[Sneed]

What's hard is that the found password is a hash. I could not find a way to output the non-hash.

Assuming you are creating a custom module here - I'm guessing you are running into the inner SHA1 hash, right? So, you'd have to crack it by prepending "eMinor--" and appending "--}" to your guess candidate (note that it does this for both rounds of SHA1)

I was today year's old when I learned of something called 'custom modules' in hashcat.
No I just ran some unix commands to do the salting, a python program to hash the wordlist, then ran the hashed wordlist against the salted SHA1.
Then I had to dehash my potfile.

Once you have a "bad" solution, it becomes possible to find a "better" solution.

I'll look into the custom modules. Thanks.

Let me know if you make progress, been looking for someone who can make custom modules for a while.

[blackboar]

Let me know if you make progress, been looking for someone who can make custom modules for a while.

% git clone http://something.github.com
% cp ./src/modules/module_04520.c ./src/modules/module_04525.c
% make

Easy peasy. Although it doesn't do anything new. My experience programming in C might be *decades* old. So ideally I just add the custom salts: eMinor-- & --} to each char *buffer and modify the length....

I'd love to make one for Argon but I need to walk before I can fly across the universe.

ReverbNation Combolist using the non-plugin method has 1.34M which I'll post shortly.

[red_dot]

Very useful educational content

[lxstcxntury]

Wow this is great, thank you

[blackboar]

hello first thank you for this incredible work I am trying to learn dehash but I am a beginner I am trying to write a program to dehash the wattpad database with your advice unfortunately there must be a problem could you help me?

for example :
I first hashed the id with SHA1 so "201689155" became "967c5fa30e70332ea8004ffd41ea2dadc46cd1a8"
and the password is $2y$10$vkJZz1FmR//QCfn1PZP9Uuxs6I4sZ6JyzWwiF3PfGdOfEOBhS8M4q

but my program comes out to me 8a8901038a1477767889a3b05277296eb42c3dae58d0847cc9c084074b1dba7c

here is my code ( python)

The bad news is that you have chosen the slowest, interpreted language possible that (at best) will maybe dehash at a rate of 100 guesses/sec.

If you wrote it in C++ or Java it'd be faster... but not really fast.

I highly recommend learning how to use hashcat BECAUSE it leverages the true CPU or GPU speeds and has optimized the dehashing in ways you can't imagine.
=> you can increase your guesses using hashcat to 10 million guesses per second - depending on the hash used.

Go here: https://hashcat.net/hashcat/

I don't remember dehashing wattpad but you seem to be on the right track.
Download the binaries or compile it yourself. It is THE TOOL to use for this.

[xidar]

Very Interesting. Thanks for sharing.

[joepa]

Wooow this is goos stuff TY!!

[AFS_Nemesis]

Just wanted to share how I usually identify hashes with an IRL example.

I found this hash in a router binary recently. It appears to be a backdoor that was commented out when the firmware hit production.

D1E79FF135D14E342D76185C23024E6DEAD4D6EC2C317A526C811E83538EA4E5ED8E1B0EEE5CE26E3C1B6A5F1FE11FA804F28B7E8821CA90AFA5B2F300DF99FDA27C9D2131E031EA11463C47944C05005EF4C1CE932D7F4A87C7563581D9F27F0C305023FCE94997EC7D790696E784357ED803A610EBB71B12A8BE5936429BFD:010001

$ hashid hash
--File 'hash'--
Analyzing 'D1E79FF135D14E342D76185C23024E6DEAD4D6EC2C317A526C811E83538EA4E5ED8E1B0EEE5CE26E3C1B6A5F1FE11FA804F28B7E8821CA90AFA5B2F300DF99FDA27C9D2131E031EA11463C47944C05005EF4C1CE932D7F4A87C7563581D9F27F0C305023FCE94997EC7D790696E784357ED803A610EBB71B12A8BE5936429BFD:010001'
[+] Unknown hash
Analyzing 'D1E79FF135D14E342D76185C23024E6DEAD4D6EC2C317A526C811E83538EA4E5ED8E1B0EEE5CE26E3C1B6A5F1FE11FA804F28B7E8821CA90AFA5B2F300DF99FDA27C9D2131E031EA11463C47944C05005EF4C1CE932D7F4A87C7563581D9F27F0C305023FCE94997EC7D790696E784357ED803A610EBB71B12A8BE5936429BFD'
[+] Skein-1024
--End of file 'hash'--

Notice the first line has the salt, which makes it unrecognized. Without the salt, it's shown as the SHA-3 finalist, Skein-1024: https://en.wikipedia.org/wiki/Skein_%28hash_function%29

https://www.kali.org/tools/hashid/

[Magouilleur]

wattpad.com - HMAC_SHA256($SALT.$PASS, $KEY)
Salt being a SHA1 hash of the user's "ID" field. The secret key is "d2e1a4c569e7018cc142e9cce755a964bd9b193d2d31f02d80bb589c959afd7e"
Example hashes:

f7c95f0df7fc445876af565b3b5699c0824ae2bbde648cab16c3775cb70bf92d:b74b5eae156acf2344c58e849cfc63d1b02f1bc6:d2e1a4c569e7018cc142e9cce755a964bd9b193d2d31f02d80bb589c959afd7e:domi77
11fce0d23f541ce06b8d8c3204313b75b9cbb3247b9e1e41987d527993b75948:0d8ee56135ae4d1ed93ab1c3d524a062d76d020e:d2e1a4c569e7018cc142e9cce755a964bd9b193d2d31f02d80bb589c959afd7e:wowman
ddd25b1faf2256e83b19ae7f305e04738e5f47d3e20d6ce32602d04cd0a08e07:7f703db3b9949444d0764acd90a5a03ddc064d78:d2e1a4c569e7018cc142e9cce755a964bd9b193d2d31f02d80bb589c959afd7e:bevertje
ac8ed5b1c0245fb717d5552a7d8bfb8ec9408aa14a9137e0af9c7b073a32396c:700c4535abc15251f9e3499eb2a4428487d028c3:d2e1a4c569e7018cc142e9cce755a964bd9b193d2d31f02d80bb589c959afd7e:letmein2013
7a0d5c94fd90c01a0f5b386b53361582f09c5411e97eff3d4117595129aa11a9:ff6d9634453289497fca7dfd51988fab7e1290df:d2e1a4c569e7018cc142e9cce755a964bd9b193d2d31f02d80bb589c959afd7e:ilovetwilight

How do you crack those hashes since there is no hash-mode for hashcat?

[Sneed]

wattpad.com - HMAC_SHA256($SALT.$PASS, $KEY)
Salt being a SHA1 hash of the user's "ID" field. The secret key is "d2e1a4c569e7018cc142e9cce755a964bd9b193d2d31f02d80bb589c959afd7e"
Example hashes:

f7c95f0df7fc445876af565b3b5699c0824ae2bbde648cab16c3775cb70bf92d:b74b5eae156acf2344c58e849cfc63d1b02f1bc6:d2e1a4c569e7018cc142e9cce755a964bd9b193d2d31f02d80bb589c959afd7e:domi77
11fce0d23f541ce06b8d8c3204313b75b9cbb3247b9e1e41987d527993b75948:0d8ee56135ae4d1ed93ab1c3d524a062d76d020e:d2e1a4c569e7018cc142e9cce755a964bd9b193d2d31f02d80bb589c959afd7e:wowman
ddd25b1faf2256e83b19ae7f305e04738e5f47d3e20d6ce32602d04cd0a08e07:7f703db3b9949444d0764acd90a5a03ddc064d78:d2e1a4c569e7018cc142e9cce755a964bd9b193d2d31f02d80bb589c959afd7e:bevertje
ac8ed5b1c0245fb717d5552a7d8bfb8ec9408aa14a9137e0af9c7b073a32396c:700c4535abc15251f9e3499eb2a4428487d028c3:d2e1a4c569e7018cc142e9cce755a964bd9b193d2d31f02d80bb589c959afd7e:letmein2013
7a0d5c94fd90c01a0f5b386b53361582f09c5411e97eff3d4117595129aa11a9:ff6d9634453289497fca7dfd51988fab7e1290df:d2e1a4c569e7018cc142e9cce755a964bd9b193d2d31f02d80bb589c959afd7e:ilovetwilight

How do you crack those hashes since there is no hash-mode for hashcat?

You would need to write a custom module in Hashcat. @blackboar might be able to assist you. I'm not sure if MDXfind or JtR have support for this type, either. Seems to be quite difficult to come across custom modules in the wild, so if I find any I'll definitely add them to this thread (with credit, of course)