:
Failed to parse hashes using the 'native hashcat' format
No hashes loaded.The command I am using is:
hashcat -a 0 -m 1000 --username 1 .\hashes.txt --show .\stockpwd.txt
The hashes sit on the hashes.txt file, and extracted using the dsinternals powershell module in the format
username:hash
username:hash
etc.
and the dictionary is in the format
pass1
pass2
etc.
I am hoping this is a relatively straightforward fix, as I have done this a year or so ago without issue. I assume I am missing an argument somewhere
RE: Unable to crack hashes - "Failed to parse hashes using the native hashcat format" - b8vr - 05-06-2025
The command will not crack anything:
hashcat -a 0 -m 1000 --username 1 .\hashes.txt --show .\stockpwd.txt
--username does not have any values, so hashcat thinks that the 1 is a hash. Remove the 1. And then --show will show already cracked hashes, if they exists in the potfile. When using --show, hashcat does not crack anything, so remove --show.
RE: Unable to crack hashes - "Failed to parse hashes using the native hashcat format" - sashman - 05-06-2025
(05-06-2025, 07:57 AM)b8vr Wrote: The command will not crack anything:
hashcat -a 0 -m 1000 --username 1 .\hashes.txt --show .\stockpwd.txt
--username does not have any values, so hashcat thinks that the 1 is a hash. Remove the 1. And then --show will show already cracked hashes, if they exists in the potfile. When using --show, hashcat does not crack anything, so remove --show.
Thanks for the reply, unfortunately making the changes you suggest results in
Code:
Token length exceptionThe command being run now is
hashcat -a 0 -m 1000 --username .\hashes.txt .\stockpwd.txt
RE: Unable to crack hashes - "Failed to parse hashes using the native hashcat format" - b8vr - 05-06-2025
Then you need to check the file containing the hashes.
Username:hash where the hash is exactly 32 bytes long containing only 0-9a-f.
RE: Unable to crack hashes - "Failed to parse hashes using the native hashcat format" - sashman - 05-21-2025
Apologies for the delay, been away for a while.
As far as I can tell the hashes are correct, here is one from the list
<username>:4**49537****7734d141****97ed2**9
which is indeed 32 bytes
Happy to provide images if you think it would help