Overview of the algorithms

[algoritual2]

Hello,

I have looked at the wiki page and the forum, but for me it is not clear how to get an overview of all the used algorithms. I can inspect the <module>.c files, but then it is still quite cumersome to translate that back to the algorithm, let alone to do that for all the modes.

Is there an easier way to obtain these algorithms? Sometimes I just want to run a modified version of these on my CPU.


Thanks in advance!

[Chick3nman]

I'm not quite sure what you mean by "overview" but you could look here to see all of our modes: https://hashcat.net/wiki/doku.php?id=example_hashes

[penguinkeeper]

You can also use hashcat -hh if you want to have an up-to-date list of all algorithms (example hashes not included though) and you'll have to be using the beta because it's a recent update

[algoritual2]

Thanks for the replies, what I am looking for is a way to retrieve the algorithms used by hashcat to calculate the hashes. I am aware of https://hashcat.net/wiki/doku.php?id=example_hashes, so for example if we look at mode 3000, the LM-hash, if we input "hashcat" in the LM algorithm, we obtain 299bd128c1101fd6, according to the table.

What does the algorithm look like to come to that value? This is an easy case, I think most of us know the algorithm (other wikipedia is your friend). But for the more obscure modes, how do we retrieve the algorithm easily?

[Chick3nman]

For many of these, there isn't an "easy to understand" primitive algorithm/construction. That's part of why many have names from where they are used/found. If you want to try and understand each of the algorithms/constructions you will need to review the kernel source in /OpenCL/, which is going to be further complicated as often we implement partial/incomplete algorithms/constructions for performance reasons or to exploit weaknesses.

[algoritual2]

Thanks again! But for a lot of these algorithms, we don't need to make matters too complicated. I mean, again the LM algorithm, or for NT, rar, many of the oracle, kerberos, are relatively easy algorithms. I say easy because there is already a threshold to being able to understand what is going on -- I assume most of us know these basics.

I don't think we need to delve TOO deep into the internals to understand these algorithms? But if I understand you correctly, there is no general way to see which algorithms are used for the modes, other than inspecting the C-code for each mode individually?

[penguinkeeper]

This splits it out a bit but yeah, there are some algorithms that cannot be split out into primitives, like bcrypt. If you want proper answers, you'd need to look at the OpenCL.
https://docs.google.com/spreadsheets/d/1...sz1rk/edit

[algoritual2]

Thanks so much, it might be overlooking things, but there is also no (reference to) algorithms in there, or am I mistaken?

[penguinkeeper]

The "Hashcat mode" column

[Chick3nman]

Thanks again! But for a lot of these algorithms, we don't need to make matters too complicated. I mean, again the LM algorithm, or for NT, rar, many of the oracle, kerberos, are relatively easy algorithms. I say easy because there is already a threshold to being able to understand what is going on -- I assume most of us know these basics.

I don't think we need to delve TOO deep into the internals to understand these algorithms? But if I understand you correctly, there is no general way to see which algorithms are used for the modes, other than inspecting the C-code for each mode individually?

Unfortunately, there is no "simple" or "relatively easy" way to describe many of the algorithms present beyond what they are already named. For example, "WinZip", which is mode 13600, refers to a kernel designed to crack zip archives created and encrypted with WinZip the utility. Calling that "PBKDF2-HMAC-SHA1 with multiple derivation paths, unpacking, and authentication steps" is not much "easier" to understand because you still don't have enough info to know how it actually works, even after all that. It would take quite the deep dive to actually understand what is going on in that kernel and how it works. For many of the algorithms/modes present there is no simple natural language way to describe them without doing a deep dive into how they work. The "algorithms used" by the different modes we support can be mixed and variable even within 1 kernel, modified from their original or "textbook" design, or completely novel/custom. The names given to them _are_ the "algorithms used for the modes". When we refer to WinZip as a mode we are essentially referring to our implementation as an "Algorithm" (though i prefer "Construction", which is similar but slightly different) called "WinZip".