The connection was lost. Trying to connect again.

Post by Viss

This thread continues with a post that is not available on this server. Open the original post

Earlier in the thread

Viss @Viss@mastodon.social

@ethagnawl @kajer they like being in charge and they hate it when someone who knows more about any given topic shows up and makes it obvious they know more

· Public

kajer @kajer@infosec.exchange

@Viss @ethagnawl

found the vote button, that's dumb

i'm not a regular github user, so this voting thing is weird, as there is no visible text to indicate as much.

· Public · edited

Viss @Viss@mastodon.social

@kajer @ethagnawl i like how they're like "hey stay calm, its not a big deal we've been looting your shit for 5 years"

· Public

tehfishman @tehfishman@ioc.exchange

@Viss GETTEM

@kajer @ethagnawl

· Public

Replies

kajer @kajer@infosec.exchange

@Viss @tehfishman @ethagnawl

I am digging in to the supervisor code.

sha1_pw[:5]

HA sends the first 5 sha1 characters to the HIBP api. This is not salted, and deterministic.

so.... let's play.

hunter2 has the sha1 of f3bbbd66a63d4bf1747940578ec3d0103530e21d

so sends to HIBP is f3bbb

now, what can we do with f3bbb? ROCKYOU$(year).TXT

okay, let's go get the range of f3bbb hashes from HIBP... ~1998 results

now hashcat -

kajer@dell7920r:~$ hashcat -a0 -m100 hashlist.txt password_list.txt --show
f3bbbd66a63d4bf1747940578ec3d0103530e21d:hunter2

hey look! I got the password from 5 bytes of SHA1

· Public · edited