Identifying hash type

[wflme]

wflme, will be nearly impossible to know with any degree of certainty without having the source. But, it is possible that it is something simple like base64(md5_raw(pass)), then s/=//g

Are they all precisely 22 chars in length?

Yep, every one on them is precisely 22 chars long.

Do you see X03MO1qnZdYdgyfeuILPmQ in the list anywhere?

I don't actually. I assume it's "password".

root@foobar:~# echo "X03MO1qnZdYdgyfeuILPmQ==" |base64 -d |xxd -p
5f4dcc3b5aa765d61d8327deb882cf99

Yes it is. By the way, from what I can tell, "==" is totally optional from /usr/bin/base64's perspective.

Actually a faster way to test might be to just do something like:

Code:

while read h; do echo "$h==" | base64 -d | xxd -p; done < hashlist > new_hashlist

Then try cracking new_hashlist as -m 0 and see what happens.

You really hit the nail on the head with this one. Turns out those are originally perfectly legit MD5's.

Never would've thought to hex dump the base64 encoded string. Definitely a first for me. Is this even remotely common practice?

Thanks a lot, epixoip. Really saved my bacon there.