Short of creating one's own script / program, is there an existing, readily available way of iterating through a list of potential passwords to find which one corresponds to a hash (HMAC-SHA256), assuming you have the key it was generated with? This is in asp.net. For the sake of this question / instance, no salt has been used.

  • 2
    $\begingroup$ In the usual way! $\endgroup$ – kelalaka Apr 12 '20 at 1:26
  • $\begingroup$ Manually / one at a time..? $\endgroup$ – xlr2020 Apr 12 '20 at 1:27
  • 1
    $\begingroup$ See the Hashcat list hashcat.net/wiki/doku.php?id=example_hashes $\endgroup$ – kelalaka Apr 12 '20 at 1:28
  • $\begingroup$ When I manually compute an HMAC, I get something that looks slightly different from the example(s) listed on that page. For instance, HMAC-MD5 of "password" with a key I've randomly selected equates to 7770cee27a11e85be4f6d3681de31847, but the page wants it formatted (their example): c741db0a2968c39d9c2a5cc75b05370:1234. What is the meaning of the colon / separator and extra characters at the end (or beginning) of the computed hash value? $\endgroup$ – xlr2020 Apr 12 '20 at 3:57
  • $\begingroup$ I tried finding that out, but it was unclear to me as well. Normally I'd say that it was used as number of iteration for password hashing, but in that case the exact password hashing scheme is missing in action. $\endgroup$ – Maarten Bodewes Apr 18 '20 at 14:48

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.