1
$\begingroup$

If I know that the algorithm used is SHA1 constructed as salt+key, and I have the result, is it possible to find the salt?

Example:

sha1(saltExamplealturkovic) => 4e6a306ff65e252571f36972949f45e513b79ba7

In this example, I know that the input value is alturkovic, the result is 4e6a306ff65e252571f36972949f45e513b79ba7, how it is constructed and that SHA1 is used as the hashing algorithm. I would like to find out what salt was used (with some common sense limits of course, such as length).

I tried using hashcat but I can't figure out if this can even be done using such a tool...

Improve this question
$\endgroup$
1
  • 4
    $\begingroup$ In theory the usual tools could be changed to also brute-force salts given passwords, but salts are usually chosen uniformly at random from a space of size $\geq 2^{64}$ so there's little hope that they can be recovered by brute-force and there are no structural weaknesses (usually) that allow a faster recovery (except if the salt is encoded into the stored hash). $\endgroup$
    – SEJPM
    Jun 27, 2019 at 15:04

1 Answer 1

Reset to default
3
$\begingroup$

TL;DR: Salts are too long to try and brute force them.

In theory

You can create a mask attack using hashcat, specifically a hybrid attack.

Let's assume you know that the salt used is (only) 4 numbers.

-a 7 ?d?d?d?d myKnownKey.txt

myKnownKey.txt contains the key alturkovic.

This setup would then try out these combinations:

  • 0000alturkovic
  • 0001alturkovic
  • 0002alturkovic
  • $\ldots$
  • 9999alturkovic

This is one example of how to create hybrid attacks using hashcat.

In practice

In practice salts are (as SEJPM commented) of course not only just 4 digits long but they are very long random alphanumerical characters and thus renders any brute force attacks impractical.

Improve this answer
$\endgroup$
3
  • $\begingroup$ I believe this is exactly what I was looking for. I am aware of the caveats and downsides and I have reasonable expectations for this to work. I have to try this tomorrow when I get to work to see how performant it actually is. Thank you. $\endgroup$
    – alturkovic
    Jun 27, 2019 at 20:57
  • $\begingroup$ I am having some trouble setting this up, I created a hash.txt file containing 4e6a306ff65e252571f36972949f45e513b79ba7 and the wordlist containing alturkovic. I then tried running it like this: hashcat64.exe -m 120 -a 7 ?a?a?a?a?a?a?a?a -o output.txt hash.txt wordlist.txt but it won't load the hash, I am getting: Hash '?a?a?a?a?a?a?a?a': Separator unmatched No hashes loaded., I assume I am using something wrong but can't figure out what, any idea? $\endgroup$
    – alturkovic
    Jun 28, 2019 at 8:07
  • $\begingroup$ Another practical method: Google it! $\endgroup$
    – fgrieu ♦
    Jun 28, 2019 at 14:07

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.