hashcat
advanced password recovery

So I have this hash and this salt, separated by the colon. 


34XX7eeXX028XX7954XXc770XXe1eXXe   :   109001

The hash was generated with the vBulletin hashing type, which is MD5(MD5(password).salt). This method is supported by hashcat, but it refuses to accept any salt which is not 3 or 30 characters. I do not have the hard drive space to create an intermediate list where I append the salt. Is there anyway I can still apply hashcat to solve this problem?

Just use 2611 mode, it should work properly.

Nice! I thought I had already tried that and failed, and just resentfully tried yet another time. But this time it worked! Thank you!