Viss
@Viss@mastodon.social
@ethagnawl @kajer they like being in charge and they hate it when someone who knows more about any given topic shows up and makes it obvious they know more
Post by Viss
This thread continues with a post that is not available on this server. Open the original post
Earlier in the thread
kajer
@kajer@infosec.exchange
found the vote button, that's dumb
i'm not a regular github user, so this voting thing is weird, as there is no visible text to indicate as much.
Viss
@Viss@mastodon.social
@kajer @ethagnawl i like how they're like "hey stay calm, its not a big deal we've been looting your shit for 5 years"
Replies
tehfishman
@tehfishman@ioc.exchange
@Viss GETTEM
Viss
@Viss@mastodon.social
@tehfishman @kajer @ethagnawl its so fucking exhausting
kajer
@kajer@infosec.exchange
I am digging in to the supervisor code.
sha1_pw[:5]
HA sends the first 5 sha1 characters to the HIBP api. This is not salted, and deterministic.
so.... let's play.
hunter2 has the sha1 of f3bbbd66a63d4bf1747940578ec3d0103530e21d
so sends to HIBP is f3bbb
now, what can we do with f3bbb? ROCKYOU$(year).TXT
okay, let's go get the range of f3bbb hashes from HIBP... ~1998 results
now hashcat -
kajer@dell7920r:~$ hashcat -a0 -m100 hashlist.txt password_list.txt --show
f3bbbd66a63d4bf1747940578ec3d0103530e21d:hunter2
hey look! I got the password from 5 bytes of SHA1