Cracking a hash when you know the result?

If I know that the algorithm used is SHA1 constructed as salt+key, and I have the result, is it possible to find the salt?

Example:

sha1(saltExamplealturkovic) => 4e6a306ff65e252571f36972949f45e513b79ba7


In this example, I know that the input value is alturkovic, the result is 4e6a306ff65e252571f36972949f45e513b79ba7, how it is constructed and that SHA1 is used as the hashing algorithm. I would like to find out what salt was used (with some common sense limits of course, such as length).

I tried using hashcat but I can't figure out if this can even be done using such a tool...

• In theory the usual tools could be changed to also brute-force salts given passwords, but salts are usually chosen uniformly at random from a space of size $\geq 2^{64}$ so there's little hope that they can be recovered by brute-force and there are no structural weaknesses (usually) that allow a faster recovery (except if the salt is encoded into the stored hash). – SEJPM Jun 27 at 15:04

TL;DR: Salts are too long to try and brute force them.

In theory

You can create a mask attack using hashcat, specifically a hybrid attack.

Let's assume you know that the salt used is (only) 4 numbers.

-a 7 ?d?d?d?d myKnownKey.txt


myKnownKey.txt contains the key alturkovic.

This setup would then try out these combinations:

• 0000alturkovic
• 0001alturkovic
• 0002alturkovic
• $$\ldots$$
• 9999alturkovic

This is one example of how to create hybrid attacks using hashcat.

In practice

In practice salts are (as SEJPM commented) of course not only just 4 digits long but they are very long random alphanumerical characters and thus renders any brute force attacks impractical.

• I believe this is exactly what I was looking for. I am aware of the caveats and downsides and I have reasonable expectations for this to work. I have to try this tomorrow when I get to work to see how performant it actually is. Thank you. – alturkovic Jun 27 at 20:57
• I am having some trouble setting this up, I created a hash.txt file containing 4e6a306ff65e252571f36972949f45e513b79ba7 and the wordlist containing alturkovic. I then tried running it like this: hashcat64.exe -m 120 -a 7 ?a?a?a?a?a?a?a?a -o output.txt hash.txt wordlist.txt but it won't load the hash, I am getting: Hash '?a?a?a?a?a?a?a?a': Separator unmatched No hashes loaded., I assume I am using something wrong but can't figure out what, any idea? – alturkovic Jun 28 at 8:07
• Another practical method: Google it! – fgrieu Jun 28 at 14:07