Finding salt, with known pass and part of hash

[Flipper]

Hi!

I've been struggling for a while to find something that could help with this problem. It seems hashcat was the closest to help me, but I'm not sure, even reading the documentation, don't know if I'll be able to do this.

Let me explain, I got this situation (just an example):

md5($pass + $salt) = ??????xxxxxxx??????? (x = known)

I want to find the salt, knowing the password and part of the hash. Let's say that, out of 16 bytes in MD5, I have 10 known bytes. Don't know where these bytes exactly are inside the hash, but they are (probably) contiguous. Also, not sure if the order is $pass+$salt or $salt+pass.

Anyway, I need to brute-force the salt, until one of the generated hashes *contains* some specific 10 bytes sequence (this means 7 possible positions inside a MD5 hash). It could tell me which one matched, and continue checking for more possible matches. I'll be able to validate the salt by comparing with other samples.

Is it feasible at all? If yes, is that possible with hashcat? In case of a "no", I probably will never find one that does!

Hope I could explain it properly.

Thanks!

[Rolf]

It is not possible, unless:
1. You find out the hash completely. HC does not support partial hashes. I know only one program which does, and it's PPro.
2. You need to know the exact algorithm.

If those two are met, you just need to pick the reversed algo, for example, for md5($salt.$pass), you will need to choose md5($pass.$salt) and this way you actually attack the hash for the salt.

If the salt is short this is an easy job.

[Flipper]

Thanks for the reply.

To tell you the truth, I don't even know the digest being used. Just wondering and giving it a try. Also, I have no way of finding it. All I know, is that it's a 14 digits, alphanumeric (lower and upper) sequence (e.g. 4HtS30XzamW0dC). It looks like being base64 encoded, but out of the samples I have, none ever appeared a + or /, which is supposed to be included in the base64's set. Well, my sample set is just 5 values, so not really decisive.
I "chose" MD5 because of its popularity. Maybe it's a trimmed hash, so it becomes 10 bytes and then base64 encoded, which becomes 14 chars of text. And I know what is part of the plain-text (or the pass), but without the salt.

It's all "bruteforce", from the used algo to the salt. :/

I'm going to give PasswordsPro a try. It seems the demo version doesn't allow this partial hash ability. Also, its not GPU accelerated. Will fiddle around their forums for some input!

Thanks!

[Rolf]

I cant be sure, but to me it seems like not really possible.
Too much limits.