SIP: search using the dictionary is not working.

[jok40]

Hi!

I found that hashcat can not find the password for the SIP-account using the dictionary. With HTTPBrute I calculated response to SIP-request (see the picture httpbrute.gif - it's just an example). Then I formed hash-file mytrunk1.hash:

Code:

$sip$***mytrunk1*asterisk*REGISTER*sip*77.12.87.99:8077**1821d72d****MD5*9638ced4c962449466deee5d4aca2b3f

Then I downloaded rockyou.txt (of about 137 megabytes), and add the password aM13xzv2h in the first row (see the picture rockyou.gif).
Launched hashcat:

Code:

hashcat-cli64 -m 11400 mytrunk1.hash rockyou.txt -o result_mytrunk1.txt

Unsuccessfully.

But if I run hashcat like this:

Code:

hashcat-cli64 -m 11400 -a 3 mytrunk1.hash ?l?u?d?dxzv?d?l -o result_mytrunk1.txt

that password is searched in less than 5 seconds.

What am I doing wrong?