Help identifying this hash

[droidman85]

AAwNPRQr6WHvftdOQER0IRhMlF00ZMGDI6B4F61u757TrRq2bl1w8ccKjYn5xplrVg==:47985d96-8a98-4a81-b4cf-b0c56da6a8ed
(AspNetUsers)
So the main hash has 68 chars and the rest im not sure it is the salt.
tried the PBKDF2 algos but all failed the lenght of the hashes

thanks in advance

[DanielG]

You mention AspNetUsers which lead me to https://msdn.microsoft.com/en-us/magazine/dn818488.aspx. This mentions that next to the passwordhash a SecurityStamp GUID is stored. The part you posted after the : is a GUID and unlikely a salt.

On https://www.blinkingcaret.com/2017/11/29...swordhash/ this base64 format is explained.

It looks like your Base64 encoded data is partly the salt and partly the PBKDF2 hash. First byte is for version (yours is Version 2) Next 16 bytes are the salt and the rest is the hash (PBKDF2 with HMAC-SHA1, 128-bit salt, 256-bit subkey, 1000 iterations.)

[droidman85]

You mention AspNetUsers which lead me to https://msdn.microsoft.com/en-us/magazine/dn818488.aspx. This mentions that next to the passwordhash a SecurityStamp GUID is stored. The part you posted after the : is a GUID and unlikely a salt.

On https://www.blinkingcaret.com/2017/11/29...swordhash/ this base64 format is explained.

It looks like your Base64 encoded data is partly the salt and partly the PBKDF2 hash. First byte is for version (yours is Version 2) Next 16 bytes are the salt and the rest is the hash (PBKDF2 with HMAC-SHA1, 128-bit salt, 256-bit subkey, 1000 iterations.)

Thanks a lot for the help, so i converted the hash
if i remove the spaces from the result it gives me a 98 char string that now looks a lot more like a hash
so i got this
c23298d9e1113e87aad9e034293c7ce11f745cd94d0f7abb383fe3f44d7d33c9:dae3aa8c6340be5c8810463d252d16ee
i removed the 00 from the start of the hash, i tried to crack it on the latest version of hashcat and all PBKDF2 versions give me error on the separator, i see that this might be a problem with the hash length, so i added the 00
00c23298d9e1113e87aad9e034293c7ce11f745cd94d0f7abb383fe3f44d7d33c9:dae3aa8c6340be5c8810463d252d16ee
still the program is not picking up the hash
did i do something wrong ?

[droidman85]

i think that i need to pass them back to base64 and add sha1:1000:hashalt
i got it to work at least it is doing it