+- hashcat Forum (https://hashcat.net/forum)
+-- Forum: Misc (https://hashcat.net/forum/forum-15.html)
+--- Forum: General Talk (https://hashcat.net/forum/forum-33.html)
+--- Thread: VeraCrypt - no idea what hash or cipher was used (/thread-7399.html)
VeraCrypt - no idea what hash or cipher was used - In - 03-28-2018
Used VeraCrypt container for a while now, and don't remember which hash and cipher (definitely was a cascade, but don't remember which) were used when it was created.
Somehow I managed to forget a password, while having a pretty good guess on what an almost correct password is (i think I either forgot couple of letter sequence, or correct keyboard layout, or both), and I've generated a dictionary with couple of thousand combinations of password candidates.
I've started reading tutorials on Vera/TrueCrypt usage of hashcat, but it mentions that I will have to know and use correct hash-cipher combination.
When I use VeraCrypt it doesn't ask me for a hash and cipher. Should I look for another solution, or write my own app that will attempt to mount VeraCrypt through a commandline, feeding it a passwords from my dictionary, or is there a way to use hashcat without knowing hash/cipher, and without trying every possible combination manually?
RE: VeraCrypt - no idea what hash or cipher was used - undeath - 03-28-2018
you can run modes 13713, 13723, 13733 and 13753 which will cover all non-boot possibilities.
RE: VeraCrypt - no idea what hash or cipher was used - In - 03-28-2018
(03-28-2018, 10:55 AM)undeath Wrote: you can run modes 13713, 13723, 13733 and 13753 which will cover all non-boot possibilities.
and header extraction is like so?
dd if=\\.\Volume{some-vo-lu-me-qwerty} of=hashcat.vc bs=1 skip=65536 count=512
upd: dd for windows fails to access volume
Error reading file: 87 The parameter is incorrect.
Any suggestion what tool i can use to get volume header in win10?
RE: VeraCrypt - no idea what hash or cipher was used - metulski2013 - 06-03-2018
(03-28-2018, 11:11 AM)In Wrote:(03-28-2018, 10:55 AM)undeath Wrote: you can run modes 13713, 13723, 13733 and 13753 which will cover all non-boot possibilities.
and header extraction is like so?
dd if=\\.\Volume{some-vo-lu-me-qwerty} of=hashcat.vc bs=1 skip=65536 count=512
upd: dd for windows fails to access volume
Error reading file: 87 The parameter is incorrect.
Any suggestion what tool i can use to get volume header in win10?
use a linux distro like "The-Distribution-Which-Does-Not-Handle-OpenCL-Well (Kali)" and boot from the disc.