Hash format guidance

This is a draft page to experiment with capturing hash-specific format guidance - details or hints that are more complex or more dynamic than available in –hash-info.

For simplicity and future-proofing, start each section title with the mode ID, and sort each section by hash ID.

General guidance

Conversion: Some formats - such as those inside larger containers like archive files, documents, full disk encryption, etc. - have to be extracted / modified / converted before hashcat can attack them. Rather than reinventing the wheel, hashcat often recommends John the Ripper's conversion scripts (the '-2john' files in the JtR distribution). If your conversion script is not listed here, try there.

Archives

11600 - 7-Zip

14700 - iTunes backup < 10.0

14800 - iTunes backup < 10.0

Documents

9400 - MS Office 2007

Full-Disk Encryption (FDE)

Veracrypt

  • Known incompatibility with truecrypt2john, see this issue

14600 - LUKS

Password Managers

6600 - 1Password, agilekeychain

8200 - 1Password, cloudkeychain

Except where otherwise noted, content on this wiki is licensed under the following license: Public Domain