How to extract a hash (VNC, SSH2 or SMB) from a WireShark capture file
#7
And some more data to test: I am now trying with SSL: a connection to GMail website using a test account. I am trying to extract the hash using "ssldump":

Code:
ssldump -r GMailConnection.cap

It gives me lots of data. There are some lines that could be the hash:

Code:
36 148 6.5794 (3.2014)  C>S  application_data
47 2  1.2720 (0.0953)  S>C  Handshake
      ServerHello
        Version 3.1
        session_id[32]=
          6b 57 35 8a 65 fd 43 62 84 d3 8b 1c b2 45 79 e9
          ec f6 af f3 72 6c 0b c5 97 83 59 1c 04 37 3d b7
        cipherSuite         TLS_RSA_WITH_RC4_128_SHA
        compressionMethod                   NULL
47 3  1.2720 (0.0000)  S>C  ChangeCipherSpec
47 4  1.2720 (0.0000)  S>C  Handshake
May I extract the handshake from here?
OCLHashCat-Plus process correctly this hash in -m 1400 (SHA256) type, but it does not find my password ("12345678" again):

Code:
oclhashcat-plus64 -m 1400 6b57358a65fd436284d38b1cb24fdae9ecf6aff3726c0bc59783591c04373db7 -a 3 12345678

I can post the results of ssldump if requested. There are several lines like "TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA" or "TLS_RSA_WITH_RC4_128_SHA".


Messages In This Thread
RE: How to extract a hash ... - by SopalajoArrierez - 03-20-2013, 10:34 PM