[ { "regex": "^[a-f0-9]{4}$", "modes": [ { "john": null, "hashcat": null, "extended": false, "name": "CRC-16" }, { "john": null, "hashcat": null, "extended": false, "name": "CRC-16-CCITT" }, { "john": null, "hashcat": null, "extended": false, "name": "FCS-16" } ] }, { "regex": "^[a-f0-9]{8}$", "modes": [ { "john": null, "hashcat": null, "extended": false, "name": "Adler-32" }, { "john": null, "hashcat": null, "extended": false, "name": "CRC-32B" }, { "john": null, "hashcat": null, "extended": false, "name": "FCS-32" }, { "john": null, "hashcat": null, "extended": false, "name": "GHash-32-3" }, { "john": null, "hashcat": null, "extended": false, "name": "GHash-32-5" }, { "john": null, "hashcat": null, "extended": false, "name": "FNV-132" }, { "john": null, "hashcat": null, "extended": false, "name": "Fletcher-32" }, { "john": null, "hashcat": null, "extended": false, "name": "Joaat" }, { "john": null, "hashcat": null, "extended": false, "name": "ELF-32" }, { "john": null, "hashcat": null, "extended": false, "name": "XOR-32" } ] }, { "regex": "^[a-f0-9]{6}$", "modes": [ { "john": null, "hashcat": null, "extended": false, "name": "CRC-24" } ] }, { "regex": "^(\\$crc32\\$)?([a-f0-9]{8}.)?[a-f0-9]{8}$", "modes": [ { "john": "crc32", "hashcat": 11500, "extended": false, "name": "CRC-32", "samples": [ "c762de4a:00000000", "$crc32$00000000.fa455f6b", "$crc32$4ff4f23f.ce6eb863" ] }, { "john": "crc32", "hashcat": 27900, "extended": false, "name": "CRC-32C", "samples": [ "5e23d60f:00000000" ] } ] }, { "regex": "^\\+[a-z0-9\\/.]{12}$", "modes": [ { "john": "bfegg", "hashcat": null, "extended": false, "name": "Eggdrop IRC Bot", "samples": [ "+9F93o1OxwgK1", "+C/.8o.Wuph9.", "+Obytd.zXYjH/" ] } ] }, { "regex": "^[a-z0-9\\/.]{13}$", "modes": [ { "john": "descrypt", "hashcat": 1500, "extended": false, "name": "DES(Unix)", "samples": [ "CCNf8Sbh3HDfQ", "CCX.K.MFy4Ois", "CC4rMpbg9AMZ." ] }, { "john": "descrypt", "hashcat": 1500, "extended": false, "name": "Traditional DES", "samples": [ "CCNf8Sbh3HDfQ", "CCX.K.MFy4Ois", "CC4rMpbg9AMZ." ] }, { "john": "descrypt", "hashcat": 1500, "extended": false, "name": "DEScrypt", "samples": [ "CCNf8Sbh3HDfQ", "CCX.K.MFy4Ois", "CC4rMpbg9AMZ." ] } ] }, { "regex": "^[a-f0-9]{16}$", "modes": [ { "john": "mysql", "hashcat": 200, "extended": false, "name": "MySQL323" }, { "john": null, "hashcat": 5100, "extended": false, "name": "Half MD5" }, { "john": null, "hashcat": null, "extended": false, "name": "FNV-164" }, { "john": null, "hashcat": null, "extended": false, "name": "CRC-64" } ] }, { "regex": "^[a-f0-9]{16}:[a-f0-9]{16}$", "modes": [ { "john": null, "hashcat": 28000, "extended": false, "name": "CRC64Jones", "samples": [ "65c1f848fe38cce6:4260950400318054" ] } ] }, { "regex": "^[a-f0-9]{16}:[a-f0-9]{0,30}$", "modes": [ { "john": null, "hashcat": 3100, "extended": false, "name": "DES(Oracle)", "samples": [ "792FCB0AE31D8489:7284616727" ] }, { "john": null, "hashcat": 3100, "extended": false, "name": "Oracle 7-10g", "samples": [ "792FCB0AE31D8489:7284616727" ] } ] }, { "regex": "^[a-z0-9\\/.]{16}$", "modes": [ { "john": "pix-md5", "hashcat": 2400, "extended": false, "name": "Cisco-PIX(MD5)" }, { "john": "dynamic_19", "hashcat": 2400, "extended": true, "name": "md5($pass)" } ] }, { "regex": "^\\([a-z0-9\\/+]{20}\\)$", "modes": [ { "john": "dominosec", "hashcat": 8700, "extended": false, "name": "Lotus Notes/Domino 6" } ] }, { "regex": "^_[a-z0-9\\/.]{19}$", "modes": [ { "john": "bsdicrypt", "hashcat": 12400, "extended": false, "name": "BSDi Crypt", "samples": [ "_GW..8841inaTltazRsQ", "_J9..XXXXsqM/YSSP..Y", "_J9..SDSD5YGyRCr4W4c" ] } ] }, { "regex": "^[a-f0-9]{24}$", "modes": [ { "john": null, "hashcat": null, "extended": false, "name": "CRC-96 (ZIP)" }, { "john": null, "hashcat": 20500, "extended": false, "name": "PKZIP Master Key", "samples": [ "f1eff5c0368d10311dcfc419" ] }, { "john": null, "hashcat": 20510, "extended": false, "name": "PKZIP Master Key (6 byte optimization)", "samples": [ "f1eff5c0368d10311dcfc419" ] } ] }, { "regex": "^[a-z0-9\\/.]{24}$", "modes": [ { "john": null, "hashcat": null, "extended": false, "name": "Crypt16" } ] }, { "regex": "^(\\$md2\\$)?[a-f0-9]{32}$", "modes": [ { "john": "md2", "hashcat": null, "extended": false, "name": "MD2" } ] }, { "regex": "^[a-f0-9]{32}(?::.+)?$", "modes": [ { "john": "raw-md5", "hashcat": 0, "extended": false, "name": "MD5", "samples": [ "8743b52063cd84097a65d1633f5c74f5", "098F6BCD4621D373CADE4E832627B4F6" ] }, { "john": "raw-md4", "hashcat": 900, "extended": false, "name": "MD4" }, { "john": null, "hashcat": 2600, "extended": true, "name": "Double MD5" }, { "john": "lm", "hashcat": 3000, "extended": false, "name": "LM" }, { "john": "haval-128-4", "hashcat": null, "extended": false, "name": "Haval-128 (4 rounds)" }, { "john": "dynamic_160", "hashcat": null, "extended": true, "name": "Haval-128 (3 rounds)" }, { "john": "dynamic_180", "hashcat": null, "extended": true, "name": "Haval-128 (5 rounds)" }, { "john": null, "hashcat": null, "extended": true, "name": "Tiger-128" }, { "john": null, "hashcat": null, "extended": true, "name": "Skein-256(128)" }, { "john": null, "hashcat": null, "extended": true, "name": "Skein-512(128)" }, { "john": "lotus5", "hashcat": 8600, "extended": false, "name": "Lotus Notes/Domino 5" }, { "john": null, "hashcat": 23, "extended": false, "name": "Skype" }, { "john": null, "hashcat": null, "extended": true, "name": "ZipMonster" }, { "john": "dynamic_3", "hashcat": 3500, "extended": true, "name": "md5(md5(md5($pass)))", "samples": [ "9882d0778518b095917eb589f6998441" ] }, { "john": "dynamic_2", "hashcat": null, "extended": true, "name": "md5(md5($pass))" }, { "john": null, "hashcat": 4300, "extended": true, "name": "md5(uppercase(md5($pass)))" }, { "john": "dynamic_22", "hashcat": 4400, "extended": true, "name": "md5(sha1($pass))" }, { "john": "dynamic_1", "hashcat": 10, "extended": true, "name": "md5($pass.$salt)" }, { "john": "dynamic_4", "hashcat": 20, "extended": true, "name": "md5($salt.$pass)" }, { "john": null, "hashcat": 30, "extended": true, "name": "md5(unicode($pass).$salt)" }, { "john": null, "hashcat": 40, "extended": true, "name": "md5($salt.unicode($pass))" }, { "john": "hmac-md5", "hashcat": 50, "extended": true, "name": "HMAC-MD5 (key = $pass)" }, { "john": "hmac-md5", "hashcat": 60, "extended": true, "name": "HMAC-MD5 (key = $salt)" }, { "john": "dynamic_8", "hashcat": 3610, "extended": true, "name": "md5(md5($salt).$pass)", "samples": [ "7b57255a15958ef898543ea6cc3313bc:1234" ] }, { "john": "dynamic_9", "hashcat": 3710, "extended": true, "name": "md5($salt.md5($pass))" }, { "john": null, "hashcat": 3720, "extended": true, "name": "md5($pass.md5($salt))", "samples": [ "10ce488714fdbde9453670e0e4cbe99c:1234" ] }, { "john": "dynamic_5", "hashcat": 3810, "extended": true, "name": "md5($salt.$pass.$salt)" }, { "john": "dynamic_14", "hashcat": null, "extended": true, "name": "md5($salt.md5($pass).$salt)" }, { "john": "dynamic_13", "hashcat": 3910, "extended": true, "name": "md5(md5($pass).md5($salt))" }, { "john": "dynamic_12", "hashcat": null, "extended": true, "name": "md5(md5($salt).md5($pass))" }, { "john": "dynamic_6", "hashcat": null, "extended": true, "name": "md5(md5($pass).$salt)" }, { "john": "dynamic_10", "hashcat": 4010, "extended": true, "name": "md5($salt.md5($salt.$pass))" }, { "john": "dynamic_11", "hashcat": 4110, "extended": true, "name": "md5($salt.md5($pass.$salt))" }, { "john": null, "hashcat": 4210, "extended": true, "name": "md5($username.0.$pass)", "samples": [ "09ea048c345ad336ebe38ae5b6c4de24:1234" ] }, { "john": "dynamic_15", "hashcat": null, "extended": true, "name": "md5($username.md5($pass).$salt)" }, { "john": "dynamic_16", "hashcat": null, "extended": true, "name": "md5(md5(md5($pass).$salt).$salt2)" }, { "john": "dynamic_18", "hashcat": null, "extended": true, "name": "md5($salt.Y.$pass.0xF7.$salt)" }, { "john": "dynamic_29", "hashcat": null, "extended": true, "name": "md5(utf16($pass))" }, { "john": "dynamic_31", "hashcat": null, "extended": true, "name": "md4($salt.$pass)" }, { "john": "dynamic_32", "hashcat": null, "extended": true, "name": "md4($pass.$salt)" }, { "john": "dynamic_33", "hashcat": null, "extended": true, "name": "md4(utf16($pass))" }, { "john": "dynamic_34", "hashcat": null, "extended": true, "name": "md5(md4($pass))" }, { "john": "dynamic_39", "hashcat": null, "extended": true, "name": "md5($salt.pad16($pass))" }, { "john": null, "hashcat": 4410, "extended": true, "name": "md5(sha1($pass).$salt)", "samples": [ "bc8319c0220bff8a0d7f5d703114a725:34659348756345251" ] }, { "john": null, "hashcat": null, "extended": true, "name": "MD6-128", "samples": [ "8cd9a30bfde990878c06be4a6111f726" ] }, { "john": null, "hashcat": 2810, "extended": false, "name": "IPB 2.x (Invision Power Board)", "samples": [ "022f7e02b3314f7d0968f73c00ba759f:67588" ] } ] }, { "regex": "^[a-f0-9]{32}(?::.{1,32})?$", "modes": [ { "john": null, "hashcat": 12, "extended": true, "name": "PostgreSQL", "samples": [ "93a8cf6a7d43e3b5bcd2dc6abb3e02c6:27032153220030464358344758762807" ] } ] }, { "regex": "^[a-f0-9]{32}:.{56}$", "modes": [ { "john": null, "hashcat": 11000, "extended": false, "name": "PrestaShop", "samples": [ "f22cade043e7214200206dbffca49fd9:27167508161455764247627144160038845437138252877014827848", "810e3d12f0f10777a679d9ca1ad7a8d9:M2uZ122bSHJ4Mi54tXGY0lqcv1r28mUluSkyw37ou5oia4i239ujqw0l" ] } ] }, { "regex": "^(\\$netmd5\\$)?([a-f0-9]{88,96}\\$)?[a-f0-9]{32}$", "modes": [ { "john": "net-md5", "hashcat": null, "extended": false, "name": "Keyed MD5: RIPv2, OSPF, BGP, SNMPv2", "samples": [ "02020000ffff0003002c01145267d48d000000000000000000020000ac100100ffffff000000000000000001ffff0001$1e372a8a233c6556253a0909bc3dcce6", "$netmd5$0201002cac1001010000000000000002000001105267ff8fffffff00000a0201000000280000000000000000$445ecbb27272bd791a757a6c85856150" ] } ] }, { "regex": "^(\\$ripemd\\$)?[a-f0-9]{32}(:.+)?$", "modes": [ { "john": "ripemd-128", "hashcat": null, "extended": false, "name": "RIPEMD-128", "samples": [ "cdf26213a150dc3ecb610f18f6b38b46", "$ripemd$cdf26213a150dc3ecb610f18f6b38b46" ] } ] }, { "regex": "^(\\$snefru\\$)?[a-f0-9]{32}$", "modes": [ { "john": "snefru-128", "hashcat": null, "extended": false, "name": "Snefru-128" } ] }, { "regex": "^(\\$NT\\$)?[a-f0-9]{32}$", "modes": [ { "john": "nt", "hashcat": 1000, "extended": false, "name": "NTLM" } ] }, { "regex": "^(([^\\\\:*?\"<>|\\n]+:)|(M\\$.+#))?[a-f0-9]{32}(:[^\\\\\\/:*?\"<>|\\n]+)?$", "modes": [ { "john": "mscash", "hashcat": 1100, "extended": false, "name": "Domain Cached Credentials (DCC), MS Cache", "samples": [ "176a4c2bd45ac73687676c2f09045353", "M$test2#ab60bdb4493822b175486810ac2abe63", "M$#january#72488d8077e33d138b9cff94092716e4", "CORP1.COMPANY.LOCAL/Administrator:ab60bdb4493822b175486810ac2abe63:Administrator" ] } ] }, { "regex": "^([^\\\\:*?\"<>|\\n]+:)?(\\$DCC2\\$(\\d+#)?[^\\\\:*?\"<>|\\n]*#)?[a-f0-9]{32}$", "modes": [ { "john": "mscash2", "hashcat": 2100, "extended": false, "name": "Domain Cached Credentials 2 (DCC2), MS Cache 2", "samples": [ "cfc6a1e33eb36c3d4f84e4c2606623d2", "$DCC2$10240#test1#607bbe89611e37446e736f7856515bf8", "$DCC2$10000#Twelve_chars#54236c670e185043c8016006c001e982", "$DCC2$january#26b5495b21f9ad58255d99b5e117abe2", "$DCC2$#59137848828d14b1fca295a5032b52a1", "CORP1.COMPANY.LOCAL/Administrator:$DCC2$10240#Administrator#cceed966f6689269b758893bb6bbb985" ] } ] }, { "regex": "^{SHA}[a-z0-9\\/+]{27}=$", "modes": [ { "john": "nsldap", "hashcat": 101, "extended": false, "name": "SHA-1(Base64)" }, { "john": "nsldap", "hashcat": 101, "extended": false, "name": "Netscape LDAP SHA" } ] }, { "regex": "^\\$1\\$[a-z0-9\\/.]{0,8}\\$[a-z0-9\\/.]{22}(:.*)?$", "modes": [ { "john": "md5crypt", "hashcat": 500, "extended": false, "name": "MD5 Crypt" }, { "john": "md5crypt", "hashcat": 500, "extended": false, "name": "Cisco-IOS(MD5)" }, { "john": "md5crypt", "hashcat": 500, "extended": false, "name": "FreeBSD MD5" } ] }, { "regex": "^0x[a-f0-9]{32}$", "modes": [ { "john": null, "hashcat": null, "extended": false, "name": "Lineage II C4" } ] }, { "regex": "^\\$H\\$[a-z0-9\\/.]{31}$", "modes": [ { "john": "phpass", "hashcat": 400, "extended": false, "name": "phpBB v3.x" }, { "john": "phpass", "hashcat": 400, "extended": false, "name": "Wordpress v2.6.0/2.6.1" }, { "john": "phpass", "hashcat": 400, "extended": false, "name": "PHPass' Portable Hash" } ] }, { "regex": "^\\$P\\$[a-z0-9\\/.]{31}$", "modes": [ { "john": "phpass", "hashcat": 400, "extended": false, "name": "Wordpress \u2265 v2.6.2" }, { "john": "phpass", "hashcat": 400, "extended": false, "name": "Joomla \u2265 v2.5.18" }, { "john": "phpass", "hashcat": 400, "extended": false, "name": "PHPass' Portable Hash" } ] }, { "regex": "^[a-f0-9]{32}:[a-z0-9]{2}$", "modes": [ { "john": null, "hashcat": 21, "extended": false, "name": "osCommerce" }, { "john": null, "hashcat": 21, "extended": false, "name": "xt:Commerce" } ] }, { "regex": "^(?:\\$apr1\\$|\\$1\\$|{smd5})[a-z0-9\\/.]{0,8}\\$[a-z0-9\\/.]{22}$", "modes": [ { "john": "md5crypt-long", "hashcat": 1600, "extended": false, "name": "MD5 (APR)" }, { "john": "md5crypt-long", "hashcat": 1600, "extended": false, "name": "Apache MD5" }, { "john": "md5crypt-long", "hashcat": 1600, "extended": false, "name": "md5apr1" }, { "john": "md5crypt-long", "hashcat": 1600, "extended": false, "name": "crypt(3) MD5", "samples": [ "$apr1$71850310$gh9m4xcAn3MGxogwX/ztb.", "$1$12345678$aIccj83HRDBo6ux1bVx7D1", "{smd5}s8/xSJ/v$uGam4GB8hOjTLQqvBfxJ2/" ] } ] }, { "regex": "^{smd5}[a-z0-9$\\/.]{31}$", "modes": [ { "john": "aix-smd5", "hashcat": 6300, "extended": false, "name": "AIX(smd5)" } ] }, { "regex": "^[a-f0-9]{32}:.+$", "modes": [ { "john": null, "hashcat": 3721, "extended": false, "name": "WebEdition CMS", "samples": [ "fa01af9f0de5f377ae8befb03865178e:5678" ] }, { "john": null, "hashcat": 26401, "extended": true, "name": "AES-128-ECB NOKDF (PT = $salt, key = $pass)", "samples": [ "e7a32f3210455cc044f26117c4612aab:86046627772965328523223752173724" ] }, { "john": null, "hashcat": 26402, "extended": true, "name": "AES-192-ECB NOKDF (PT = $salt, key = $pass)", "samples": [ "2995e91b798ef51232a91579edb1d176:49869364034411376791729962721320" ] }, { "john": null, "hashcat": 26403, "extended": true, "name": "AES-256-ECB NOKDF (PT = $salt, key = $pass)", "samples": [ "264a4248c9522cb74d33fe26cb596895:61270210011294880287232432636227" ] } ] }, { "regex": "^[a-f0-9]{40}(:[^:]+)?$", "modes": [ { "john": "raw-sha1", "hashcat": 100, "extended": false, "name": "SHA-1" }, { "john": null, "hashcat": 4500, "extended": false, "name": "Double SHA-1" }, { "john": "dynamic_190", "hashcat": null, "extended": false, "name": "Haval-160 (3 rounds)" }, { "john": "dynamic_200", "hashcat": null, "extended": false, "name": "Haval-160 (4 rounds)" }, { "john": "dynamic_210", "hashcat": null, "extended": false, "name": "Haval-160 (5 rounds)" }, { "john": null, "hashcat": null, "extended": true, "name": "Tiger-160" }, { "john": null, "hashcat": null, "extended": false, "name": "HAS-160" }, { "john": "raw-sha1-linkedin", "hashcat": 190, "extended": false, "name": "LinkedIn", "samples": [ "b89eaac7e61417341b710b727768294d0e6a277b" ] }, { "john": null, "hashcat": null, "extended": false, "name": "Skein-256(160)" }, { "john": null, "hashcat": null, "extended": false, "name": "Skein-512(160)" }, { "john": "dynamic_35", "hashcat": null, "extended": true, "name": "MangosWeb Enhanced CMS" }, { "john": "dynamic_36", "hashcat": null, "extended": true, "name": "MangosWeb Enhanced CMS v2" }, { "john": "dynamic_35", "hashcat": null, "extended": true, "name": "sha1(uppercase($username).:.$pass)" }, { "john": "dynamic_36", "hashcat": null, "extended": true, "name": "sha1($username.:.$pass)" }, { "john": null, "hashcat": 4600, "extended": true, "name": "sha1(sha1(sha1($pass)))", "samples": [ "dc57f246485e62d99a5110afc9264b4ccbfcf3cc" ] }, { "john": "dynamic_23", "hashcat": 4700, "extended": true, "name": "sha1(md5($pass))" }, { "john": "dynamic_24", "hashcat": 110, "extended": true, "name": "sha1($pass.$salt)" }, { "john": "dynamic_25", "hashcat": 120, "extended": true, "name": "sha1($salt.$pass)" }, { "john": null, "hashcat": 130, "extended": true, "name": "sha1(unicode($pass).$salt)" }, { "john": null, "hashcat": 140, "extended": true, "name": "sha1($salt.unicode($pass))" }, { "john": "hmac-sha1", "hashcat": 150, "extended": true, "name": "HMAC-SHA1 (key = $pass)" }, { "john": "hmac-sha1", "hashcat": 160, "extended": true, "name": "HMAC-SHA1 (key = $salt)" }, { "john": null, "hashcat": 4710, "extended": true, "name": "sha1($salt.$pass.$salt)" }, { "john": "dynamic_37", "hashcat": null, "extended": true, "name": "SMF" }, { "john": "dynamic_37", "hashcat": null, "extended": true, "name": "sha1(lowercase($username).$pass)" }, { "john": "dynamic_38", "hashcat": null, "extended": true, "name": "Wolt3BB" }, { "john": "dynamic_38", "hashcat": null, "extended": true, "name": "sha1($salt.sha1($salt.sha1($pass)))" }, { "john": "dynamic_40", "hashcat": null, "extended": true, "name": "net-sha1" }, { "john": "dynamic_40", "hashcat": null, "extended": true, "name": "sha1($salt.pad20($pass))" }, { "john": null, "hashcat": 24300, "extended": true, "name": "sha1($salt.sha1($pass.$salt))", "samples": [ "94520b02c04e79e08a75a84c2a6e3ed4e3874fe8:ThisIsATestSalt" ] }, { "john": null, "hashcat": 27200, "extended": false, "name": "Ruby on Rails Restful Auth (one round, no sitekey)", "samples": [ "3999d08db95797891ec77f07223ca81bf43e1be2:5dcc47b04c49d3c8e1b9e4ec367fddeed21b7b85" ] } ] }, { "regex": "^(\\$ripemd\\$)?[a-f0-9]{40}(:[^:]+)?$", "modes": [ { "john": "ripemd-160", "hashcat": 6000, "extended": false, "name": "RIPEMD-160", "samples": [ "9c1185a5c5e9fc54612808977ee8f548b2258d31", "$ripemd$9c1185a5c5e9fc54612808977ee8f548b2258d31", "012cb9b334ec1aeb71a9c8ce85586082467f7eb6" ] } ] }, { "regex": "^[a-f0-9]{40}:[a-f0-9]+:[a-f0-9]+$", "modes": [ { "john": null, "hashcat": 29000, "extended": true, "name": "sha1($salt.sha1(utf16le($username).':'.utf16le($pass)))", "samples": [ "339b5eaa53f28516008e9ca710857d3a4785b6fc:8ca064ff42fcab5a8f0692544b8dd3d3054bd73fe9afaa08c6b6b310538cc9a7:757365726e616d65" ] } ] }, { "regex": "^(\\*)?[a-f0-9]{40}$", "modes": [ { "john": "mysql-sha1", "hashcat": 300, "extended": false, "name": "MySQL5.x", "samples": [ "*2c905879f74f28f8570989947d06a8429fb943e6", "*A8A397146B1A5F8C8CF26404668EFD762A1B7B82" ] }, { "john": "mysql-sha1", "hashcat": 300, "extended": false, "name": "MySQL4.1", "samples": [ "*5AD8F88516BD021DD43F171E2C785C69F8E54ADB", "*be1bdec0aa74b4dcb079943e70528096cca985f8", "fcf7c1b8749cf99d88e5f34271d636178fb5d130" ] } ] }, { "regex": "^[a-z0-9]{43}$", "modes": [ { "john": null, "hashcat": 5700, "extended": false, "name": "Cisco-IOS(SHA-256)" } ] }, { "regex": "^{SSHA}[a-z0-9\\/+]{38}==$", "modes": [ { "john": "nsldaps", "hashcat": 111, "extended": false, "name": "SSHA-1(Base64)" }, { "john": "nsldaps", "hashcat": 111, "extended": false, "name": "Netscape LDAP SSHA" }, { "john": "nsldaps", "hashcat": 111, "extended": true, "name": "nsldaps" } ] }, { "regex": "^[a-z0-9=]{47}$", "modes": [ { "john": "fortigate", "hashcat": 7000, "extended": false, "name": "Fortigate(FortiOS)" } ] }, { "regex": "^[a-f0-9]{48}$", "modes": [ { "john": "dynamic_220", "hashcat": null, "extended": false, "name": "Haval-192 (3 rounds)" }, { "john": "dynamic_230", "hashcat": null, "extended": false, "name": "Haval-192 (4 rounds)" }, { "john": "dynamic_240", "hashcat": null, "extended": false, "name": "Haval-192 (5 rounds)" }, { "john": "tiger", "hashcat": null, "extended": false, "name": "Tiger-192" }, { "john": null, "hashcat": null, "extended": false, "name": "SHA-1(Oracle)" }, { "john": "xsha", "hashcat": 122, "extended": false, "name": "OSX v10.4" }, { "john": "xsha", "hashcat": 122, "extended": false, "name": "OSX v10.5" }, { "john": "xsha", "hashcat": 122, "extended": false, "name": "OSX v10.6" } ] }, { "regex": "^[a-f0-9]{51}$", "modes": [ { "john": null, "hashcat": null, "extended": false, "name": "Palshop CMS" } ] }, { "regex": "^[a-z0-9]{51}$", "modes": [ { "john": null, "hashcat": null, "extended": false, "name": "CryptoCurrency(PrivateKey)" } ] }, { "regex": "^{ssha1}\\d{2}\\$[a-z0-9$\\/.]{44}$", "modes": [ { "john": "aix-ssha1", "hashcat": 6700, "extended": false, "name": "AIX(ssha1)" } ] }, { "regex": "^0x0100[a-f0-9]{48}$", "modes": [ { "john": "mssql05", "hashcat": 132, "extended": false, "name": "MSSQL(2005)" }, { "john": "mssql05", "hashcat": 132, "extended": false, "name": "MSSQL(2008)" } ] }, { "regex": "^(\\$md5,rounds=\\d+\\$|\\$md5\\$rounds=\\d+\\$|\\$md5\\$)[a-z0-9\\/.]{0,16}(\\$|\\$\\$)[a-z0-9\\/.]{22}$", "modes": [ { "john": "sunmd5", "hashcat": 3300, "extended": false, "name": "Sun MD5 Crypt", "samples": [ "$md5$rounds=904$iPPKEBnEkp3JV8uX$0L6m7rOFTVFn.SGqo2M9W1" ] } ] }, { "regex": "^[a-f0-9]{56}$", "modes": [ { "john": "raw-sha224", "hashcat": 1300, "extended": false, "name": "SHA-224" }, { "john": "dynamic_51", "hashcat": null, "extended": true, "name": "sha224($salt.$pass)" }, { "john": "dynamic_52", "hashcat": null, "extended": true, "name": "sha224($pass.$salt)" }, { "john": "dynamic_53", "hashcat": null, "extended": true, "name": "sha224(sha224($pass))" }, { "john": "dynamic_54", "hashcat": null, "extended": true, "name": "sha224(sha224_raw($pass))" }, { "john": "dynamic_55", "hashcat": null, "extended": true, "name": "sha224(sha224($pass).$salt)" }, { "john": "dynamic_56", "hashcat": null, "extended": true, "name": "sha224($salt.sha224($pass))" }, { "john": "dynamic_57", "hashcat": null, "extended": true, "name": "sha224(sha224($salt).sha224($pass))" }, { "john": "dynamic_58", "hashcat": null, "extended": true, "name": "sha224(sha224($pass).sha224($pass))" }, { "john": "dynamic_250", "hashcat": null, "extended": false, "name": "Haval-224 (3 rounds)" }, { "john": "dynamic_260", "hashcat": null, "extended": false, "name": "Haval-224 (4 rounds)" }, { "john": "dynamic_270", "hashcat": null, "extended": false, "name": "Haval-224 (5 rounds)" }, { "john": "dynamic_370", "hashcat": 17300, "extended": false, "name": "SHA3-224" }, { "john": "dynamic_430", "hashcat": 17700, "extended": false, "name": "Keccak-224" }, { "john": null, "hashcat": null, "extended": true, "name": "Skein-256(224)" }, { "john": null, "hashcat": null, "extended": true, "name": "Skein-512(224)" }, { "john": "dynamic_330", "hashcat": null, "extended": true, "name": "Skein-224" }, { "john": null, "hashcat": null, "extended": false, "name": "BLAKE2-224" } ] }, { "regex": "^(\\$2[abxy]|\\$2)\\$\\d{2}\\$[a-z0-9\\/.]{53}$", "modes": [ { "john": "bcrypt", "hashcat": 3200, "extended": false, "name": "Blowfish(OpenBSD)" }, { "john": null, "hashcat": null, "extended": false, "name": "Woltlab Burning Board 4.x" }, { "john": "bcrypt", "hashcat": 3200, "extended": false, "name": "bcrypt" }, { "john": null, "hashcat": 25600, "extended": true, "name": "bcrypt(md5($pass)) / bcryptmd5", "samples": [ "$2a$05$/VT2Xs2dMd8GJKfrXhjYP.DkTjOVrY12yDN7/6I8ZV0q/1lEohLru" ] }, { "john": null, "hashcat": 25800, "extended": true, "name": "bcrypt(sha1($pass)) / bcryptsha1", "samples": [ "$2a$05$Uo385Fa0g86uUXHwZxB90.qMMdRFExaXePGka4WGFv.86I45AEjmO" ] }, { "john": null, "hashcat": 28400, "extended": true, "name": "bcrypt(sha512($pass)) / bcryptsha512", "samples": [ "$2a$12$KhivLhCuLhSyMBOxLxCyLu78x4z2X/EJdZNfS3Gy36fvRt56P2jbS" ] } ] }, { "regex": "^[a-f0-9]{40}:[a-f0-9]{16}$", "modes": [ { "john": null, "hashcat": 5800, "extended": false, "name": "Android PIN" } ] }, { "regex": "^(S:)?[a-f0-9]{40}(:)?[a-f0-9]{20}$", "modes": [ { "john": "oracle11", "hashcat": 112, "extended": false, "name": "Oracle 11g/12c" } ] }, { "regex": "^\\$bcrypt-sha256\\$(2[axy]|2)\\,\\d+\\$[a-z0-9\\/.]{22}\\$[a-z0-9\\/.]{31}$", "modes": [ { "john": null, "hashcat": null, "extended": false, "name": "bcrypt(SHA-256)" } ] }, { "regex": "^[a-f0-9]{32}:.{3}$", "modes": [ { "john": null, "hashcat": 2611, "extended": false, "name": "vBulletin < v3.8.5" } ] }, { "regex": "^[a-f0-9]{32}:.{30}$", "modes": [ { "john": null, "hashcat": 2711, "extended": false, "name": "vBulletin \u2265 v3.8.5" } ] }, { "regex": "^(\\$snefru\\$)?[a-f0-9]{64}$", "modes": [ { "john": "snefru-256", "hashcat": null, "extended": false, "name": "Snefru-256" } ] }, { "regex": "^[a-f0-9]{64}(:.+)?$", "modes": [ { "john": "raw-sha256", "hashcat": 1400, "extended": false, "name": "SHA-256" }, { "john": "dynamic_140", "hashcat": null, "extended": false, "name": "RIPEMD-256", "samples": [ "1419109aa0de60e6ba0b6d2b2f602c13b07e97b5ffc85b6be2297badc699262f", "f156e6c20042057840f3251ee041596d89fde06c2505f61764ad1c03c2fc1375" ] }, { "john": "haval-256-3", "hashcat": null, "extended": false, "name": "Haval-256 (3 rounds)" }, { "john": "dynamic_290", "hashcat": null, "extended": false, "name": "Haval-256 (4 rounds)" }, { "john": "dynamic_300", "hashcat": null, "extended": false, "name": "Haval-256 (5 rounds)" }, { "john": "gost", "hashcat": 6900, "extended": false, "name": "GOST R 34.11-94" }, { "john": null, "hashcat": null, "extended": false, "name": "GOST CryptoPro S-Box" }, { "john": "dynamic_380", "hashcat": 17400, "extended": false, "name": "SHA3-256" }, { "john": "raw-keccak-256", "hashcat": 17800, "extended": false, "name": "Keccak-256" }, { "john": "skein-256", "hashcat": null, "extended": false, "name": "Skein-256" }, { "john": null, "hashcat": null, "extended": true, "name": "Skein-512(256)" }, { "john": null, "hashcat": null, "extended": true, "name": "Ventrilo" }, { "john": "dynamic_62", "hashcat": 1410, "extended": true, "name": "sha256($pass.$salt)" }, { "john": "dynamic_61", "hashcat": 1420, "extended": true, "name": "sha256($salt.$pass)" }, { "john": null, "hashcat": 1430, "extended": true, "name": "sha256(unicode($pass).$salt)" }, { "john": null, "hashcat": 1440, "extended": true, "name": "sha256($salt.unicode($pass))" }, { "john": "hmac-sha256", "hashcat": 1450, "extended": true, "name": "HMAC-SHA256 (key = $pass)" }, { "john": "hmac-sha256", "hashcat": 1460, "extended": true, "name": "HMAC-SHA256 (key = $salt)" }, { "john": "dynamic_63", "hashcat": null, "extended": true, "name": "sha256(sha256($pass))" }, { "john": "dynamic_64", "hashcat": 21400, "extended": true, "name": "sha256(sha256_raw($pass))", "samples": [ "0cc1b58a543f372327aa0281e97ab56e345267ee46feabf7709515debb7ec43c" ] }, { "john": "dynamic_65", "hashcat": 20710, "extended": true, "name": "sha256(sha256($pass).$salt)", "samples": [ "bfede293ecf6539211a7305ea218b9f3f608953130405cda9eaba6fb6250f824:7218532375810603" ] }, { "john": "dynamic_66", "hashcat": 20720, "extended": true, "name": "sha256($salt.sha256($pass))", "samples": [ "bae9edada8358fcebcd811f7d362f46277fb9d488379869fba65d79701d48b8b:869dc2ed80187919" ] }, { "john": null, "hashcat": 21420, "extended": true, "name": "sha256($salt.sha256_raw($pass))", "samples": [ "5934ea4d670c13a71155faba42056b2525f71bdc9215d31108990c11bf3d98e3:9269771356270099311432765354522635185291064175409115041569" ] }, { "john": "dynamic_67", "hashcat": null, "extended": true, "name": "sha256(sha256($salt).sha256($pass))" }, { "john": "dynamic_68", "hashcat": null, "extended": true, "name": "sha256(sha256($pass).sha256($pass))" }, { "john": "dynamic_320", "hashcat": null, "extended": false, "name": "PANAMA" }, { "john": null, "hashcat": null, "extended": false, "name": "BLAKE2-256" }, { "john": null, "hashcat": null, "extended": false, "name": "MD6-256", "samples": [ "bc9e2022386d929ae3936306153d9366fc555dc868579c87c7faf8846f79f414" ] } ] }, { "regex": "^[a-f0-9]{32}:[a-z0-9]{32}$", "modes": [ { "john": null, "hashcat": 11, "extended": false, "name": "Joomla < v2.5.18" } ] }, { "regex": "^[a-f0-9]{32}:[a-f0-9]{32}$", "modes": [ { "john": null, "hashcat": null, "extended": true, "name": "SAM(LM_Hash:NT_Hash)" } ] }, { "regex": "^(\\$chap\\$0\\*)?[a-f0-9]{32}[\\*:][a-f0-9]{32}(:\\d{2})?$", "modes": [ { "john": "chap", "hashcat": 4800, "extended": false, "name": "MD5(Chap)" }, { "john": "chap", "hashcat": 4800, "extended": false, "name": "iSCSI CHAP Authentication" } ] }, { "regex": "^\\$episerver\\$\\*0\\*[a-z0-9\\/=+]+\\*[a-z0-9\\/=+]{27,28}$", "modes": [ { "john": "episerver", "hashcat": 141, "extended": false, "name": "EPiServer 6.x < v4" } ] }, { "regex": "^{ssha256}\\d{2}\\$[a-z0-9$\\/.]{60}$", "modes": [ { "john": "aix-ssha256", "hashcat": 6400, "extended": false, "name": "AIX(ssha256)" } ] }, { "regex": "^[a-f0-9]{80}$", "modes": [ { "john": "dynamic_150", "hashcat": null, "extended": false, "name": "RIPEMD-320", "samples": [ "303aa1dcb731cd4e4bff2a60971eb7376c6c47cb59947c804776d115470183c8cc2e487337b45412", "3c616c27aa7539c4726388c9e047aa4ea089dd739b3cfc470e964ea12e479da3cce437b9daa90214" ] } ] }, { "regex": "^\\$episerver\\$\\*1\\*[a-z0-9\\/=+]+\\*[a-z0-9\\/=+]{42,43}$", "modes": [ { "john": "episerver", "hashcat": 1441, "extended": false, "name": "EPiServer 6.x \u2265 v4" } ] }, { "regex": "^0x0100[a-f0-9]{88}$", "modes": [ { "john": "mssql", "hashcat": 131, "extended": false, "name": "MSSQL(2000)" } ] }, { "regex": "^[a-f0-9]{96}$", "modes": [ { "john": "raw-sha384", "hashcat": 10800, "extended": false, "name": "SHA-384" }, { "john": "dynamic_390", "hashcat": 17500, "extended": false, "name": "SHA3-384" }, { "john": "dynamic_440", "hashcat": 17900, "extended": false, "name": "Keccak-384" }, { "john": null, "hashcat": null, "extended": true, "name": "Skein-512(384)" }, { "john": null, "hashcat": null, "extended": true, "name": "Skein-1024(384)" }, { "john": "dynamic_71", "hashcat": null, "extended": true, "name": "sha384($salt.$pass)" }, { "john": "dynamic_72", "hashcat": null, "extended": true, "name": "sha384($pass.$salt)" }, { "john": "dynamic_73", "hashcat": null, "extended": true, "name": "sha384(sha384($pass))" }, { "john": "dynamic_74", "hashcat": null, "extended": true, "name": "sha384(sha384_raw($pass))" }, { "john": "dynamic_75", "hashcat": null, "extended": true, "name": "sha384(sha384($pass).$salt)" }, { "john": "dynamic_76", "hashcat": null, "extended": true, "name": "sha384($salt.sha384($pass))" }, { "john": "dynamic_77", "hashcat": null, "extended": true, "name": "sha384(sha384($salt).sha384($pass))" }, { "john": "dynamic_78", "hashcat": null, "extended": true, "name": "sha384(sha384($pass).sha384($pass))" }, { "john": "dynamic_350", "hashcat": null, "extended": true, "name": "Skein-384" }, { "john": null, "hashcat": null, "extended": false, "name": "BLAKE2-384" } ] }, { "regex": "^{SSHA512}[a-z0-9\\/+]{96}$", "modes": [ { "john": "ssha512", "hashcat": 1711, "extended": false, "name": "SSHA-512(Base64)" }, { "john": "ssha512", "hashcat": 1711, "extended": false, "name": "LDAP(SSHA-512)" } ] }, { "regex": "^{ssha512}\\d{2}\\$[a-z0-9\\/.]{16,48}\\$[a-z0-9\\/.]{86}$", "modes": [ { "john": "aix-ssha512", "hashcat": 6500, "extended": false, "name": "AIX(ssha512)" } ] }, { "regex": "^[a-f0-9]{128}(:.+)?$", "modes": [ { "john": "raw-sha512", "hashcat": 1700, "extended": false, "name": "SHA-512", "samples": [ "f342aae82952db35b8e02c30115e3deed3d80fdfdadacab336f0ba51ac54e297291fa1d6b201d69a2bd77e2535280f17a54fa1e527abc6e2eddba79ad3be11c0", "7aba4411846c61b08b0f2282a8a4600232ace4dd96593c755ba9c9a4e7b780b8bdc437b5c55574b3e8409c7b511032f98ef120e25467678f0458643578eb60ff", "12b03226a6d8be9c6e8cd5e55dc6c7920caaa39df14aab92d5e3ea9340d1c8a4d3d0b8e4314f1f6ef131ba4bf1ceb9186ab87c801af0d5c95b1befb8cedae2b9" ] }, { "john": "whirlpool", "hashcat": 6100, "extended": false, "name": "Whirlpool" }, { "john": null, "hashcat": null, "extended": false, "name": "Salsa10" }, { "john": null, "hashcat": null, "extended": false, "name": "Salsa20" }, { "john": "raw-sha3", "hashcat": 17600, "extended": false, "name": "SHA3-512" }, { "john": "dynamic_400", "hashcat": 17600, "extended": false, "name": "SHA3-512" }, { "john": "raw-keccak", "hashcat": 18000, "extended": false, "name": "Keccak-512" }, { "john": "raw-blake2", "hashcat": null, "extended": false, "name": "BLAKE2-512", "samples": [ "4245af08b46fbb290222ab8a68613621d92ce78577152d712467742417ebc1153668f1c9e1ec1e152a32a9c242dc686d175e087906377f0c483c5be2cb68953e" ] }, { "john": "skein-512", "hashcat": null, "extended": false, "name": "Skein-512" }, { "john": null, "hashcat": null, "extended": true, "name": "Skein-1024(512)" }, { "john": "dynamic_82", "hashcat": 1710, "extended": true, "name": "sha512($pass.$salt)" }, { "john": "dynamic_81", "hashcat": 1720, "extended": true, "name": "sha512($salt.$pass)" }, { "john": null, "hashcat": 1730, "extended": true, "name": "sha512(unicode($pass).$salt)" }, { "john": null, "hashcat": 1740, "extended": true, "name": "sha512($salt.unicode($pass))" }, { "john": "hmac-sha512", "hashcat": 1750, "extended": true, "name": "HMAC-SHA512 (key = $pass)" }, { "john": "hmac-sha512", "hashcat": 1760, "extended": true, "name": "HMAC-SHA512 (key = $salt)" }, { "john": "dynamic_83", "hashcat": null, "extended": true, "name": "sha512(sha512($pass))" }, { "john": "dynamic_85", "hashcat": null, "extended": true, "name": "sha512(sha512($pass).$salt)" }, { "john": "dynamic_86", "hashcat": null, "extended": true, "name": "sha512($salt.sha512($pass))" }, { "john": "dynamic_87", "hashcat": null, "extended": true, "name": "sha512(sha512($salt).sha512($pass))" }, { "john": "dynamic_88", "hashcat": null, "extended": true, "name": "sha512(sha512($pass).sha512($pass))" }, { "john": null, "hashcat": null, "extended": false, "name": "MD6-512", "samples": [ "39990e5d4b65abd1c679b36fc7fa0b2f831144374ac3792736180bc5fc5ed4e93f177ed03f16ebac7327b9ddb7e4add838c3ce784653bbdd57d46a9a1d22932d" ] } ] }, { "regex": "^\\$BLAKE2\\$[a-f0-9]{128}$", "modes": [ { "john": "raw-blake2", "hashcat": 600, "extended": false, "name": "BLAKE2-512", "samples": [ "$BLAKE2$021ced8799296ceca557832ab941a50b4a11f83478cf141f51f933f653ab9fbcc05a037cddbed06e309bf334942c4e58cdf1a46e237911ccd7fcf9787cbc7fd0", "$BLAKE2$1f7d9b7c9a90f7bfc66e52b69f3b6c3befbd6aee11aac860e99347a495526f30c9e51f6b0db01c24825092a09dd1a15740f0ade8def87e60c15da487571bcef7", "$BLAKE2$296c269e70ac5f0095e6fb47693480f0f7b97ccd0307f5c3bfa4df8f5ca5c9308a0e7108e80a0a9c0ebb715e8b7109b072046c6cd5e155b4cfd2f27216283b1e" ] } ] }, { "regex": "^\\$BLAKE2\\$[a-f0-9]{128}(?::.+)$", "modes": [ { "john": null, "hashcat": 610, "extended": true, "name": "BLAKE2-512($pass.$salt)", "samples": [ "$BLAKE2$41fcd44c789c735c08b43a871b81c8f617ca43918d38aee6cf8291c58a0b00a03115857425e5ff6f044be7a5bec8536b52d6c9992e21cd43cdca8a55bbf1f5c1:1033" ] }, { "john": null, "hashcat": 620, "extended": true, "name": "BLAKE2-512($salt.$pass)", "samples": [ "$BLAKE2$f0325fdfc3f82a014935442f7adbc069d4636d67276a85b09f8de368f122cf5195a0b780d7fee709fbf1dcd02ddcb581df84508cf1fb0f3393af1be0565491c6:3301" ] } ] }, { "regex": "^[a-f0-9]{136}$", "modes": [ { "john": "xsha512", "hashcat": 1722, "extended": false, "name": "OSX v10.7" } ] }, { "regex": "^0x0200[a-f0-9]{136}$", "modes": [ { "john": "mssql12", "hashcat": 1731, "extended": false, "name": "MSSQL(2012)", "samples": [ "0x0200F733058A07892C5CACE899768F89965F6BD1DED7955FE89E1C9A10E27849B0B213B5CE92CC9347ECCB34C3EFADAF2FD99BFFECD8D9150DD6AACB5D409A9D2652A4E0AF16", "0x0200AB3E1F9028A739EEF62ABF672427276A32D5EDD349E638E7F2CD81DAA247CFE20EE4E3B0A30B2D0AE3C3FA010E61752F1BF45E045041F1B988C083C7F118527E3E5F0562" ] }, { "john": "mssql12", "hashcat": 1731, "extended": false, "name": "MSSQL(2014)", "samples": [ "0x02003788006711b2e74e7d8cb4be96b1d187c962c5591a02d5a6ae81b3a4a094b26b7877958b26733e45016d929a756ed30d0a5ee65d3ce1970f9b7bf946e705c595f07625b1", "0x02006BF4AB05873FF0C8A4AFD1DC5912CBFDEF62E0520A3353B04E1184F05C873C9C76BBADDEAAC1E9948C7B6ABFFD62BFEFD7139F17F6AFE10BE0FEE7A178644623067C2423" ] } ] }, { "regex": "^\\$ml\\$\\d+\\$[a-f0-9]{64}\\$[a-f0-9]{128}$", "modes": [ { "john": "pbkdf2-hmac-sha512", "hashcat": 7100, "extended": false, "name": "OSX v10.8" }, { "john": "pbkdf2-hmac-sha512", "hashcat": 7100, "extended": false, "name": "OSX v10.9" } ] }, { "regex": "^[a-f0-9]{256}$", "modes": [ { "john": null, "hashcat": null, "extended": true, "name": "Skein-1024" } ] }, { "regex": "^grub\\.pbkdf2\\.sha512\\.\\d+\\.([a-f0-9]{128,2048}\\.|\\d+\\.)?[a-f0-9]{128}$", "modes": [ { "john": null, "hashcat": 7200, "extended": false, "name": "GRUB 2" } ] }, { "regex": "^sha1\\$[a-z0-9]+\\$[a-f0-9]{40}$", "modes": [ { "john": null, "hashcat": 124, "extended": false, "name": "Django(SHA-1)" } ] }, { "regex": "^[a-f0-9]{49}$", "modes": [ { "john": "citrix_ns10", "hashcat": 8100, "extended": false, "name": "Citrix Netscaler" } ] }, { "regex": "^\\$S\\$[a-z0-9\\/.]{52}$", "modes": [ { "john": "drupal7", "hashcat": 7900, "extended": false, "name": "Drupal > v7.x" } ] }, { "regex": "^\\$5\\$(rounds=\\d+\\$)?[a-z0-9\\/.]{0,16}\\$[a-z0-9\\/.]{43}$", "modes": [ { "john": "sha256crypt", "hashcat": 7400, "extended": false, "name": "SHA-256 Crypt" } ] }, { "regex": "^0x[a-f0-9]{4}[a-f0-9]{16}[a-f0-9]{64}$", "modes": [ { "john": "sybasease", "hashcat": 8000, "extended": false, "name": "Sybase ASE" } ] }, { "regex": "^\\$6\\$(rounds=\\d+\\$)?[a-z0-9\\/.]{0,16}\\$[a-z0-9\\/.]{86}$", "modes": [ { "john": "sha512crypt", "hashcat": 1800, "extended": false, "name": "SHA-512 Crypt" } ] }, { "regex": "^\\$sha\\$[a-z0-9]{1,16}\\$([a-f0-9]{32}|[a-f0-9]{40}|[a-f0-9]{64}|[a-f0-9]{128}|[a-f0-9]{140})$", "modes": [ { "john": null, "hashcat": 20711, "extended": false, "name": "Minecraft (AuthMe Reloaded sha256)", "samples": [ "$SHA$7218532375810603$bfede293ecf6539211a7305ea218b9f3f608953130405cda9eaba6fb6250f824" ] } ] }, { "regex": "^sha256\\$[a-z0-9]+\\$[a-f0-9]{64}$", "modes": [ { "john": null, "hashcat": null, "extended": false, "name": "Django(SHA-256)" } ] }, { "regex": "^sha384\\$[a-z0-9]+\\$[a-f0-9]{96}$", "modes": [ { "john": null, "hashcat": null, "extended": false, "name": "Django(SHA-384)" } ] }, { "regex": "^crypt1:[a-z0-9+=]{12}:[a-z0-9+=]{12}$", "modes": [ { "john": null, "hashcat": null, "extended": false, "name": "Clavister Secure Gateway" } ] }, { "regex": "^[a-f0-9]{112}$", "modes": [ { "john": null, "hashcat": null, "extended": false, "name": "Cisco VPN Client(PCF-File)" } ] }, { "regex": "^[a-f0-9]{1329}$", "modes": [ { "john": null, "hashcat": null, "extended": false, "name": "Microsoft MSTSC(RDP-File)" } ] }, { "regex": "^[^\\/:*?\"<>|]{0,60}::[^\\/:*?\"<>|]{0,45}:[a-f0-9]{0,48}:[a-f0-9]{48}:[a-f0-9]{16}$", "modes": [ { "john": "netntlm / netntlm-naive", "hashcat": 5500, "extended": false, "name": "NetNTLMv1 / NetNTLMv1+ESS (vanilla)", "samples": [ "u4-netntlm::kNS:338d08f8e26de93300000000000000000000000000000000:9526fb8c23a90751cdd619b6cea564742e1e4bf33006ba41:cb8086049ec4736c", "CORP\\Administrator:::25B2B477CE101D83648BB087CE7A1C217F51C7FC64C0EBB1:C8BD0C1630A9ECF7A95F494A8F0B2CB4A3F25B1225514304:1122334455667788", "DOMAIN\\User:::c70e4fb229437ef300000000000000000000000000000000:abf7762caf2b1bbfc5cfc1f46665249f049e0af72ae5b5a9:24ca92fdab441aa4", "ESS:::4765f360625700b000000000000000000000000000000000:81f5ecd8a77fe819f7f6689a08a27ac705fc2e1bb00cecb2:c75c20bff9baa71f" ] }, { "john": "netntlm / netntlm-naive", "hashcat": 27000, "extended": false, "name": "NetNTLMv1 / NetNTLMv1+ESS (NT)", "samples": [ "::5V4T:ada06359242920a500000000000000000000000000000000:0556d5297b5daa70eaffde82ef99293a3f3bb59b7c9704ea:9c23f6c094853920" ] } ] }, { "regex": "^[^\\/:*?\"<>|]{0,60}::[^\\/:*?\"<>|]{0,45}:[a-f0-9]{16}:[a-f0-9]{32}:[a-f0-9]{2,1024}$", "modes": [ { "john": "netntlmv2", "hashcat": 5600, "extended": false, "name": "NetNTLMv2 (vanilla)", "samples": [ "admin::N46iSNekpT:08ca45b7d7ea58ee:88dcbe4446168966a153a0064958dac6:5c7830315c7830310000000000000b45c67103d07d7b95acd12ffa11230e0000000052920b85f78d013c31cdb3b92f5d765c783030", "ntlmv2test::WORKGROUP:1122334455667788:07659A550D5E9D02996DFD95C87EC1D5:0101000000000000006CF6385B74CA01B3610B02D99732DD000000000200120057004F0052004B00470052004F00550050000100200044004100540041002E00420049004E0043002D0053004500430055005200490000000000", "USER1::Domain:1122334455667788:5E4AB1BF243DCA304A00ADEF78DC38DF:0101000000000000BB50305495AACA01338BC7B090A62856000000000200120057004F0052004B00470052004F00550050000000000000000000", "TESTWORKGROUP\\NTlmv2:::1122334455667788:07659A550D5E9D02996DFD95C87EC1D5:0101000000000000006CF6385B74CA01B3610B02D99732DD000000000200120057004F0052004B00470052004F00550050000100200044004100540041002E00420049004E0043002D0053004500430055005200490000000000", "NTlmv2::TESTWORKGROUP:1122334455667788:07659A550D5E9D02996DFD95C87EC1D5:0101000000000000006CF6385B74CA01B3610B02D99732DD000000000200120057004F0052004B00470052004F00550050000100200044004100540041002E00420049004E0043002D0053004500430055005200490000000000", "TestUser::W2K3ADWIN7:1122334455667788:989B96DC6EAB529F72FCBA852C0D5719:01010000000000002EC51CEC91AACA0124576A744F198BDD000000000200120057004F0052004B00470052004F00550050000000000000000000", "user::W2K3ADWIN7:1122334455667788:5BD1F32D8AFB4FB0DD0B77D7DE2FF7A9:0101000000000000309F56FE91AACA011B66A7051FA48148000000000200120057004F0052004B00470052004F00550050000000000000000000", "W2K3ADWIN7\\user1:::1122334455667788:027EF88334DAA460144BDB678D4F988D:010100000000000092809B1192AACA01E01B519CB0248776000000000200120057004F0052004B00470052004F00550050000000000000000000", "W2K3ADWIN7\\TEST_USER:::1122334455667788:A06EC5ED9F6DAFDCA90E316AF415BA71:010100000000000036D3A13292AACA01D2CD95757A0836F9000000000200120057004F0052004B00470052004F00550050000000000000000000" ] }, { "john": "netntlmv2", "hashcat": 27100, "extended": false, "name": "NetNTLMv2 (NT)", "samples": [ "0UL5G37JOI0SX::6VB1IS0KA74:ebe1afa18b7fbfa6:aab8bf8675658dd2a939458a1077ba08:010100000000000031c8aa092510945398b9f7b7dde1a9fb00000000f7876f2b04b700" ] } ] }, { "regex": "^\\$(?:af|k4)\\$[^$]+\\$[a-f0-9]{32}$", "modes": [ { "john": "krb4", "hashcat": null, "extended": false, "name": "Kerberos 4 TGT", "samples": [ "$af$UMICH.EDU$bb46613c503ad92e649d99d038efddb2", "$af$UMICH.EDU$bebcedf43f7f2aa78cf9c0639e494c92" ] } ] }, { "regex": "^\\$krb5\\$[^$]+\\$[^$]+\\$[a-f0-9]{456}$", "modes": [ { "john": "krb5", "hashcat": null, "extended": false, "name": "Kerberos 5 TGT", "samples": [ "$krb5$oskov$ACM.UIUC.EDU$4730d7249765615d6f3652321c4fb76d09fb9cd06faeb0c31b8737f9fdfcde4bd4259c31cb1dff25df39173b09abdff08373302d99ac09802a290915243d9f0ea0313fdedc7f8d1fae0d9df8f0ee6233818d317f03a72c2e77b480b2bc50d1ca14fba85133ea00e472c50dbc825291e2853bd60a969ddb69dae35b604b34ea2c2265a4ffc72e9fb811da17c7f2887ccb17e2f87cd1f6c28a9afc0c083a9356a9ee2a28d2e4a01fc7ea90cc8836b8e25650c3a1409b811d0bad42a59aa418143291d42d7b1e6cb5b1876a4cc758d721323a762e943f774630385c9faa68df6f3a94422f97", "$krb5$oskov$ACM.UIUC.EDU$6cba0316d38e31ba028f87394792baade516afdfd8c5a964b6a7677adbad7815d778b297beb238394aa97a4d495adb7c9b7298ba7c2a2062fb6c9a4297f12f83755060f4f58a1ea4c7026df585cdfa02372ad619ab1a4ec617ad23e76d6e37e36268d9aa0abcf83f11fa8092b4328c5e6c577f7ec6f1c1684d9c99a309eee1f5bd764c4158a2cf311cded8794b2de83131c3dc51303d5300e563a2b7a230eac67e85b4593e561bf6b88c77b82c729e7ba7f3d2f99b8dc85b07873e40335aff4647833a87681ee557fbd1ffa1a458a5673d1bd3c1587eceeabaebf4e44c24d9a8ac8c1d89" ] } ] }, { "regex": "^\\$(?:krb5pa\\$\\d{2}|mskrb5)\\$.+\\$[a-f0-9]+$", "modes": [ { "john": "krb5pa-md5", "hashcat": 7500, "extended": false, "name": "Kerberos 5 AS-REQ Pre-Auth etype 23", "samples": [ "$krb5pa$23$user$realm$salt$5cbb0c882a2b26956e81644edbdb746326f4f5f0e947144fb3095dffe4b4b03e854fc1d631323632303636373330383333353630", "$krb5pa$23$user$realm$salt$afcbe07c32c3450b37d0f2516354570fe7d3e78f829e77cdc1718adf612156507181f7daeb03b6fbcfe91f8346f3c0ae7e8abfe5", "$mskrb5$john$JOHN.DOE.MS.COM$02E837D06B2AC76891F388D9CC36C67A$2A9785BF5036C45D3843490BF9C228E8C18653E10CE58D7F8EF119D2EF4F92B1803B1451", "$krb5pa$23$$$$afcbe07c32c3450b37d0f2516354570fe7d3e78f829e77cdc1718adf612156507181f7daeb03b6fbcfe91f8346f3c0ae7e8abfe5" ] } ] }, { "regex": "^\\$krb5tgs\\$23\\$(?:[^$]+\\$[^$]+\\$[^$]+\\$)?[a-f0-9]{32}\\$[a-f0-9]{64,40960}$", "modes": [ { "john": "krb5tgs", "hashcat": 13100, "extended": false, "name": "Kerberos 5 TGS-REP etype 23", "samples": [ "$krb5tgs$23$*user$realm$test/spn*$b548e10f5694ae018d7ad63c257af7dc$35e8e45658860bc31a859b41a08989265f4ef8afd75652ab4d7a30ef151bf6350d879ae189a8cb769e01fa573c6315232b37e4bcad9105520640a781e5fd85c09615e78267e494f433f067cc6958200a82f70627ce0eebc2ac445729c2a8a0255dc3ede2c4973d2d93ac8c1a56b26444df300cb93045d05ff2326affaa3ae97f5cd866c14b78a459f0933a550e0b6507bf8af27c2391ef69fbdd649dd059a4b9ae2440edd96c82479645ccdb06bae0eead3b7f639178a90cf24d9a", "$krb5tgs$23$74809c4c83c3c8279c6058d2f206ec2f$78b4bbd4d229487d5afc9a6050d4144ce10e9245cdfc0df542879814ce740cebb970ee820677041596d7e55836a18cc95c04169e7c74a4a22ae94e66f3d37150e26cc9cb99e189ef54feb7a40a8db2cb2c41db80d8927c74da7b33b52c58742d2109036b8ab27184609e7adff27b8f17b2f2a7b7d85e4ad532d8a70d48685a4390a9fc7a0ab47fd17334534d795abf83462f0db3de931c6a2d5988ab5bf3253facfff1381afb192ce385511c9052f2915ffdb7ea28a1bbad0573d9071e79dc15068527d50100de8813793a15c292f145fa3797ba86f373a4f0a05e5f2ec7dbfd8c8b5139cc7fbb098ea1dd91a7440134ffe2aff7174d0df13dcad82c81c680a70127a3ec8792bdecd74a878f97ff2b21277dc8c9a2f7bbcd9f72560dd933d85585259067d45a46a6f505d03f188b62c37edf03f117503a26743ebd674d5b07324c15fc8418881613b365402e0176da97d43cf85e8239b69aee07791233a959bcaf83a7f492fa718dd0a1747eaf5ce626eb11bda89e8235a056e2721f45c3b61442d893ef32a8c192ea0dadb853f3c6f3c75e92f23c744605c6f55578f696b0f33a9586b8aae3e12e38a097692cd9a31d780d973eaaf62ef23b2fc9ae59a38bfd8ea14d3289b46910f61a90aa733e66382bc27f40ba634e55ef1bec0ca7f71546b79566d85664b92f9fae495fcef5cde4c4399a6798569a7e81b9cc4bdde7104f3fe181401f82bba944e3b0a406c7093c00ff9d5984a82517b1a64a8aa561bc1f0cbafbdbbc5654d375c91d4e485e17bb06838109fbc1504147481c91652f545086a84daa423a6286ea6bb13460c5ff3d865a7b37b9ce4e7b07fbe2f6897c12c1e4df2e875c1ec9cfbf84097a7f48b270baf3481263b21849ab93c231490d06a23461a5e00c23df76bca8e5a19256d859304e1f5752bf055ac7f4843e1ad174f1cbbf5c142958f9310025ce439d5979982fb0b8c2ea95e1a22ee8dc63423d9d364cb0b95bcdf89ec4ed485b9005326d728757d77aa3e020a4a61d7deb782bc5264dca350173609772cd6d003ee8104dd24d310c9a18a44f78e27d65095f5bb54f6118c8f0d79ad5a850cec8d40a19bd0134144e904c9eb7fdcff3293696071fc1118f6b2f934281a25bcd5ca7d567714b1e43bd6d09bfcc8744c0ca273a75938394ac2fb31957287093346078577c94a71dfa6ad4a63211f54f00ef7a9064d070aaff84116ee891728915c938a8a32e87aaa00ec18e2b4e9ae88f7e53f08d855052a995f92351be32d8df934eab487103b0f089828e5fb5f73af3a8a05b9fffd25c43a392994743de3de1a2a9b8bba27e02ae2341f09d63aafab291759c41b9635521ca02f08e21e7e5c3ce75c8c3515eaa99aeb9bf8e204663e8b6b8507ecf87230a131687b4770e250ba0ef29fa3ca3b47b34971e17c6a3ef785acdd7c90da9d2", "$krb5tgs$23$8bef2ad33c7d5d23c8693ccd868d9f84$f72688ca744f9634625c2dbd94ef6193644e08c4627839ce5fcf8bbfbd15ad7093fb3ecc24512ac161188a7ad2de127166f4f244f37527e15468d844efe6396756b8cf8341cbfe70e454e1f2b324f5ddee64f4f4947e1bb6776041e28e6261b57b1791677b35e1b4171ec5a05062b7bd7eb5558d6e4165ad916e790954f163a7f7e8390462295d74eff33fcbb442d4281f7cf68ddbb6ce27030015b2cf4f68e04793a9674e634663a68622e13a5a6d8c27bf8b90ee18033e754c95776d1dbd8d73ab292d27c445eb33b9b814945617f527678667b2d81adc57c7c62713d7826bc9ea918b330245a4d7fbcc33889901a63131be87a0d4e8f49d1259141677bfa27c284d8cfb1c94f4d4a602f30b774e58378710d0ad2a73c978c8c6470402c0cdbdf5d505fe07dc4250510836d5ec969b56790128aa75b292d71d4e6c77ffee261230fc7b11969e4701abc63f120420cc0f74f99e42d6613713fc0530842f77b7a45daadb296c744e0725cd2867492b5bc1cb6a4e3315e1f6b7e5b0299a9283235769d95ef63c885352b08176547f86a03ec323a2e5c84f66f3ab699fc7c5e8b2120659c963d5c98df9529939b250e0f1703f5a9859f8b00a5317aa92dc37093dc87984c0eb841cd2ce77b80510c79e8b5eb56c15f07eba936d257a4d78f82a6179ba7ed07fbeba68d43112e44f850a5034b9239c689828f7039b8c8efcbecbc34ab92d5fb869482456a92ce9201e6586458e1d7bd38b2251b1fb573dc1c6ce40a428448cfaf18e5251436aece6baa2356a06a50a6d4c011977233e7b38007cad4a869941fea1139ff4d2ce216166abf5dfa89dc85719b14eaa0d492b1d442b67cb10c81bb35e1a96ae4f62e8c4fbf604c916e2ac4a121620a2beb40cf7d43bbe7ddbb38435dacd7aba846915eb01b57d33d5dcc25082e79452416d86143e33608a8e279d396cca4a8cc5d02ad820868c4381f9f7f5bab23ba8440fd9ab5ae713cb1c20a82e0a0e93a83248b2a2a8a30aceed71a8e78526943b45f122f16ea004ffdea16005bb52e184b7498c8aefb26da2e8b43e98343e9bb364578deceee623656985fdb58dda60a112d9dc1f0e36230d43ab8d1f48ba2013fd641001f675b8918fb69826decefd742a3f3c02b49988b2b439db763db2d95744a2f2456f5b32ea64e8836873ecce085875b4e054e55700198642961560529bba800a683f149c63dd5f983477f415399f229f6f292327ebac73a6707da022e472f1081421c8549d21696db7fe7bdd2ad744a5afbada9a719c26e3962cd86f8e" ] } ] }, { "regex": "^\\$krb5asrep\\$23\\$(?:[^:$]+:)?[a-f0-9]{32}\\$[a-f0-9]{64,40960}$", "modes": [ { "john": "krb5asrep", "hashcat": 18200, "extended": false, "name": "Kerberos 5 AS-REP etype 23", "samples": [ "$krb5asrep$23$8cf8eb5287e28a4006c064892150c4fb$3e05ecc13548bec8e1eeb900dea5429cc6931bae9b8524490eb3a8801560871fe44355ed556202afbb39872e1bbb5c3c4f1b37dcd68fda89a23ebad917d4bbb0933edd94331598939e5d0c0c98c7e219a2e9dd6b877280d1bd7c51131413be577a167208bcc21e9fe7ae8f393278d740e72ca5c44c42d5cb0bf6bab0a36f1b88b7ddc4abbc6f152e652f6ba35c2955fb4132e11b7e566f3b422c3740f79847b77783d245a4e570b8a621b4ff6ff4815566446af70313ee78133707a76a4e4424783bd7c04920aa822a1a36b29f7e25cef186e6439fc46e42e23d6bd918969ef49b8388aef158e443b3a57dbde7ada631fbef7326f9046a9b", "$krb5asrep$23$c447eddaebf22ebf006a8fc6f986488c$eb3a17eb56287b474cecad5d4e0490d949977ba3f5015220bcd3080444d5601d67b76c5453b678e8527624e40c273bea4cfe4a7303e136b9bc3b9e63b6fb492ee4b4d2f830c5fa5a55466b57a678f708438f6712354a2deb851792b09270f4941966b82a2fd5ad8fa1fbd95a60b0f9bcd57774b3e55467a02ffcb3f1379104c24e468342f83df20b571e6f34f9a9842b43735d58d94514dcefa76719c0f5c7c3a3bfa770380924625aa0a3472d7c02d10dbb278fd946f7efcfe59a4d4cb7bdb9c5dbddc027611fe333d3ac940ec5b4ed43b55ab54b03cd2df0a9a2a7b5d235c226b259bd5ff8e0e49680351d4f0c4d13e258bc8d383cad6fc2711be0", "$krb5asrep$23$771adbc2397abddef676742924414f2b$2df6eb2d9c71820dc3fa2c098e071d920f0e412f5f12411632c5ee70e004da1be6f003b78661f8e4507e173552a52da751c45887c19bc1661ed334e0ccb4ef33975d4bd68b3d24746f281b4ca4fdf98fca0e50a8e845ad7d834e020c05b1495bc473b0295c6e9b94963cb912d3ff0f2f48c9075b0f52d9a31e5f4cc67c7af1d816b6ccfda0da5ccf35820a4d7d79073fa404726407ac840910357ef210fcf19ed81660106dfc3f4d9166a89d59d274f31619ddd9a1e2712c879a4e9c471965098842b44fae7ca6dd389d5d98b7fd7aca566ca399d072025e81cf0ef5075447687f80100307145fade7a8", "$krb5asrep$23$user@domain.com:3e156ada591263b8aab0965f5aebd837$007497cb51b6c8116d6407a782ea0e1c5402b17db7afa6b05a6d30ed164a9933c754d720e279c6c573679bd27128fe77e5fea1f72334c1193c8ff0b370fadc6368bf2d49bbfdba4c5dccab95e8c8ebfdc75f438a0797dbfb2f8a1a5f4c423f9bfc1fea483342a11bd56a216f4d5158ccc4b224b52894fadfba3957dfe4b6b8f5f9f9fe422811a314768673e0c924340b8ccb84775ce9defaa3baa0910b676ad0036d13032b0dd94e3b13903cc738a7b6d00b0b3c210d1f972a6c7cae9bd3c959acf7565be528fc179118f28c679f6deeee1456f0781eb8154e18e49cb27b64bf74cd7112a0ebae2102ac" ] } ] }, { "regex": "^\\$krb5asrep\\$18\\$[^$]+\\$[a-f0-9]{542}\\$[a-f0-9]{24}$", "modes": [ { "john": "krb5asrep", "hashcat": null, "extended": false, "name": "Kerberos 5 AS-REP etype 18", "samples": [ "$krb5asrep$18$EXAMPLE.COMlulu$b49aa3de9314e2d8daafe323f2e84b9a4ddc361d99bf3bf3a99102f8bff5368bdefc9d7ae090532fdad2a508ac1271bfbd17363b3a1da23bf9db324a24c238634e3ab28d7f4eca009b4c3953c882f5a4206458a0b4238f3e538308d7339382f38412bbfe7b71e269274526edf7b802ea1ecdf7b8c17f9502b7a6750313329a68b8f8a2d039c8dfe74b9ead98684cfc86e5d0f77c18ba05718b01c33831db17191a0e77f9cef998bbb66a794915b03c94725aceabe9e2b5e25b665a37b5dd3a59a5552bd779dd5f0ae7295d232194eec1ca1ba0324bdc836ba623117e59fcfedab45a86d76d2c768341d327c035a1f5c756cfc06d76b6f7ea31c7a8e782eb48de0aab2fb373ffc2352c4192838323f8$a5245c7f39480a840da0e4c6", "$krb5asrep$18$EXAMPLE.COMluser$42e34732112be6cec1532177a6c93af5ec3b2fc7da106c004d6d89ddcb4131092aecbead3e9f30d07b593f4c7adc6478ab50b80fee07db3531471f5f1986c8882c45fef784258f9d43195108b83a74f6dcae1beed179c356c0da4e2d69f122efc579fd207d2b2b241a6c275997f2ec6fec95573a7518cb8b8528d932cc14186e4c5d46cef1eed4f2924ea316d80a62b0bcd98592a11eb69c04ef43b63aeae35e9f8bd8f842d0c9c33d768cd33c55914c2a1fb2f7c640b7270cf2274993c0ce4f413aac8e9d7a231c70dd0c6f8b9c16b47a90fae8d68982a66aa58e2eb8dde93d3504e87b5d4e33827c2aa501ed63544c0578032f395205c63b030cccc699aafb9132692c79a154d645fe83927b0eda$420973360c2e907b9053f1db" ] } ] }, { "regex": "^\\$krb5asrep\\$17\\$[^$]+\\$[a-f0-9]{542}\\$[a-f0-9]{24}$", "modes": [ { "john": "krb5asrep", "hashcat": null, "extended": false, "name": "Kerberos 5 AS-REP etype 17", "samples": [ "$krb5asrep$17$EXAMPLE.COMhero$4e7c79214fd330b2e505a4c75e257e4686029136d54f92ce91bb69d5ffc064e64e925b3ae8bc1df431c74ccaf2075cb4a1a32151b0848964e147bf6f8e4a50caa7931faad50433991e016e312c70ad9007e38166f8df39eda3edd2445cce757e062d0919e663a67eb9fdb472b2a840cf521f18bd794947bcc0c0c6394cc5a60b860c963640867e623732206e7bf904d3b066a17b6f4ea3fd6d74f110ee80052e5297f7a19aaec22e22d582d183d43d6ca1792da187a3a182d1f479c5b4692841ccd701a63735d64584c4f8d199d67876dae5181f4eadfe75e454d0587d0953d7e16cb1b63265da6188b10c1746a2e83c41707bd03fcb2d460d1c6802826a0347b5ee7cdbe5384acad139b4395928bd$7ed0277ba9b853008cc62abe" ] } ] }, { "regex": "^\\$krb5tgs\\$17\\$[^$]{1,512}\\$[^$]{1,512}\\$[^$]{1,4}?\\$?[a-f0-9]{1,32}\\$[a-f0-9]{64,40960}$", "modes": [ { "john": null, "hashcat": 19600, "extended": false, "name": "Kerberos 5 TGS-REP etype 17 (AES128-CTS-HMAC-SHA1-96)", "samples": [ "$krb5tgs$17$srv_http$synacktiv.local$849e31b3db1c1f203fa20b85$948690f5875125348286ad3346d27b43eaabc71896b620c16de7ddcdbd561628c650c508856a3f574261948b6db4b48332d30536e978046a423ad4368f9a69b4dc4642dab4e0d475d8299be718fd6f98ac85a771b457b2453e78c9411dfce572b19660fe7a5a8246d9b2a91ea2f14d1986ea0a77ecf9b8330bc8fd9ab540bcf46b74c5aa7005cfccd89ec05f66aeab30c6b2bf8595cf6c9a1b68ad885258850c4b1dd9265f270fb2af52fd76c16246df51ea67efc58a65c345686c84e43642febe908a" ] } ] }, { "regex": "^\\$krb5tgs\\$18\\$[^$]{1,512}\\$[^$]{1,512}\\$[^$]{1,4}?\\$?[a-f0-9]{1,32}\\$[a-f0-9]{64,40960}$", "modes": [ { "john": null, "hashcat": 19700, "extended": false, "name": "Kerberos 5 TGS-REP etype 18 (AES256-CTS-HMAC-SHA1-96)", "samples": [ "$krb5tgs$18$srv_http$synacktiv.local$16ce51f6eba20c8ee534ff8a$57d07b23643a516834795f0c010da8f549b7e65063e5a367ca9240f9b800adad1734df7e7d5dd8307e785de4f40aacf901df41aa6ce695f8619ec579c1fa57ee93661cf402aeef4e3a42e7e3477645d52c09dc72feade03512dffe0df517344f673c63532b790c242cc1d50f4b4b34976cb6e08ab325b3aefb2684262a5ee9faacb14d059754f50553be5bfa5c4c51e833ff2b6ac02c6e5d4c4eb193e27d7dde301bd1ddf480e5e282b8c27ef37b136c8f140b56de105b73adeb1de16232fa1ab5c9f6" ] } ] }, { "regex": "^\\$krb5pa\\$17\\$[^$]{1,512}\\$[^$]{1,512}(?:\\$[^$]*)?\\$[a-f0-9]{104,112}$", "modes": [ { "john": "krb5pa-sha1", "hashcat": 19800, "extended": false, "name": "Kerberos 5 AS-REQ Pre-Auth etype 17", "samples": [ "$krb5pa$17$hashcat$HASHCATDOMAIN.COM$a17776abe5383236c58582f515843e029ecbff43706d177651b7b6cdb2713b17597ddb35b1c9c470c281589fd1d51cca125414d19e40e333", "$krb5pa$17$user1$EXAMPLE.COM$$c5461873dc13665771b98ba80be53939e906d90ae1ba79cf2e21f0395e50ee56379fbef4d0298cfccfd6cf8f907329120048fd05e8ae5df4" ] } ] }, { "regex": "^\\$krb5pa\\$18\\$[^$]{1,512}\\$[^$]{1,512}(?:\\$[^$]*)?\\$[a-f0-9]{104,112}$", "modes": [ { "john": "krb5pa-sha1", "hashcat": 19900, "extended": false, "name": "Kerberos 5 AS-REQ Pre-Auth etype 18", "samples": [ "$krb5pa$18$hashcat$HASHCATDOMAIN.COM$96c289009b05181bfd32062962740b1b1ce5f74eb12e0266cde74e81094661addab08c0c1a178882c91a0ed89ae4e0e68d2820b9cce69770", "$krb5pa$18$user1$EXAMPLE.COM$$2a0e68168d1eac344da458599c3a2b33ff326a061449fcbc242b212504e484d45903c6a16e2d593912f56c93883bf697b325193d62a8be9c", "$krb5pa$18$aduser$AD.EXAMPLE.COM$$64dfeee04be2b2e0423814e0df4d0f960885aca4efffe6cb5694c4d34690406071c4968abd2c153ee42d258c5e09a41269bbcd7799f478d3", "$krb5pa$18$aduser$AD.EXAMPLE.COM$AD.EXAMPLE.COMaduser$f94f755a8b4493d925094a4eb1cec630ac40411a14c9733a853516fe426637d9daefdedc0567e2bb5a83d4f89a0ad1a4b178662b6106c0ff" ] } ] }, { "regex": "^\\$krb5db\\$17\\$[^$]{1,512}\\$[^$]{1,512}(?:\\$[^$]*)?\\$[a-f0-9]{32}$", "modes": [ { "john": null, "hashcat": 28800, "extended": false, "name": "Kerberos 5 DB etype 17", "samples": [ "$krb5db$17$test$TEST.LOCAL$1c41586d6c060071e08186ee214e725e" ] } ] }, { "regex": "^\\$krb17\\$[^$]{1,512}\\$[a-f0-9]{32}$", "modes": [ { "john": "krb5-17", "hashcat": null, "extended": false, "name": "Kerberos 5 DB etype 17", "samples": [ "$krb17$TEST.LOCALtest$6fb8b78e20ad3df6591cabb9cacf4594", "$krb17$TEST.LOCALtest$b7dc1cf2b403cf5f27ea9b2ea526dc5a" ] } ] }, { "regex": "^\\$krb5db\\$18\\$[^$]{1,512}\\$[^$]{1,512}(?:\\$[^$]{1,512})?\\$[a-f0-9]{64}$", "modes": [ { "john": null, "hashcat": 28900, "extended": false, "name": "Kerberos 5 DB etype 18", "samples": [ "$krb5db$18$test$TEST.LOCAL$266b5a53a6d663c3f69174f3309acada8e467c097c7973699f86286a6cf1a6c7" ] } ] }, { "regex": "^\\$krb18\\$[^$]{1,512}\\$[a-f0-9]{64}$", "modes": [ { "john": "krb5-18", "hashcat": null, "extended": false, "name": "Kerberos 5 DB etype 18", "samples": [ "$krb18$OLYMPE.OLtest$214bb89cf5b8330112d52189ab05d9d05b03b5a961fe6d06203335ad5f339b26" ] } ] }, { "regex": "^\\$krb3\\$[^$]{1,512}\\$[a-f0-9]{16}$", "modes": [ { "john": "krb5-3", "hashcat": null, "extended": false, "name": "Kerberos 5 DB etype 3", "samples": [ "$krb3$INTERNAL.CORP1user3$eafdc79b7620584a", "$krb3$EXAMPLE.COMlulu$25bfb33132c11346", "$krb3$EXAMPLE.COMluluaaaa$97076894ae025738", "$krb3$EXAMPLE.COMluluaaaa$79850e6e9e5e92d0" ] } ] }, { "regex": "^\\$scram\\$\\d+\\$[a-z0-9\\/.]{16}\\$sha-1=[a-z0-9\\/.]{27},sha-256=[a-z0-9\\/.]{43},sha-512=[a-z0-9\\/.]{86}$", "modes": [ { "john": null, "hashcat": null, "extended": false, "name": "SCRAM Hash" } ] }, { "regex": "^[a-f0-9]{40}:[a-f0-9]{0,32}$", "modes": [ { "john": null, "hashcat": 4521, "extended": false, "name": "Redmine", "samples": [ "c18e826af2a78c7b9b7261452613233417e65817:28246535720688452723483475753333" ] } ] }, { "regex": "^(.+)?\\$[a-f0-9]{16}$", "modes": [ { "john": "sapb", "hashcat": 7700, "extended": false, "name": "SAP CODVN B (BCODE)" } ] }, { "regex": "^(.+)?\\$[a-f0-9]{40}$", "modes": [ { "john": "sapg", "hashcat": 7800, "extended": false, "name": "SAP CODVN F/G (PASSCODE)" } ] }, { "regex": "^(.+\\$)?[a-z0-9\\/.+]{30}(:.+)?$", "modes": [ { "john": "md5ns", "hashcat": 22, "extended": false, "name": "Juniper Netscreen/SSG(ScreenOS)" } ] }, { "regex": "^0x[a-f0-9]{60}\\s0x[a-f0-9]{40}$", "modes": [ { "john": null, "hashcat": 123, "extended": false, "name": "EPi", "samples": [ "0x326C6D7B4E4F794B79474E36704F35723958397163735263516265456E31 0xAFC55E260B8F45C0C6512BCE776C1AD8312B56E6" ] } ] }, { "regex": "^[a-f0-9]{40}:[^*]{1,25}$", "modes": [ { "john": null, "hashcat": 121, "extended": false, "name": "SMF \u2265 v1.1" } ] }, { "regex": "^(\\$wbb3\\$\\*1\\*)?[a-f0-9]{40}[:*][a-f0-9]{40}$", "modes": [ { "john": "wbb3", "hashcat": 8400, "extended": false, "name": "Woltlab Burning Board 3.x" } ] }, { "regex": "^[a-f0-9]{130}(:[a-f0-9]{40})?$", "modes": [ { "john": null, "hashcat": 7300, "extended": false, "name": "IPMI2 RAKP HMAC-SHA1" } ] }, { "regex": "^[a-f0-9]{32}:\\d+:[a-z0-9_.+\\-]+@[a-z0-9\\-]+\\.[a-z0-9\\-.]+$", "modes": [ { "john": null, "hashcat": 6800, "extended": false, "name": "Lastpass" } ] }, { "regex": "^[a-z0-9\\/.]{16}([:$].+)?$", "modes": [ { "john": "asa-md5", "hashcat": 2410, "extended": false, "name": "Cisco-ASA(MD5)" }, { "john": "dynamic_20", "hashcat": 2410, "extended": true, "name": "md5($pass.$salt)" } ] }, { "regex": "^\\$vnc\\$\\*[a-f0-9]{32}\\*[a-f0-9]{32}$", "modes": [ { "john": "vnc", "hashcat": null, "extended": false, "name": "VNC" } ] }, { "regex": "^[a-z0-9]{32}(:([a-z0-9\\-]+\\.)?[a-z0-9\\-.]+\\.[a-z]{2,7}:.+:\\d+)?$", "modes": [ { "john": null, "hashcat": 8300, "extended": false, "name": "DNSSEC(NSEC3)" } ] }, { "regex": "^(user-.+:)?\\$racf\\$\\*.+\\*[a-f0-9]{16}$", "modes": [ { "john": "racf", "hashcat": 8500, "extended": false, "name": "RACF" } ] }, { "regex": "^\\$3\\$\\$[a-f0-9]{32}$", "modes": [ { "john": null, "hashcat": null, "extended": false, "name": "NTHash(FreeBSD Variant)" } ] }, { "regex": "^\\$sha1\\$\\d+\\$[a-z0-9\\/.]{0,64}\\$[a-z0-9\\/.]{28}$", "modes": [ { "john": "sha1crypt", "hashcat": 15100, "extended": false, "name": "SHA-1 Crypt (Juniper/NetBSD)", "samples": [ "$sha1$20000$75552156$HhYMDdaEHiK3eMIzTldOFPnw.s2Q", "$sha1$64000$wnUR8T1U$azjCegpOIk0FjE61qzGWhdkpuMRL" ] } ] }, { "regex": "^[a-f0-9]{70}$", "modes": [ { "john": "hmailserver", "hashcat": 1421, "extended": false, "name": "hMailServer" } ] }, { "regex": "^[:\\$][AB][:\\$]([a-f0-9]{1,8}[:\\$])?[a-f0-9]{32}$", "modes": [ { "john": "mediawiki", "hashcat": 3711, "extended": false, "name": "MediaWiki" } ] }, { "regex": "^[a-f0-9]{140}$", "modes": [ { "john": null, "hashcat": null, "extended": false, "name": "Minecraft(xAuth)" } ] }, { "regex": "^\\$pbkdf2(-hmac)?(-sha1)?\\$(\\d{1,6}\\$[a-z0-9\\/.]+\\$[a-z0-9\\/.]+|\\d{1,6}\\.[a-f0-9]+\\.[a-f0-9]{40})$", "modes": [ { "john": "pbkdf2-hmac-sha1", "hashcat": 20400, "extended": false, "name": "PBKDF2-SHA1 (Generic)", "samples": [ "$pbkdf2$131000$r5WythYixPgfQ2jt3buXcg$8Kdr.QQEOaZIXNOrrru36I/.6Po", "$pbkdf2-hmac-sha1$1000.fd11cde0.27de197171e6d49fc5f55c9ef06c0d8751cd7250", "$pbkdf2-hmac-sha1$1000$6926d45e$231c561018a4cee662df7cd4a8206701c5806af9", "$pbkdf2-hmac-sha1$1000.6834476f733353333654315a5a31494f.1932a843a69dc1e38a29d2691a7abf27ecaa6d55", "$pbkdf2-hmac-sha1$1000.3031323334353637383930313233343536373839303132333435363738393031323334353637383930313233343536373839303132333435363738393031323334353637383930313233343536373839303132333435363738393031323334353637383930313233343536373839303132333435363738393031323334353637383930313233343536373839303132333435363738393031323334353637383930313233343536373839303132333435363738.8f7c89f74233f78f6c8ace00696cf6ed09ae43f4" ] } ] }, { "regex": "^\\$pbkdf2-sha256\\$\\d{1,6}\\$[a-z0-9\\/.]+\\$[a-z0-9\\/.]+$", "modes": [ { "john": "pbkdf2-hmac-sha256", "hashcat": 20300, "extended": false, "name": "PBKDF2-SHA256 (Generic)", "samples": [ "$pbkdf2-sha256$29000$x9h7j/Ge8x6DMEao1VqrdQ$kra3R1wEnY8mPdDWOpTqOTINaAmZvRMcYd8u5OBQP9A", "$pbkdf2-sha256$1000$b1dWS2dab3dKQWhPSUg3cg$UY9j5wlyxtsJqhDKTqua8Q3fMp0ojc2pOnErzr8ntLE", "$pbkdf2-sha256$12000$fK8VAoDQuvees5ayVkpp7Q$xfzKAoBR/Iaa68tjn.O8KfGxV.zdidcqEeDoTFvDz2A", "$pbkdf2-sha256$12000$MDEyMzQ1Njc4OTAxMjM0NTY3ODkwMTIzNDU2Nzg5MDEyMzQ1Njc4OTAxMjM0NTY3ODkwMTIzNDU2Nzg5MDEyMzQ1Njc4OTAxMjM0NTY3ODkwMTIzNDU2Nzg5MDEyMzQ1Njc4OTAxMjM0NTY3ODkwMTIzNDU2Nzg5MDEyMzQ1Njc4OTAxMjM0NTY3ODkwMTIzNDU2Nzg5MDEyMzQ1Njc4OTAxMjM0NTY3ODkwMTIzNDU2Nzg$94Z71JhWYUP2E0IrQrexc8AMhHzVB4bwkxh7n0FCnns" ] } ] }, { "regex": "^\\$pbkdf2-sha512\\$\\d+\\$[a-z0-9\\/.]+\\$[a-z0-9\\/.]{86}$", "modes": [ { "john": null, "hashcat": null, "extended": false, "name": "PBKDF2-SHA512(Generic)" } ] }, { "regex": "^\\$p5k2\\$\\d+\\$[a-z0-9\\/+=\\-]+\\$[a-z0-9\\/+\\-]{27}=$", "modes": [ { "john": null, "hashcat": null, "extended": false, "name": "PBKDF2(Cryptacular)" } ] }, { "regex": "^\\$p5k2\\$\\d+\\$[a-z0-9\\/.]+\\$[a-z0-9\\/.]{32}$", "modes": [ { "john": null, "hashcat": null, "extended": false, "name": "PBKDF2(Dwayne Litzenberger)" } ] }, { "regex": "^{FSHP[0123]\\|\\d+\\|\\d+}[a-z0-9\\/+=]+$", "modes": [ { "john": null, "hashcat": null, "extended": false, "name": "Fairly Secure Hashed Password" } ] }, { "regex": "^\\$PHPS\\$.+\\$[a-f0-9]{32}$", "modes": [ { "john": "phps", "hashcat": 2612, "extended": false, "name": "PHPS" } ] }, { "regex": "^\\d{4}:[a-f0-9]{16}:[a-f0-9]{2080}$", "modes": [ { "john": null, "hashcat": 6600, "extended": false, "name": "1Password(Agile Keychain)" } ] }, { "regex": "^[a-f0-9]{64}:[a-f0-9]{32}:\\d{5}:[a-f0-9]{608}$", "modes": [ { "john": null, "hashcat": 8200, "extended": false, "name": "1Password(Cloud Keychain)" } ] }, { "regex": "^[a-f0-9]{256}:[a-f0-9]{256}:[a-f0-9]{16}:[a-f0-9]{16}:[a-f0-9]{320}:[a-f0-9]{16}:[a-f0-9]{40}:[a-f0-9]{40}:[a-f0-9]{32}$", "modes": [ { "john": null, "hashcat": 5300, "extended": false, "name": "IKE-PSK MD5" } ] }, { "regex": "^[a-f0-9]{256}:[a-f0-9]{256}:[a-f0-9]{16}:[a-f0-9]{16}:[a-f0-9]{320}:[a-f0-9]{16}:[a-f0-9]{40}:[a-f0-9]{40}:[a-f0-9]{40}$", "modes": [ { "john": null, "hashcat": 5400, "extended": false, "name": "IKE-PSK SHA1" } ] }, { "regex": "^[a-z0-9\\/+]{27}=$", "modes": [ { "john": null, "hashcat": 133, "extended": false, "name": "PeopleSoft" } ] }, { "regex": "^crypt\\$[a-f0-9]{5}\\$[a-z0-9\\/.]{13}$", "modes": [ { "john": null, "hashcat": null, "extended": false, "name": "Django(DES Crypt Wrapper)" } ] }, { "regex": "^(\\$django\\$\\*1\\*)?pbkdf2_sha256\\$\\d+\\$[a-z0-9]+\\$[a-z0-9\\/+=]{44}$", "modes": [ { "john": "django", "hashcat": 10000, "extended": false, "name": "Django (PBKDF2-HMAC-SHA256)" } ] }, { "regex": "^pbkdf2_sha1\\$\\d+\\$[a-z0-9]+\\$[a-z0-9\\/+=]{28}$", "modes": [ { "john": null, "hashcat": null, "extended": false, "name": "Django(PBKDF2-HMAC-SHA1)" } ] }, { "regex": "^bcrypt(\\$2[axy]|\\$2)\\$\\d{2}\\$[a-z0-9\\/.]{53}$", "modes": [ { "john": null, "hashcat": null, "extended": false, "name": "Django(bcrypt)" } ] }, { "regex": "^md5\\$[a-f0-9]+\\$[a-f0-9]{32}$", "modes": [ { "john": null, "hashcat": null, "extended": false, "name": "Django(MD5)" } ] }, { "regex": "^\\{PKCS5S2\\}[a-z0-9\\/+]{64}$", "modes": [ { "john": null, "hashcat": null, "extended": false, "name": "PBKDF2(Atlassian)" } ] }, { "regex": "^\\([a-z0-9\\/+]{49}\\)$", "modes": [ { "john": null, "hashcat": 9100, "extended": false, "name": "Lotus Notes/Domino 8" } ] }, { "regex": "^SCRYPT:\\d+:\\d{1}:\\d{1}:[a-z0-9:\\/+=]+$", "modes": [ { "john": null, "hashcat": 8900, "extended": false, "name": "scrypt" } ] }, { "regex": "^\\$8\\$[a-z0-9\\/.]{14}\\$[a-z0-9\\/.]{43}$", "modes": [ { "john": "cisco8", "hashcat": 9200, "extended": false, "name": "Cisco Type 8" } ] }, { "regex": "^\\$9\\$[a-z0-9\\/.]{14}\\$[a-z0-9\\/.]{43}$", "modes": [ { "john": "cisco9", "hashcat": 9300, "extended": false, "name": "Cisco Type 9" } ] }, { "regex": "^\\$office\\$\\*2007\\*\\d{2}\\*\\d{3}\\*\\d{2}\\*[a-z0-9]{32}\\*[a-z0-9]{32}\\*[a-z0-9]{40}$", "modes": [ { "john": "office", "hashcat": 9400, "extended": false, "name": "Microsoft Office 2007" } ] }, { "regex": "^\\$office\\$\\*2010\\*\\d{6}\\*\\d{3}\\*\\d{2}\\*[a-z0-9]{32}\\*[a-z0-9]{32}\\*[a-z0-9]{64}$", "modes": [ { "john": "office", "hashcat": 9500, "extended": false, "name": "Microsoft Office 2010" } ] }, { "regex": "^\\$office\\$\\*2013\\*\\d{6}\\*\\d{3}\\*\\d{2}\\*[a-z0-9]{32}\\*[a-z0-9]{32}\\*[a-z0-9]{64}$", "modes": [ { "john": "office", "hashcat": 9600, "extended": false, "name": "Microsoft Office 2013 - 2019" } ] }, { "regex": "^\\$office\\$2016\\$\\d\\$\\d{6}\\$[^$]{24}\\$[^$]{88}$", "modes": [ { "john": null, "hashcat": 25300, "extended": false, "name": "Microsoft Office 2016 - SheetProtection", "samples": [ "$office$2016$0$100000$876MLoKTq42+/DLp415iZQ==$TNDvpvYyvlSUy97UOLKNhXynhUDDA7H8kLql0ISH5SxcP6hbthdjaTo4Z3/MU0dcR2SAd+AduYb3TB5CLZ8+ow==" ] } ] }, { "regex": "^\\$fde\\$\\d{2}\\$[a-f0-9]{32}\\$\\d{2}\\$[a-f0-9]{32}\\$[a-f0-9]{3072}$", "modes": [ { "john": "fde", "hashcat": 8800, "extended": false, "name": "Android FDE \u2264 4.3" } ] }, { "regex": "^\\$oldoffice\\$[01]\\*[a-f0-9]{32}\\*[a-f0-9]{32}\\*[a-f0-9]{32}$", "modes": [ { "john": "oldoffice", "hashcat": 9700, "extended": false, "name": "Microsoft Office \u2264 2003 (MD5+RC4)" }, { "john": "oldoffice", "hashcat": 9710, "extended": false, "name": "Microsoft Office \u2264 2003 (MD5+RC4) collider-mode #1" }, { "john": "oldoffice", "hashcat": 9720, "extended": false, "name": "Microsoft Office \u2264 2003 (MD5+RC4) collider-mode #2" } ] }, { "regex": "^\\$oldoffice\\$[34]\\*[a-f0-9]{32}\\*[a-f0-9]{32}\\*[a-f0-9]{40}$", "modes": [ { "john": "oldoffice", "hashcat": 9800, "extended": false, "name": "Microsoft Office \u2264 2003 (SHA1+RC4)" }, { "john": "oldoffice", "hashcat": 9810, "extended": false, "name": "Microsoft Office \u2264 2003 (SHA1+RC4) collider-mode #1" }, { "john": "oldoffice", "hashcat": 9820, "extended": false, "name": "Microsoft Office \u2264 2003 (SHA1+RC4) collider-mode #2" } ] }, { "regex": "^(\\$radmin2\\$)?[a-f0-9]{32}$", "modes": [ { "john": "radmin", "hashcat": 9900, "extended": false, "name": "RAdmin v2.x" } ] }, { "regex": "^{x-issha,\\s\\d{4}}[a-z0-9\\/+=]+$", "modes": [ { "john": "saph", "hashcat": 10300, "extended": false, "name": "SAP CODVN H (PWDSALTEDHASH) iSSHA-1" } ] }, { "regex": "^\\$cram_md5\\$[a-z0-9\\/+=\\-]+\\$[a-z0-9\\/+=\\-]{52}$", "modes": [ { "john": null, "hashcat": 10200, "extended": false, "name": "CRAM-MD5" } ] }, { "regex": "^[a-f0-9]{16}:2:4:[a-f0-9]{32}$", "modes": [ { "john": null, "hashcat": 10100, "extended": false, "name": "SipHash" } ] }, { "regex": "^[a-f0-9]{4,}$", "modes": [ { "john": null, "hashcat": null, "extended": true, "name": "Cisco Type 7" } ] }, { "regex": "^[a-z0-9\\/.]{13,}$", "modes": [ { "john": "bigcrypt", "hashcat": null, "extended": true, "name": "BigCrypt" } ] }, { "regex": "^(\\$cisco4\\$)?[a-z0-9\\/.]{43}$", "modes": [ { "john": "cisco4", "hashcat": null, "extended": false, "name": "Cisco Type 4" } ] }, { "regex": "^bcrypt_sha256\\$\\$(2[axy]|2)\\$\\d+\\$[a-z0-9\\/.]{53}$", "modes": [ { "john": null, "hashcat": null, "extended": false, "name": "Django(bcrypt-SHA256)" } ] }, { "regex": "^\\$postgres?\\$(?:[^*]{0,32})?\\*[a-f0-9]{8}\\*[a-f0-9]{32}$", "modes": [ { "john": "postgres", "hashcat": 11100, "extended": false, "name": "PostgreSQL CRAM (MD5)", "samples": [ "$postgres$postgres*74402844*4e7fabaaf34d780c4a5822d28ee1c83e", "$postgres$postgres*f063f05d*1d586cc8d137e5f1733f234d224393e8", "$postgre$postgres*684697c8*bf2a64f35feba7bf1b633d60393c1356", "$postgres$Twelve_chars*55393156*c01df9affa7573ef32ec143759f3e005" ] } ] }, { "regex": "^\\$siemens-s7\\$\\d{1}\\$[a-f0-9]{40}\\$[a-f0-9]{40}$", "modes": [ { "john": "siemens-s7", "hashcat": null, "extended": false, "name": "Siemens-S7" } ] }, { "regex": "^(\\$pst\\$)?[a-f0-9]{8}$", "modes": [ { "john": null, "hashcat": null, "extended": false, "name": "Microsoft Outlook PST" } ] }, { "regex": "^sha256[:$]\\d+[:$][a-z0-9\\/+]+[:$][a-z0-9\\/+]{32,128}$", "modes": [ { "john": null, "hashcat": 10900, "extended": false, "name": "PBKDF2-HMAC-SHA256 (PHP)", "samples": [ "sha256:1000:NjI3MDM3:vVfavLQL9ZWjg8BUMq6/FB8FtpkIGWYk" ] } ] }, { "regex": "^(\\$dahua\\$)?[a-z0-9]{8}$", "modes": [ { "john": "dahua", "hashcat": 24900, "extended": false, "name": "Dahua (MD5 Authentication)", "samples": [ "GRuHbyVp", "$dahua$4WzwxXxM" ] } ] }, { "regex": "^[a-z0-9]{8}(?::[a-z0-9]{8})?$", "modes": [ { "john": null, "hashcat": 25700, "extended": false, "name": "MurmurHash", "samples": [ "b69e7687:05094309" ] }, { "john": null, "hashcat": 27800, "extended": false, "name": "MurmurHash3", "samples": [ "23e93f65:00000000" ] } ] }, { "regex": "^\\$mysqlna\\$[a-f0-9]{40}[:*][a-f0-9]{40}$", "modes": [ { "john": null, "hashcat": 11200, "extended": false, "name": "MySQL Challenge-Response Authentication (SHA1)" } ] }, { "regex": "^\\$pdf\\$1\\*2\\*\\d{2}\\*[-0-9]{1,6}\\*\\d\\*\\d{2}\\*[a-f0-9]{32}\\*\\d{2}\\*[a-f0-9]{64}\\*\\d{2}\\*[a-f0-9]{64}$", "modes": [ { "john": "pdf", "hashcat": 10400, "extended": false, "name": "PDF 1.1 - 1.3 (Acrobat 2 - 4)" }, { "john": "pdf", "hashcat": 10410, "extended": false, "name": "PDF 1.1 - 1.3 (Acrobat 2 - 4), collider #1" } ] }, { "regex": "^\\$pdf\\$1\\*2\\*\\d{2}\\*[-0-9]{1,6}\\*\\d\\*\\d{2}\\*[a-f0-9]{32}\\*\\d{2}\\*[a-f0-9]{64}\\*\\d{2}\\*[a-f0-9]{64}:[a-f0-9]{10}$", "modes": [ { "john": "pdf", "hashcat": 10420, "extended": false, "name": "PDF 1.1 - 1.3 (Acrobat 2 - 4), collider #2" } ] }, { "regex": "^\\$pdf\\$[24]\\*[34]\\*128\\*[0-9\\-]{1,6}\\*1\\*(16|32)\\*[a-f0-9]{32,64}\\*32\\*[a-f0-9]{64}\\*(8|16|32)\\*[a-f0-9]{16,64}$", "modes": [ { "john": "pdf", "hashcat": 10500, "extended": false, "name": "PDF 1.4 - 1.6 (Acrobat 5 - 8)", "samples": [ "$pdf$2*3*128*-4*1*16*62888255846156252261477183186121*32*6879919b1afd520bd3b7dbcc0868a0a500000000000000000000000000000000*32*0000000000000000000000000000000000000000000000000000000000000000" ] }, { "john": "pdf", "hashcat": 25400, "extended": false, "name": "PDF 1.4 - 1.6 (Acrobat 5 - 8) - edit password", "samples": [ "$pdf$2*3*128*-3904*1*16*631ed33746e50fba5caf56bcc39e09c6*32*5f9d0e4f0b39835dace0d306c40cd6b700000000000000000000000000000000*32*842103b0a0dc886db9223b94afe2d7cd63389079b61986a4fcf70095ad630c24" ] } ] }, { "regex": "^\\$pdf\\$5\\*[5|6]\\*\\d{3}\\*[-0-9]{1,6}\\*\\d\\*\\d{1,4}\\*[a-f0-9]{0,1024}\\*\\d{1,4}\\*[a-f0-9]{0,1024}\\*\\d{1,4}\\*[a-f0-9]{0,1024}\\*\\d{1,4}\\*[a-f0-9]{0,1024}\\*\\d{1,4}\\*[a-f0-9]{0,1024}$", "modes": [ { "john": "pdf", "hashcat": 10600, "extended": false, "name": "PDF 1.7 Level 3 (Acrobat 9)" }, { "john": "pdf", "hashcat": 10700, "extended": false, "name": "PDF 1.7 Level 8 (Acrobat 10 - 11)" } ] }, { "regex": "^\\$bitcoin\\$\\d{2,4}\\$[a-f0-9$]{250,360}$", "modes": [ { "john": "bitcoin", "hashcat": 11300, "extended": false, "name": "Bitcoin/Litecoin Wallet", "samples": [ "$bitcoin$96$c265931309b4a59307921cf054b4ec6b6e4554369be79802e94e16477645777d948ae1d375191831efc78e5acd1f0443$16$8017214013543185$200460$96$480008005625057442352316337722323437108374245623701184230273883222762730232857701607167815448714$66$014754433300175043011633205413774877455616682000536368706315333388", "$bitcoin$96$c265931309b4a59307921cf054b4ec6b6e4554369be79802e94e16477645777d948ae1d375191831efc78e5acd1f0443$16$8017214013543185$200460$96$480008005625057442352316337722323437108374245623701184230273883222762730232857701607167815448714$66$014754433300175043011633205413774877455616682000536368706315333388", "$bitcoin$96$a8d2a30b9a5419934cbb7cb0727ddc16c4bebdbf30d7e099ca35f2b1b7ba04cc42eb5b865bff8f65fc6ba9e15428d84f$16$872581181d72f577$128205$96$0a8d43558ed2b55f4a53491df66e6a71003db4588d11dc0a88b976122c2849a74c2bfaace36424cf029795db6fd2c78f$130$04ff53a6f68eab1c52e5b561b4616edb5bed4d7510cdb4931c8da68732a86d86f3a3f7de266f17c8d03e02ebe8e2c86e2f5de0007217fd4aaf5742ca7373113060" ] } ] }, { "regex": "^\\$ethereum\\$[a-z0-9*]{150,1400}$", "modes": [ { "john": "ethereum-presale-opencl", "hashcat": 16300, "extended": false, "name": "Ethereum Presale Wallet" } ] }, { "regex": "^\\$ethereum\\$[a-z0-9*]{150,250}$", "modes": [ { "john": "Ethereum Wallet", "hashcat": 15600, "extended": false, "name": "ethereum-opencl" } ] }, { "regex": "^\\$monero\\$(0)\\*[a-f0-9]{32,4096}$", "modes": [ { "john": "monero", "hashcat": null, "extended": false, "name": "monero Wallet" } ] }, { "regex": "^\\$ab\\$\\d{1}\\*\\d{1}\\*\\d{1,6}\\*[a-f0-9]{128}\\*[a-f0-9]{128}\\*[a-f0-9]{32}\\*[a-f0-9]{192}$", "modes": [ { "john": "AndroidBackup", "hashcat": 18900, "extended": false, "name": "Android Backup" } ] }, { "regex": "^\\$zip2\\$\\*\\d{1}\\*\\d{1}\\*\\d{1}\\*[a-f0-9]{16,32}\\*[a-f0-9]{1,6}\\*[a-f0-9]{1,6}\\*[a-f0-9]*\\*[a-f0-9]{20}\\*\\$\/zip2\\$$", "modes": [ { "john": "zip", "hashcat": 13600, "extended": false, "name": "WinZip", "samples": [ "$zip2$*0*1*0*0675369741458183*5dc5*0**36b85538918416712640*$/zip2$", "$zip2$*0*1*0*9ffba76344938a7d*cc41*210*fb28d3fd983302058c5296c07442502ae05bb59adb9eb2378cb0841efa227cd58f7076ec00bb5faaee24c3433763d715461d4e714cdd9d933f621d2cf6ae73d824414ca2126cfc608d8fc7641d2869afa90f28be7113c71c6b6a3ad6d6633173cde9d7c1bb449cc0a1f8cbab8639255684cd25cb363234f865d9224f4065c0c62e5e60c2500bc78fa903630ccbb5816be2ef5230d411051d7bc54ecdf9dcbe500e742da2a699de0ec1f20b256dbcd506f926e91a1066a74b690f9dd50bd186d799deca428e6230957e2c6fcdcec73927d77bb49699a80e9c1540a13899ecb0b635fb728e1ade737895d3ff9babd4927bbbc296ec92bab87fd7930db6d55e74d610aef2b6ad19b7db519c0e7a257f9f78538bb0e9081c8700f7e8cd887f15a212ecb3d5a221cb8fe82a22a3258703f3c7af77ef5ecf25b4e6fb4118b00547c271d9b778b825247a4cd151bff81436997818f9d3c95155910ff152ad28b0857dcfc943e32729379c634d29a50655dc05fb63fa5f20c9c8cbdc630833a97f4f02792fcd6b1b73bfb4d333485bb0eb257b9db0481d11abfa06c2e0b82817d432341f9bdf2385ede8ca5d94917fa0bab9c2ed9d26ce58f83a93d418aa27a88697a177187e63f89904c0b9053151e30a7855252dab709aee47a2a8c098447160c8f96c56102067d9c8ffc4a74cd9011a2522998da342448b78452c6670eb7eb80ae37a96ca15f13018e16c93d515d75e792f49*bd2e946811c4c5b09694*$/zip2$", "$zip2$*0*2*0*c702895e204a15d8016cd436*7688*32*f1e0c797182c9231ebbdfb23111203131d9c949b45396f6ea233ac41c056f938a68869400bc25123bd61f8d7bd4930a6440c*3f229b45b30739ab4867*$/zip2$", "$zip2$*0*3*0*855f69693734c7be8c1093ea5bae6114*f035*210*c02aa1d42cc7623c0746979c6c2ce78e8492e9ab1d0954b76d328c52c4d555fbdc2af52822c7b6f4548fc5cca615cd0510f699d4b6007551c38b4183cafba7b073a5ba86745f0c3842896b87425d5247d3b09e0f9f701b50866e1636ef62ee20343ea6982222434fdaf2e52fe1c90f0c30cf2b4528b79abd2824e14869846c26614d9cbc156964d63041bfab66260821bedc151663adcb2c9ac8399d921ddac06c9a4cd8b442472409356cfe0655c9dbbec36b142611ad5604b68108be3321b2324d5783938e52e5c15ec4d8beb2b5010fad66d8cf6a490370ec86878ad2b393c5aa4523b95ae21f8dd5f0ae9f24581e94793a01246a4cc5a0f772e041b3a604ae334e43fe41d32058f857c227cee567254e9c760d472af416abedf8a87e67b309d30bc94d77ef6617b0867976a4b3824c0c1c4aa2b2668f9eb70c493d20d7fab69436c59e47db40f343d98a3b7503e07969d26afa92552d15009542bf2af9b47f2cfa0c2283883e99d0966e5165850663a2deed557fb8554a16f3a9cb04b9010c4b70576b18695dfea973aa4bc607069a1d90e890973825415b717c7bdf183937fa8a3aa985be1eadc8303f756ebd07f864082b775d7788ee8901bb212e69f01836d45db320ff1ea741fa8a3c13fa49ebc34418442e6bd8b1845c56d5c798767c92a503228148a6db44a08fc4a1c1d55eea73dbb2bd4f2ab09f00b043ee0df740681f5c5579ecbb1dbb7f7f3f67ffe2*c6b781ef18c5ccd83869*$/zip2$" ] } ] }, { "regex": "^\\$itunes_backup\\$\\*\\d{1,2}\\*[a-f0-9]{80}\\*\\d{1,6}\\*[a-f0-9]{40}\\*\\d{0,10}\\*[a-f0-9]{0,40}$", "modes": [ { "john": "itunes-backup", "hashcat": 14700, "extended": false, "name": "iTunes backup < 10.0" }, { "john": "itunes-backup", "hashcat": 14800, "extended": false, "name": "iTunes backup >= 10.0" } ] }, { "regex": "^\\$telegram\\$0\\*[a-f0-9]{64}\\*\\d{32}$", "modes": [ { "john": null, "hashcat": 22301, "extended": false, "name": "Telegram Mobile App Passcode (SHA256)" } ] }, { "regex": "^\\$telegram\\$1\\*4000\\*[a-f0-9]{64}\\*[a-f0-9]{576}$", "modes": [ { "john": "telegram", "hashcat": null, "extended": false, "name": "Telegram Desktop 1.3.9" } ] }, { "regex": "^\\$telegram\\$2\\*100000\\*[a-f0-9]{64}\\*[a-f0-9]{576}$", "modes": [ { "john": "telegram", "hashcat": 24500, "extended": false, "name": "Telegram Desktop \u2265 2.1.14-beta / 2.2.0", "samples": [ "$telegram$2*100000*77461dcb457ce9539f8e4235d33bd12455b4a38446e63b52ecdf2e7b65af4476*f705dda3247df6d690dfc7f44d8c666979737cae9505d961130071bcc18eeadaef0320ac6985e4a116834c0761e55314464aae56dadb8f80ab8886c16f72f8b95adca08b56a60c4303d84210f75cfd78a3e1a197c84a747988ce2e1b247397b61041823bdb33932714ba16ca7279e6c36b75d3f994479a469b50a7b2c7299a4d7aadb775fb030d3bb55ca77b7ce8ac2f5cf5eb7bdbcc10821b8953a4734b448060246e5bb93f130d6d3f2e28b9e04f2a064820be562274c040cd849f1473d45141559fc45da4c54abeaf5ca40d2d57f8f8e33bdb232c7279872f758b3fb452713b5d91c855383f7cec8376649a53b83951cf8edd519a99e91b8a6cb90153088e35d9fed332c7253771740f49f9dc40c7da50352656395bbfeae63e10f754d24a", "$telegram$2*100000*0970f6c043d855aa895703b8a1cc086109cf081f72a77b6504f7f4bf3db06420*129294a5eac3196a4c9a88e556f7507b0957f6dd45d704db8abe607ec6d807270c02635289056256a6044a6408e7ef5d33f98c561f16f8aedd2b3ae33ddffddc63c8584dcb232c9f610953f461adb8d29da83f2b01e32db98101febffae4072703bfbfd492e1dd6abeb0926d3df2ed3b47dee4eb6c9f42ab657f89f19d7314c07e2ffc843e448c6d324e9f8d2c3e877a25b0b153736fddb35f5205737620ba2f96aa47f799366150b4de89a0c6e12caa4f03553d164ce9e2e975aadc83538e6ae3df93acb6026f97ac9f6f017a6bbc6607767e591b2c732e3c0ac844584c69dae89ca3272c996eb83b4e66976e3851cfc89be11dc602bb8c0cdf578d9a0a9dbc2296888fa5ee7e58d985a9bf9a1dbc75d2ddfd6ce222c5ee9f3bb40f6e25c2cd" ] } ] }, { "regex": "^\\$7z\\$\\d{1,3}\\$\\d{1,2}\\$\\d{1}\\$[^$]{0,64}\\$\\d{1,2}\\$[a-f0-9]{32}\\$\\d{1,10}\\$\\d+\\$\\d+\\$[a-f0-9]{2,}(?:\\$\\d+\\$[a-f0-9]{0,10}(?:\\$[a-f0-9]{0,10})?)?$", "modes": [ { "john": "7z", "hashcat": 11600, "extended": false, "name": "7-zip", "samples": [ "$7z$0$14$0$$11$33363437353138333138300000000000$2365089182$16$12$d00321533b483f54a523f624a5f63269", "$7z$128$19$0$1122$8$a264c94f2cd72bec0000000000000000$725883103$112$108$64749c0963e20c74602379ca740165b9511204619859d1914819bc427b7e5f0f8fc67f53a0b53c114f6fcf4542a28e4a9d3914b4bc76baaa616d6a7ec9efc3f051cb330b682691193e6fa48159208329460c3025fb273232b82450645f2c12a9ea38b53a2331a1d0858813c8bf25a831", "$7z$1$19$0$1122$8$732b59fd26896e410000000000000000$2955316379$192$183$7544a3a7ec3eb99a33d80e57907e28fb8d0e140ec85123cf90740900429136dcc8ba0692b7e356a4d4e30062da546a66b92ec04c64c0e85b22e3c9a823abef0b57e8d7b8564760611442ecceb2ca723033766d9f7c848e5d234ca6c7863a2683f38d4605322320765938049305655f7fb0ad44d8781fec1bf7a2cb3843f269c6aca757e509577b5592b60b8977577c20aef4f990d2cb665de948004f16da9bf5507bf27b60805f16a9fcc4983208297d3affc4455ca44f9947221216f58c337f$232$5d00000100", "$7z$0$19$0$1122$8$d1f50227759415890000000000000000$1412385885$112$112$5e5b8b734adf52a64c541a5a5369023d7cccb78bd910c0092535dfb013a5df84ac692c5311d2e7bbdc580f5b867f7b5dd43830f7b4f37e41c7277e228fb92a6dd854a31646ad117654182253706dae0c069d3f4ce46121d52b6f20741a0bb39fc61113ce14d22f9184adafd6b5333fb1", "$7z$0$19$0$1122$8$d1f50227759415890000000000000000$1412385885$112$112$5e5b8b734adf52a64c541a5a5369023d7cccb78bd910c0092535dfb013a5df84ac692c5311d2e7bbdc580f5b867f7b5dd43830f7b4f37e41c7277e228fb92a6dd854a31646ad117654182253706dae0c069d3f4ce46121d52b6f20741a0bb39fc61113ce14d22f9184adafd6b5333fb1", "$7z$7$19$0$$8$8a9fc71fabb004c40000000000000000$1263025034$32$29$f84a72524bf817740f312a33e71d32bfa27f3652706d3e9590a118f70aca7757$24$", "$7z$129$19$0$$16$e69f6cbb583ea5fe2bd2fa577bf35d7c$1528797878$64$51$aef4bf018d0340cf086526f856a95526e4d587799f3c9adaa57bee6f7086e1eebae13ec751deee6ec6e343ef0a6171ba6b608433461235ef2fcbb8ead742d9ca$658$5d00100000$05", "$7z$1$19$0$1122$8$5fdbec1569ff58060000000000000000$2465353234$112$112$58ba7606aafc7918e3db7f6e0920f410f61f01e9c1533c40850992fee4c5e5215bc6b4ea145313d0ac065b8ec5b47d9fb895bb7f97609be46107d71e219544cfd24b52c2ecd65477f72c466915dcd71b80782b1ac46678ab7f437fd9f7b8e9d9fad54281d252de2a7ae386a65fc69eda$176$5d00000100", "$7z$2$19$0$$8$055c46385a7995490000000000000000$1263025034$32$28$1abc552f80372f1c1fea1bab9583599b844b25f0b06afacfbf322ef3d396126a$24$00", "$7z$128$19$0$1122$8$94fb9024fdd3e6c40000000000000000$3965424295$112$99$1127828817ff126bc45ff3c5225d9d0c5d00a52094909674e6ed3dc431546d9a672738f2fa07556340d604d2efd2901b9d2ac2c0686c25af9c520c137b16c50c54df8703fd0b0606fa721ad70aafb9c4e3b288ef49864e6034021969b4ce11e3b8e269a92090ccf593c6a0da06262116", "$7z$128$19$0$1122$8$e24e93c7a9ebde080000000000000000$718561925$112$99$580bf36388526c932c22e3227b51774b6963a9c5b96fc8e2ac70a4302864fa88f50e7c00d9a79e0bca0f07a236e51200dc23435b7680e6fa99b19d790ac093af615a972f8b232686c21279234a2582f9714c5a1a2d326084158eba3e81b4f8ad40784d84baa8ddbed19f1c6603156d2c", "$7z$128$19$0$1122$8$6fbd519735b131710000000000000000$1248418560$112$99$cc9e3c97073d7fd37f04d4e6983b386e3ac00f6292dedb0f566dccf22cdbbb55fee8669edade383e96aa0a740e2b42aa7fddbe5831cac10828c624ee03a1a256c6e777c3d714c55296cb815c509a252b9426fe8d4566c944efe3fac5ea94910e55a390aef2c729a031e832c406049810" ] } ] }, { "regex": "^\\$zip3\\$\\*\\d\\*\\d\\*128\\*\\d\\*[a-f0-9]{0,32}\\*[a-f0-9]{288}\\*\\d\\*\\d\\*\\d\\*[^\\s]{0,64}$", "modes": [ { "john": "securezip", "hashcat": 23001, "extended": false, "name": "SecureZIP AES-128", "samples": [ "$zip3$*0*1*128*0*b4630625c92b6e7848f6fd86*df2f62611b3d02d2c7e05a48dad57c7d93b0bac1362261ab533807afb69db856676aa6e350320130b5cbf27c55a48c0f75739654ac312f1cf5c37149557fc88a92c7e3dde8d23edd2b839036e88092a708b7e818bf1b6de92f0efb5cce184cceb11db6b3ca0527d0bdf1f1137ee6660d9890928cd80542ac1f439515519147c14d965b5ba107c6227f971e3e115170bf*0*0*0*file.txt" ] } ] }, { "regex": "^\\$zip3\\$\\*\\d\\*\\d\\*192\\*\\d\\*[a-f0-9]{0,32}\\*[a-f0-9]{288}\\*\\d\\*\\d\\*\\d\\*[^\\s]{0,64}$", "modes": [ { "john": "securezip", "hashcat": 23002, "extended": false, "name": "SecureZIP AES-192", "samples": [ "$zip3$*0*1*192*0*53ff2de8c280778e1e0ab997*603eb37dbab9ea109e2c405e37d8cae1ec89e1e0d0b9ce5bf55d1b571c343b6a3df35fe381c30249cb0738a9b956ba8e52dfc5552894296300446a771032776c811ff8a71d9bb3c4d6c37016c027e41fea2d157d5b0ce17804b1d7c1606b7c1121d37851bd705e001f2cd755bbf305966d129a17c1d48ff8e87cfa41f479090cd456527db7d1d43f9020ad8e73f851a5*0*0*0*file.txt", "$zip3$*0*1*192*0*edb47a990800000000000000*ba4288c0572f6043b21eba768ca8854fbec62c644f29cdc9652f037b3600dcc761dd07645cbaa1ebec1140e21e19a1cf4b43a82cb47e71e6ac82d3387581996e3fb201328dd5ad8a5be841e2cc9bee7e940da5b55b8a385df87d2431e24baf9a050ea550bd8ea00d2271f9e9d06b32222b8e5815a9db7e75655937c8437332b5b5b08e4c1800976b528322df6ba9653e*0*0*0*secret.txt", "$zip3$*0*1*192*0*a5763deec28f57f7c3218289*7c789a396b6935a2595da1045728aec01572ed0834bc0baa1ab43a186265be83135359ddf2e2f1a2c42f88879617922687131720e8238b006ba10f1caead1d6fbcabbacf32bc3aeda76747d26671f3a94f2037b330a3a790eb72564b05e064747e042c3112d42e739907fdded43c5c4fbf1a5f831cf77bb47f838c75d30a95215b6457a0d4ffc6d408da6be86a04c0d2*0*0*0*1" ] } ] }, { "regex": "^\\$zip3\\$\\*\\d\\*\\d\\*256\\*\\d\\*[a-f0-9]{0,32}\\*[a-f0-9]{288}\\*\\d\\*\\d\\*\\d\\*[^\\s]{0,64}$", "modes": [ { "john": "securezip", "hashcat": 23003, "extended": false, "name": "SecureZIP AES-256", "samples": [ "$zip3$*0*1*256*0*39bff47df6152a0214d7a967*65ff418ffb3b1198cccdef0327c03750f328d6dd5287e00e4c467f33b92a6ef40a74bb11b5afad61a6c3c9b279d8bd7961e96af7b470c36fc186fd3cfe059107021c9dea0cf206692f727eeca71f18f5b0b6ee1f702b648bba01aa21c7b7f3f0f7d547838aad46868155a04214f22feef7b31d7a15e1abe6dba5e569c62ee640783bb4a54054c2c69e93ece9f1a2af9d*0*0*0*file.txt", "$zip3$*0*1*256*0*edb47a990800000000000000*32f884f9fbb54360920a50ec37cc0651fe7b0d9892de44eed17696186139a09c1530e0522abfd9777d18441739cdc7107fdfd252ecd0c8dbbba8181bd09436e9a6a918e385cbab26bee49cd0e3182e67df3fe8c3cdc9e58d6166a0f550969cc456b4a881524e6e66a14e30196b972e260c509fce918736465aea1d00bd5871876e263635be4700ef081117ed896e1504*0*0*0*secret.txt", "$zip3$*0*1*256*0*3f2f7f230e00000000000000*c75ed4a3ec89c22cda7aa3faa9a11cdcca9f5a2f45fe2844d963b2b76b8f98f43a907997557fc2b0eb8cb590b130c573ddfac3f5e70997d6a4539e10728317bdcd70eb74b82bafa2e4871488984db8522c4c4c8ff28fd2dd62c26be9d24246f80ddbdfa8d3b9e81b775dbdb84371446564df3effdbea48713dd223a2bb9afddffc9b8e60f41939f7577f9f30b0a28b78*0*0*0*code.txt" ] } ] }, { "regex": "^\\$pkzip2?\\$[a-f0-9\\*]+\\$\/pkzip2?\\$$", "modes": [ { "john": "pkzip", "hashcat": 17200, "extended": false, "name": "PKZIP (Compressed)", "samples": [ "$pkzip2$1*1*2*0*e3*1c5*eda7a8de*0*28*8*e3*eda7*5096*a9fc1f4e951c8fb3031a6f903e5f4e3211c8fdc4671547bf77f6f682afbfcc7475d83898985621a7af9bccd1349d1976500a68c48f630b7f22d7a0955524d768e34868880461335417ddd149c65a917c0eb0a4bf7224e24a1e04cf4ace5eef52205f4452e66ded937db9545f843a68b1e84a2e933cc05fb36d3db90e6c5faf1bee2249fdd06a7307849902a8bb24ec7e8a0886a4544ca47979a9dfeefe034bdfc5bd593904cfe9a5309dd199d337d3183f307c2cb39622549a5b9b8b485b7949a4803f63f67ca427a0640ad3793a519b2476c52198488e3e2e04cac202d624fb7d13c2*$/pkzip2$", "$pkzip$1*1*2*0*e4*1c5*eda7a8de*0*4c*8*e4*eda7*194883130e4c7419bd735c53dec36f0c4b6de6daefea0f507d67ff7256a49b5ea93ccfd9b12f2ee99053ee0b1c9e1c2b88aeaeb6bd4e60094a1ea118785d4ded6dae94cade41199330f4f11b37cba7cda5d69529bdfa43e2700ba517bd2f7ff4a0d4b3d7f2559690ec044deb818c44844d6dd50adbebf02cec663ae8ebb0dde05d2abc31eaf6de36a2fc19fda65dd6a7e449f669d1f8c75e9daa0a3f7be8feaa43bf84762d6dbcc9424285a93cedfa3a75dadc11e969065f94fe3991bc23c9b09eaa5318aa29fa02e83b6bee26cafec0a5e189242ac9e562c7a5ed673f599cefcd398617*$/pkzip$", "$pkzip$1*2*2*0*e4*1c5*eda7a8de*0*47*8*e4*4bb6*436c9ffa4328870f6272349b591095e1b1126420c3041744650282bc4f575d0d4a5fc5fb34724e6a1cde742192387b9ed749ab5c72cd6bb0206f102e9216538f095fb773661cfde82c2e2a619332998124648bf4cd0da56279f0c297567d9b5d684125ee92920dd513fd18c27afba2a9633614f75d8f8b9a14095e3fafe8165330871287222e6681dd9c0f830cf5d464457b257d0900eed29107fad8af3ac4f87cf5af5183ff0516ccd9aeac1186006c8d11b18742dfb526aadbf2906772fbfe8fb18798967fd397a724d59f6fcd4c32736550986d227a6b447ef70585c049a1a4d7bf25*$/pkzip$" ] }, { "john": "pkzip", "hashcat": 17210, "extended": false, "name": "PKZIP (Uncompressed)", "samples": [ "$pkzip2$1*1*2*0*1d1*1c5*eda7a8de*0*28*0*1d1*eda7*5096*1dea673da43d9fc7e2be1a1f4f664269fceb6cb88723a97408ae1fe07f774d31d1442ea8485081e63f919851ca0b7588d5e3442317fff19fe547a4ef97492ed75417c427eea3c4e146e16c100a2f8b6abd7e5988dc967e5a0e51f641401605d673630ea52ebb04da4b388489901656532c9aa474ca090dbac7cf8a21428d57b42a71da5f3d83fed927361e5d385ca8e480a6d42dea5b4bf497d3a24e79fc7be37c8d1721238cbe9e1ea3ae1eb91fc02aabdf33070d718d5105b70b3d7f3d2c28b3edd822e89a5abc0c8fee117c7fbfbfd4b4c8e130977b75cb0b1da080bfe1c0859e6483c42f459c8069d45a76220e046e6c2a2417392fd87e4aa4a2559eaab3baf78a77a1b94d8c8af16a977b4bb45e3da211838ad044f209428dba82666bf3d54d4eed82c64a9b3444a44746b9e398d0516a2596d84243b4a1d7e87d9843f38e45b6be67fd980107f3ad7b8453d87300e6c51ac9f5e3f6c3b702654440c543b1d808b62f7a313a83b31a6faaeedc2620de7057cd0df80f70346fe2d4dccc318f0b5ed128bcf0643e63d754bb05f53afb2b0fa90b34b538b2ad3648209dff587df4fa18698e4fa6d858ad44aa55d2bba3b08dfdedd3e28b8b7caf394d5d9d95e452c2ab1c836b9d74538c2f0d24b9b577*$/pkzip2$" ] }, { "john": "pkzip", "hashcat": 17220, "extended": false, "name": "PKZIP (Compressed Multi-File)", "samples": [ "$pkzip2$3*1*1*0*8*24*a425*8827*d1730095cd829e245df04ebba6c52c0573d49d3bbeab6cb385b7fa8a28dcccd3098bfdd7*1*0*8*24*2a74*882a*51281ac874a60baedc375ca645888d29780e20d4076edd1e7154a99bde982152a736311f*2*0*e3*1c5*eda7a8de*0*29*8*e3*eda7*5096*1455781b59707f5151139e018bdcfeebfc89bc37e372883a7ec0670a5eafc622feb338f9b021b6601a674094898a91beac70e41e675f77702834ca6156111a1bf7361bc9f3715d77dfcdd626634c68354c6f2e5e0a7b1e1ce84a44e632d0f6e36019feeab92fb7eac9dda8df436e287aafece95d042059a1b27d533c5eab62c1c559af220dc432f2eb1a38a70f29e8f3cb5a207704274d1e305d7402180fd47e026522792f5113c52a116d5bb25b67074ffd6f4926b221555234aabddc69775335d592d5c7d22462b75de1259e8342a9ba71cb06223d13c7f51f13be2ad76352c3b8ed*$/pkzip2$", "$pkzip$3*1*1*0*8*24*4001*8986ec4d693e86c1a42c1bd2e6a994cb0b98507a6ec937fe0a41681c02fe52c61e3cc046*1*0*8*24*4003*a087adcda58de2e14e73db0043a4ff0ed3acc6a9aee3985d7cb81d5ddb32b840ea2057d9*2*0*e4*1c5*eda7a8de*0*4c*8*e4*eda7*89a792af804bf38e31fdccc8919a75ab6eb75d1fd6e7ecefa3c5b9c78c3d50d656f42e582af95882a38168a8493b2de5031bb8b39797463cb4769a955a2ba72abe48ee75b103f93ef9984ae740559b9bd84cf848d693d86acabd84749853675fb1a79edd747867ef52f4ee82435af332d43f0d0bb056c49384d740523fa75b86a6d29a138da90a8de31dbfa89f2f6b0550c2b47c43d907395904453ddf42a665b5f7662de170986f89d46d944b519e1db9d13d4254a6b0a5ac02b3cfdd468d7a4965e4af05699a920e6f3ddcedb57d956a6b2754835b14e174070ba6aec4882d581c9f30*$/pkzip$" ] }, { "john": "pkzip", "hashcat": 17225, "extended": false, "name": "PKZIP (Mixed Multi-File)", "samples": [ "$pkzip2$3*1*1*0*0*24*3e2c*3ef8*0619e9d17ff3f994065b99b1fa8aef41c056edf9fa4540919c109742dcb32f797fc90ce0*1*0*8*24*431a*3f26*18e2461c0dbad89bd9cc763067a020c89b5e16195b1ac5fa7fb13bd246d000b6833a2988*2*0*23*17*1e3c1a16*2e4*2f*0*23*1e3c*3f2d*54ea4dbc711026561485bbd191bf300ae24fa0997f3779b688cdad323985f8d3bb8b0c*$/pkzip2$" ] }, { "john": "pkzip", "hashcat": 17230, "extended": false, "name": "PKZIP (Mixed Multi-File Checksum-Only)", "samples": [ "$pkzip2$8*1*1*0*8*24*a425*8827*3bd479d541019c2f32395046b8fbca7e1dca218b9b5414975be49942c3536298e9cc939e*1*0*8*24*2a74*882a*537af57c30fd9fd4b3eefa9ce55b6bff3bbfada237a7c1dace8ebf3bb0de107426211da3*1*0*8*24*2a74*882a*5f406b4858d3489fd4a6a6788798ac9b924b5d0ca8b8e5a6371739c9edcfd28c82f75316*1*0*8*24*2a74*882a*1843aca546b2ea68bd844d1e99d4f74d86417248eb48dd5e956270e42a331c18ea13f5ed*1*0*8*24*2a74*882a*aca3d16543bbfb2e5d2659f63802e0fa5b33e0a1f8ae47334019b4f0b6045d3d8eda3af1*1*0*8*24*2a74*882a*fbe0efc9e10ae1fc9b169bd060470bf3e39f09f8d83bebecd5216de02b81e35fe7e7b2f2*1*0*8*24*2a74*882a*537886dbabffbb7cac77deb01dc84760894524e6966183b4478a4ef56f0c657375a235a1*1*0*8*24*eda7*5096*40eb30ef1ddd9b77b894ed46abf199b480f1e5614fde510855f92ae7b8026a11f80e4d5f*$/pkzip2$" ] } ] }, { "regex": "^\\$argon2d\\$v=19\\$m=\\d{1,6},t=\\d{1,2},p=\\d{1,2}\\$[^$]+\\$[^\\s]{6,}$", "modes": [ { "john": "argon2", "hashcat": null, "extended": false, "name": "argon2d", "samples": [ "$argon2d$v=19$m=4096,t=3,p=1$ZGFtYWdlX2RvbmU$w9w3s5/zV8+PcAZlJhnTCOE+vBkZssmZf6jOq3dKv50", "$argon2d$v=19$m=4096,t=3,p=1$c2hvcnRfc2FsdA$zMrTcOAOUje6UqObRVh84Pe1K6gumcDqqGzRM0ILzYmj", "$argon2d$v=19$m=16384,t=3,p=1$c2hvcnRfc2FsdA$TLSTPihIo+5F67Y1vJdfWdB9", "$argon2d$v=19$m=16384,t=4,p=3$YW5vdGhlcl9zYWx0$yw93eMxC8REPAwbQ0e/q43jR9+RI9HI/DHP75uzm7tQfjU734oaI3dzcMWjYjHzVQD+J4+MG+7oyD8dN/PtnmPCZs+UZ67E+rkXJ/wTvY4WgXgAdGtJRrAGxhy4rD7d5G+dCpqhrog" ] } ] }, { "regex": "^\\$argon2i\\$v=19\\$m=\\d{1,6},t=\\d{1,2},p=\\d{1,2}\\$[^$]+\\$[^\\s]{6,}$", "modes": [ { "john": "argon2", "hashcat": null, "extended": false, "name": "argon2i", "samples": [ "$argon2i$v=19$m=4096,t=3,p=1$ZGFtYWdlX2RvbmU$N59QwnpxDQZRj1/cO6bqm408dD6Z2Z9LKYpwFJSPVKA", "$argon2i$v=19$m=4096,t=3,p=1$c2hvcnRfc2FsdA$1l4kAwUdAApoCbFH7ghBEf7bsdrOQzE4axIJ3PV0Ncrd", "$argon2i$v=19$m=16384,t=3,p=1$c2hvcnRfc2FsdA$vvjDVog22A5x9eljmB+2yC8y", "$argon2i$v=19$m=16384,t=4,p=3$YW5vdGhlcl9zYWx0$K7unxwO5aeuZCpnIJ06FMCRKod3eRg8oIRzQrK3E6mGbyqlTvvl47jeDWq/5drF1COJkEF9Ty7FWXJZHa+vqlf2YZGp/4qSlAvKmdtJ/6JZU32iQItzMRwcfujHE+PBjbL5uz4966A" ] } ] }, { "regex": "^\\$argon2id\\$v=19\\$m=\\d{1,6},t=\\d{1,2},p=\\d{1,2}\\$[^$]+\\$[^\\s]{6,}$", "modes": [ { "john": null, "hashcat": null, "extended": false, "name": "argon2id" } ] }, { "regex": "^\\$axcrypt\\$\\*2\\*\\d{1,7}\\*[a-f0-9]{128}\\*[a-f0-9]{288}\\*\\d{1,7}\\*[a-f0-9]{64}$", "modes": [ { "john": "axcrypt", "hashcat": 23500, "extended": false, "name": "AxCrypt 2", "samples": [ "$axcrypt$*2*10000*6d44c6d19076bce9920c5fb76b246c161926ce65abb93ec2003919d78898aadd5bc6e5754201ff25d681ad89fa2861d20ef7c3fd7bde051909dfef8adcb50491*68f78a1b80291a42b2a117d6209d3eb3541a8d47ed6b970b2b8294b2bc78347fc2b494a0599f8cba6d45e88fd8fbc5b4dd7e888f6c9543e679489de132167222e130d5925278693ad8599284705fdf99360b2199ed0005be05867b9b7aa6bb4be76f5f979819eb27cf590a47d81830575b2af09dda756360c844b89c7dcec099cfdd27d2d0c95d24f143405f303e4843*1000*debdeb8ea7b9800b01855de09b105fdb8840efc1f67dc742283d13a5570165f8", "$axcrypt$*2*28200*96fca6b5aff19cb540125e6452f1ab6e1cbf7097ad75326e7aa1726f687ed18e66a63295d735f458a138901be41d95d29ff760c7c4b4178320251f2ab0ecabd8*d1d90c425fd8e2d20b2aa7ef6f3ab9dcefad84917f9e07f65f8da61e7e84f490ba8007179718ce0033cbc887177c2b51ed00e88155741960ab667a5328f305969518bc436ee1ba28126a5be79b0b90f8a9c8a438cba9d0e59c0b6573cde124a8300a6fb01ff857485d302285f1eacd7f08d9cc70ec9fdf412b60bc5a728b5108ef8bda24caee5ab7cc4376951c080c6d*1000*fead8792ea352979ab19e7b287bf709f39df0706a7e460b5271d1ebc71014b3b", "$axcrypt$*2*23652*8817291e0611409390c50a8bdc99a98bf56d393174d7c177082391f7919ed392a701783790ad2eed49139ede2b1546dc4a9aaa142e2b2530b4c82cff03df18b1*2561a0c3f5e166c7273ea6fb59592a58b8d8235a379c82de39fc6d674291b6a25a268732c34eab1b092166ca4f9ef9e383325b90633896890f7dca4d29876ec5bb232ff89c8130aad917f93d9228a091a9996e1f14d4b130b5aad7516c11aa9143730d7b0ec8168b4d83bdd0ca1a9a36784572b9db992bd13289ecd577a421ded0576801e88c7275b2d5fa8eb7e540cb*1000*3dc38e68204a7060c3cd616ffcf6df17dbbb3c199e67ea85c7e29751b9ea2fc2" ] } ] }, { "regex": "^\\$axcrypt\\$\\*1\\*\\d{1,7}\\*[a-f0-9]{32}\\*[a-f0-9]{48}(?:\\*[a-z0-9]+)?$", "modes": [ { "john": "axcrypt", "hashcat": null, "extended": false, "name": "AxCrypt 1", "samples": [ "$axcrypt$*1*1337*0fd9e7e2f907f480f8af162564f8f94b*af10c88878ba4e2c89b12586f93b7802453121ee702bc362", "$axcrypt$*1*31014*3408ae91dddc0b1750ed4223fd843364*1cc0f8fa8d89f44d284d0562ac7e93848c86ce9605907129", "$axcrypt$*1*20000*efd759ae68ae7edd709b9e1c2166d0f7*dcf4c1279b8e4d39475925b17f698c3ce39e9e7d82917272*68656c6c6f0a", "$axcrypt$*1*38574*ce4f58c1e85df1ea921df6d6c05439b4*3278c3c730f7887b1008e852e59997e2196710a5c6bc1813*66664a6b2074434a4520374d73592055626979204a6b755520736d6b4b20394e694a205548444320524578562065674b33202f42593d" ] } ] }, { "regex": "^\\$rar5\\$\\d{2}\\$[a-f0-9]{32}\\$\\d{2}\\$[a-f0-9]{32}\\$\\d{1}\\$[a-f0-9]{16}$", "modes": [ { "john": "rar5", "hashcat": 13000, "extended": false, "name": "RAR5", "samples": [ "$rar5$16$38466361001011015181344360681307$15$00000000000000000000000000000000$8$cc7a30583e62676a", "$rar5$16$37526a0922b4adcc32f8fed5d51bb6c8$15$8955617d9b801def51d734095bb8ecdb$8$9f0b23c98ebb3653", "$rar5$16$ed9bd88cc649bd06bfd7dc418fcf5fbd$15$21771e718815d6f23073ea294540ce94$8$5c4361e549c999e1" ] } ] }, { "regex": "^\\$RAR3\\$\\*\\d{1}\\*[a-f0-9]{16}\\*[a-f0-9]{8}\\*\\d{1,7}\\*\\d{1,6}\\*\\d{1}\\*[a-f0-9]{2,}\\*\\d{2}$", "modes": [ { "john": "rar", "hashcat": 23700, "extended": false, "name": "RAR3 -p (Uncompressed)", "samples": [ "$RAR3$*1*e54a73729887cb53*49b0a846*16*14*1*34620bcca8176642a210b1051901921e*30", "$RAR3$*1*c47c5bef0bbd1e98*965f1453*48*47*1*c5e987f81d316d9dcfdb6a1b27105ce63fca2c594da5aa2f6fdf2f65f50f0d66314f8a09da875ae19d6c15636b65c815*30" ] }, { "john": "rar", "hashcat": 23800, "extended": false, "name": "RAR3 -p (Compressed)", "samples": [ "$RAR3$*1*ad56eb40219c9da2*834064ce*32*13*1*eb47b1abe17a1a75bce6c92ab1cef3f4126035ea95deaf08b3f32a0c7b8078e1*33", "$RAR3$*1*b4eee1a48dc95d12*965f1453*64*47*1*0fe529478798c0960dd88a38a05451f9559e15f0cf20b4cac58260b0e5b56699d5871bdcc35bee099cc131eb35b9a116adaedf5ecc26b1c09cadf5185b3092e6*33" ] } ] }, { "regex": "^\\$RAR3\\$\\*\\d{1}\\*[a-f0-9]{16}\\*[a-f0-9]{32}$", "modes": [ { "john": "rar", "hashcat": 12500, "extended": false, "name": "RAR3 -hp", "samples": [ "$RAR3$*0*45109af8ab5f297a*adbf6c5385d7a40373e8f77d7b89d317", "$RAR3$*0*7ce241baa2bd521b*3eb0017fa8843017952c53a3ac8332b6", "$RAR3$*0*c203c4d80a8a09dc*1f406154556d4c895a8be207fd2b5d0c" ] } ] }, { "regex": "^\\$uido\\$[a-f0-9]{32}\\$[a-f0-9]{40}\\$\\d{1,7}\\$[a-f0-9]{80}$", "modes": [ { "john": null, "hashcat": 26500, "extended": false, "name": "iPhone passcode (UID key + System Keybag)", "samples": [ "$uido$77889b1bca161ce876d976a102c7bf82$3090545724551425617156367874312887832777$50000$2d4c86b71c0c04129a47c6468e2437d1fecd88e232a7b15112d5364682dc391dbbbb921cf6e02664" ] } ] }, { "regex": "^\\$metamask\\$(?=[^$]{44}\\$)(?:[a-z0-9+\\/]{4})*(?:|(?:[a-z0-9+\\/]{3}=)|(?:[a-z0-9+\\/]{2}==)|(?:[a-z0-9+\\/]{1}===))\\$(?=[^$]{24}\\$)(?:[a-z0-9+\\/]{4})*(?:|(?:[a-z0-9+\\/]{3}=)|(?:[a-z0-9+\\/]{2}==)|(?:[a-z0-9+\\/]{1}===))\\$(?=[^$]{64,})(?:[a-z0-9+\\/]{4})*(?:|(?:[a-z0-9+\\/]{3}=)|(?:[a-z0-9+\\/]{2}==)|(?:[a-z0-9+\\/]{1}===))$", "modes": [ { "john": null, "hashcat": 26600, "extended": false, "name": "MetaMask Wallet", "samples": [ "$metamask$AARgM5AgABE2eWgJcWAwQIAFmSYoASZVZBlAR4B0h2M=$8HrVMqsjfFTusMbegh+KWg==$7FPq7LjWe3t/TjDBtUwrJBpiG/Rdt+uf71dLCyUZd0pdtymBK6mSMZDyRfp/CzpjEPA1dU1BLDshcwM/1k6KdO//+mPWrgY4j49XTXIMnHNhJPfPv8s9rXiq8jLqetsStqtWmTZaD7fTtbzOYWR4gwQc98MxCnn/IrSnfCHungw1rLV5Xm0/hF7WfzFeEgcHknhJJP1xSeJCL9qI5DJ+lz7ksc0UVvHoiNJx8uvPBNkHpGQRNujwlnk=" ] } ] }, { "regex": "^SH2(?=.{60})(?:[a-z0-9+\/]{4})*(?:|(?:[a-z0-9+\/]{3}=)|(?:[a-z0-9+\/]{2}==)|(?:[a-z0-9+\/]{1}===))$", "modes": [ { "john": "fortigate256", "hashcat": 26300, "extended": false, "name": "FortiGate256 (FortiOS256)", "samples": [ "SH2lpcpFXM5QRlWYwY5vL9+5svfYyb+c79qENpxEoB3NtZpVxKwHjuq/9TH88U=", "SH2+n+OiTlautpJQF1NBcMU2H1otOvlAz9g5wzxwHw+4il3Aiixv9oPtKnRgCc=", "SH2B0YZCrPjDldskSin50dSxbw22VVy+Mb6Ldvb4eq1FV5q4KE3SYPotvX2KWI=" ] } ] }, { "regex": "^(?=.{28})(?:[a-z0-9+\\/]{4})*(?:|(?:[a-z0-9+\\/]{3}=)|(?:[a-z0-9+\\/]{2}==)|(?:[a-z0-9+\\/]{1}===))$", "modes": [ { "john": null, "hashcat": 24800, "extended": false, "name": "Umbraco HMAC-SHA1", "samples": [ "8uigXlGMNI7BzwLCJlDbcKR2FP4=" ] } ] }, { "regex": "^\\$bcve\\$\\d\\$[a-f0-9]{2}\\$[a-f0-9]{16}\\$[a-f0-9]{192}$", "modes": [ { "john": null, "hashcat": 23900, "extended": false, "name": "Jetico BestCrypt v3 Volume Encryption", "samples": [ "$bcve$3$08$234b8182cee7098b$35c12ef76a1e88175c4c222da3558310a0075bc7a06ecf46746d149c02a81fb8a97637d1103d2e13ddd5deaf982889594b18c12d7ca18a54875c5da4a47f90ae615ab94b8e3ed9e3c793d872a1b5ac35cfdb66c221d6d0853e9ff2e0f4435b43" ] } ] }, { "regex": "^\\$BestCrypt\\$\\d\\$\\d\\$\\d\\$\\d{1,5}\\$\\d{1,3}\\$\\d+\\$\\d{1,3}\\$\\d{1,2}\\$[a-f0-9]{64,128}\\$\\d\\$[a-f0-9]{512}$", "modes": [ { "john": "bestcrypt", "hashcat": null, "extended": false, "name": "Jetico BestCrypt Container Encryption (.jbc)", "samples": [ "$BestCrypt$1$5$3$16384$240$3154116612$128$32$51f7450dccbb1c947dd46138bf0d80d588b6938b02505642dde9e1ea61481485$1$a186f281fbbc68f3b27c7b4cc16b7916a2e19c2695b34ee4133a6ac6373db67b88fb54e3def1c0d288d3170dcb5860c2f190ab199fde7f1072a2a109441e608ae46890c5f18ab80803012a43d9cc595a45c5b9ed8b3ed3330cab1a29e5a96512e2f2e0e5927d6836c3a67c1cd13a61a8201a0a99be84c3e19e6d8a12330ae72c22179d37bb7d55034bb96b5cf9f73c11fa82be31d06bfe33305b616cc72079777a5f1f4a720b56470a83da08c17cbc86e34961c4f0bdb8556e2afa0b2b890780e03304725ce7cf8c592f037beb04b393f4f02e3bc9f6582082a39d31f2e643c5f7811f30eeee2ccc6c11496b7d70dc0d300e145408d28448ff5d929c42007dbe", "$BestCrypt$1$5$3$16384$240$3154116612$10$64$7f36390c85bc5695d49d5d135cb09e00cbf738bb203d0f0a0181805acc15d1cc6f856af0f738c44eead724a854700700a1595b5b30d47242a277b60df6491dde$1$a5b6a69b5cb04be789b42e1f50d3426048ea0df06c3b9a9932d85bd54b99aae202c1ca2e283786a4154f09fa01014ecab7f95c3b9a9b6adab1a695153ca8bffec2408566a7da986c0f107c57404c96823bbdc18a4b11337d211b49d7a133cf951b03c54aaccf3ed9b6445e472ba508add524fb67343e954efe313f544d8ecd6f99e9731fa147c62e17a07954f4a265b43cad4247d61529a3e8760d91c5a4314238eb78e10c2521309b7b827be302a32ee37e03854a8c4f872a07fac709b6170f2e7bd9d723f65ba3fd3766c42ed4a4f8dcc55e4c3b9d4e1dcf2bc54a23a87763f4379afdd9d8e934f254f713f3ba80369f26de2c5195c5e04405acdb2893990a" ] } ] }, { "regex": "^\\$mongodb-scram\\$\\*\\d\\*(?=[^*]{0,76}\\*)(?:[a-z0-9+\\/]{4})*(?:|(?:[a-z0-9+\\/]{3}=)|(?:[a-z0-9+\\/]{2}==)|(?:[a-z0-9+\\/]{1}===))\\*\\d{1,7}\\*(?=[^*]{24}\\*)(?:[a-z0-9+\\/]{4})*(?:|(?:[a-z0-9+\\/]{3}=)|(?:[a-z0-9+\\/]{2}==)|(?:[a-z0-9+\\/]{1}===))\\*(?=[^*]{28})(?:[a-z0-9+\\/]{4})*(?:|(?:[a-z0-9+\\/]{3}=)|(?:[a-z0-9+\\/]{2}==)|(?:[a-z0-9+\\/]{1}===))$", "modes": [ { "john": null, "hashcat": 24100, "extended": false, "name": "MongoDB ServerKey SCRAM-SHA-1", "samples": [ "$mongodb-scram$*0*dXNlcg==*10000*4p+f1tKpK18hQqrVr0UGOw==*Jv9lrpUQ2bVg2ZkXvRm2rppsqNw=" ] } ] }, { "regex": "^\\$mongodb-scram\\$\\*\\d\\*(?=[^*]{0,88}\\*)(?:[a-z0-9+\\/]{4})*(?:|(?:[a-z0-9+\\/]{3}=)|(?:[a-z0-9+\\/]{2}==)|(?:[a-z0-9+\\/]{1}===))\\*\\d{1,7}\\*(?=[^*]{40}\\*)(?:[a-z0-9+\\/]{4})*(?:|(?:[a-z0-9+\\/]{3}=)|(?:[a-z0-9+\\/]{2}==)|(?:[a-z0-9+\\/]{1}===))\\*(?=[^*]{44})(?:[a-z0-9+\\/]{4})*(?:|(?:[a-z0-9+\\/]{3}=)|(?:[a-z0-9+\\/]{2}==)|(?:[a-z0-9+\\/]{1}===))$", "modes": [ { "john": null, "hashcat": 24200, "extended": false, "name": "MongoDB ServerKey SCRAM-SHA-256", "samples": [ "$mongodb-scram$*1*dXNlcg==*15000*qYaA1K1ZZSSpWfY+yqShlcTn0XVcrNipxiYCLQ==*QWVry9aTS/JW+y5CWCBr8lcEH9Kr/D4je60ncooPer8=" ] } ] }, { "regex": "^\\$scram\\$.+\\$\\d{1,5}\\$(?:[a-z0-9+\\/]{4})*(?:|(?:[a-z0-9+\\/]{3}=)|(?:[a-z0-9+\\/]{2}==)|(?:[a-z0-9+\\/]{1}===))\\$(?:[a-z0-9+\\/]{4})*(?:|(?:[a-z0-9+\\/]{3}=)|(?:[a-z0-9+\\/]{2}==)|(?:[a-z0-9+\\/]{1}===))$", "modes": [ { "john": "scram", "hashcat": null, "extended": false, "name": "MongoDB SCRAM PBKDF2-SHA1", "samples": [ "$scram$someadmin$10000$wf42AF7JaU1NSeBaSmkKzw==$H6A5RF0qz6DrcWNNX4xe+wIeVEw=", "$scram$admin$10000$ouQdw5om9Uc5gxulO9F/8w==$DSnATYsgoE8InL5Petfjp8MWGh4=" ] } ] }, { "regex": "^\\$mongodb\\$(?:(?:0\\$.+\\$[a-f0-9]{32})|(?:1\\$.+\\$[a-f0-9]{16}\\$[a-f0-9]{32}))$", "modes": [ { "john": "mongodb", "hashcat": null, "extended": false, "name": "MongoDB (system / network)", "samples": [ "$mongodb$0$sa$75692b1d11c072c6c79332e248c4f699", "$mongodb$1$sa$58d3229c83e3f87e$0c85e3f74adce5d037426791940c820a", "$mongodb$1$eight18_characters$8c82aec197929775$5c414259f7f7a42f8c4d1b6ffb37913a" ] } ] }, { "regex": "^\\$iwork\\$\\d\\$\\d\\$\\d\\$\\d{4,6}\\$[a-f0-9]{16,32}\\$[a-f0-9]{32}\\$[a-f0-9]{128}$", "modes": [ { "john": "iwork", "hashcat": 23300, "extended": false, "name": "Apple iWork", "samples": [ "$iwork$2$1$1$4000$b31b7320d1e7a5ee$01f54d6f9e5090eb16fef2b05f8242bc$69561c985268326b7353fb22c3685a378341127557bd2bbea1bd10afb31f2127344707b662a2c29480c32b8b93dea0538327f604e5aa8733be83af25f370f7ac", "$iwork$1$2$1$100000$d77ce46a68697e08b76ac91de9117541$e7b72b2848dc27efed883963b00b1ac7$e794144cd2f04bd50e23957b30affb2898554a99a3accb7506c17132654e09c04bbeff45dc4f8a8a1db5fd1592f699eeff2f9a8c31b503e9631a25a344b517f7", "$iwork$1$2$1$100000$9d406f6bbb6d3798273a1352c33ed387$7dfef75b06f8cb0092802ad833d6e88c$fc4dd694e0b5fbb123d1a6f1abec30e51176e6f0d574e4988e9c82d354baa3540e2f2268d096d9e46c1080eda32ca8eb8abfeeaa01466d86706b03eb8bd5f0e5", "$iwork$2$1$1$4000$736f6d6553616c74$a9d975f8b3e1bf0c388944b457127df4$09eb5d093584376001d4c94e9d0a41eb8a2993132849c5aed8e56e7bd0e8ed50ba38aced793e3480675990c828c01d25fe245cc6aa603c6cb1a0425988f1d3dc" ] } ] }, { "regex": "^SQLCIPHER\\*\\d\\*\\d{1,6}\\*[a-f0-9]{32}\\*[a-f0-9]{32}\\*[a-f0-9]{32}$", "modes": [ { "john": null, "hashcat": 24610, "extended": false, "name": "SQLCipher", "samples": [ "SQLCIPHER*1*64000*25548249195677404156261816261456*85b5e156e1cf1e0be5e9f4217186817b*33435c230bbc7989bbd027630e3f47cd" ] } ] }, { "regex": "^[a-f0-9]{10}$", "modes": [ { "john": null, "hashcat": 24700, "extended": false, "name": "Stuffit5", "samples": [ "66a75cb059" ] } ] }, { "regex": "^\\$stellar\\$(?=[^$]{24}\\$)(?:[a-z0-9+\\/]{4})*(?:|(?:[a-z0-9+\\/]{3}=)|(?:[a-z0-9+\\/]{2}==)|(?:[a-z0-9+\\/]{1}===))\\$(?=[^$]{16}\\$)(?:[a-z0-9+\\/]{4})*(?:|(?:[a-z0-9+\\/]{3}=)|(?:[a-z0-9+\\/]{2}==)|(?:[a-z0-9+\\/]{1}===))\\$(?=[^$]{96}$)(?:[a-z0-9+\\/]{4})*(?:|(?:[a-z0-9+\\/]{3}=)|(?:[a-z0-9+\\/]{2}==)|(?:[a-z0-9+\\/]{1}===))$", "modes": [ { "john": null, "hashcat": 25500, "extended": false, "name": "Stargazer Stellar Wallet XLM", "samples": [ "$stellar$YAlIJziURRcBEWUwRSRDWA==$EutMmmcV5Hbf3p1I$rfSAF349RvGKG4R4Z2VCrH9WjNEKjbJa9hpOja9Yn8MwXruuFEMtw47HPn9CYj+JJ5Rb4Z87Wejj1c4fqpbMZHFOnqtQsVAr" ] } ] }, { "regex": "^\\$knx-ip-secure-device-authentication-code\\$\\*[a-f0-9]{4}\\*[a-f0-9]{64}\\*[a-f0-9]{32}$", "modes": [ { "john": null, "hashcat": 25900, "extended": false, "name": "KNX IP Secure - Device Authentication Code", "samples": [ "$knx-ip-secure-device-authentication-code$*3033*fa7c0d787a9467c209f0a6e7cf16069ed704f3959dce19e45d7935c0a91bce41*f927640d9bbe9a4b0b74dd3289ad41ec" ] } ] }, { "regex": "^\\$mozilla\\$\\*AES\\*[a-f0-9]{40}\\*[a-f0-9]{64}\\*\\d{1,6}\\*[a-f0-9]{32}\\*[a-f0-9]{32}$", "modes": [ { "john": null, "hashcat": 26100, "extended": false, "name": "Mozilla key4.db", "samples": [ "$mozilla$*AES*5add91733b9b13310ea79a4b38de5c3f797c3bf1*54c17e2a8a066cbdc55f2080c5e9f02ea3954d712cb34b4547f5186548f46512*10000*040e4b5a00f993e63f67a34f6cfc5704*eae9c6c003e6d1b2aa8aa21630838808" ] } ] }, { "regex": "^\\$mozilla\\$\\*(?:(?:3DES\\*[a-f0-9]{40}\\*[a-f0-9]{40}\\*[a-f0-9]{32})|(?:\\d\\*\\d{2}\\*\\d\\*[a-f0-9]{40}\\*\\d{2}\\*[a-f0-9]{22}\\*\\d{2}\\*[a-f0-9]{32}\\*\\d{2}\\*[a-f0-9]{40}))$", "modes": [ { "john": "mozilla", "hashcat": 26000, "extended": false, "name": "Mozilla key3.db", "samples": [ "$mozilla$*3DES*b735d19e6cadb5136376a98c2369f22819d08c79*2b36961682200a877f7d5550975b614acc9fefe3*f03f3575fd5bdbc9e32232316eab7623", "$mozilla$*3*20*1*5199adfab24e85e3f308bacf692115f23dcd4f8f*11*2a864886f70d010c050103*16*9debdebd4596b278de029b2b2285ce2e*20*2c4d938ccb3f7f1551262185ccee947deae3b8ae" ] } ] }, { "regex": "^[a-z]{16}$", "modes": [ { "john": null, "hashcat": 26200, "extended": false, "name": "OpenEdge Progress 4GL Encode", "samples": [ "lebVZteiEsdpkncc", "pjqtudckibycRKbj", "bkibllkLdqlpeIol", "OpalkkljtlheSihj" ] } ] }, { "regex": "^\\$bitwarden\\$\\d\\*\\d{1,7}\\*(?:(?:.+\\*[a-f0-9]{32}\\*[a-f0-9]{160})|(?:(?:[a-z0-9+\\/]{4})*(?:|(?:[a-z0-9+\\/]{3}=)|(?:[a-z0-9+\\/]{2}==)|(?:[a-z0-9+\\/]{1}===))\\*(?:[a-z0-9+\\/]{4})*(?:|(?:[a-z0-9+\\/]{3}=)|(?:[a-z0-9+\\/]{2}==)|(?:[a-z0-9+\\/]{1}===))))$", "modes": [ { "john": "bitwarden", "hashcat": 23400, "extended": false, "name": "Bitwarden", "samples": [ "$bitwarden$1*100000*bm9yZXBseUBoYXNoY2F0Lm5ldA==*zAXL7noQxkIJG82vWuqyDsnoqnKAVU7gE/8IRI6BlMs=", "$bitwarden$0*5000*lulu@mailinator.com*20d9c3c9daaed076026b6cb5887d3273*3bbcb4c7cec45d71c7238291573eb8a8a0f71e6191fb708b07f2cb43b26a56b533ba35a5906abdc08600baedb18fbc042a3b50f4549890210a254129b0ae749394c3c39b33ca183c605ee97b167329d3", "$bitwarden$0*5000*user@example.com*ce49243f6593589f7fa825411fbeb8d7*d90deb720836c5ea5c91eccc896035e510fc8951606266e840b6d7748a623ef68cf98fb69ec8ab5b0fe6a0ddd48edcda9aa6eef07125d89ea417477b96bfd2db462f2b2363f73b5553d78e8b3f372e3a" ] } ] }, { "regex": "^\\$xmpp-scram\\$\\d\\$\\d{1,8}\\$\\d{1,8}\\$[a-f0-9]{0,512}\\$[a-f0-9]{40}$", "modes": [ { "john": "xmpp-scram", "hashcat": 23200, "extended": false, "name": "XMPP SCRAM PBKDF2-SHA1", "samples": [ "$xmpp-scram$0$4096$45$353835323736323530353932363531393630313632353634313335323434323038393931323138373138343134$6d5b543b985dc6c0645da3c83d114fce121aa51d", "$xmpp-scram$0$4096$36$37333536663261622d613666622d346333642d396232622d626432646237633338343064$38f79a6e3e64c07f731570d531ec05365aa05306", "$xmpp-scram$0$4096$16$4f67aec1bd53f5f2f74652e69a3b8f32$4aec3caa8ace5180efa7a671092646c041ab1496", "$xmpp-scram$0$4096$16$1f7fcb384d5bcc61dfb1231ae1b32a2f$a2d076d56b0152ed557ad7d38fce93159bc63c9b", "$xmpp-scram$0$4096$24$bc1bd6638a1231ffd54f608983425eacf729d8455a469197$aee9254762b23a3950fd7c803caab5f6654587c8" ] } ] }, { "regex": "^\\$keychain\\$\\*[a-f0-9]{40}\\*[a-f0-9]{16}\\*[a-f0-9]{96}$", "modes": [ { "john": "keychain", "hashcat": 23100, "extended": false, "name": "Apple macOS Keychain", "samples": [ "$keychain$*74cd1efd49e54a8fdc8750288801e09fa26a33b1*66001ad4e0498dc7*5a084b7314971b728cb551ac40b2e50b7b5bd8b8496b902efe7af07538863a45394ead8399ec581681f7416003c49cc7", "$keychain$*10f7445c8510fa40d9ef6b4e0f8c772a9d37e449*f3d19b2a45cdcccb*8c3c3b1c7d48a24dad4ccbd4fd794ca9b0b3f1386a0a4527f3548bfe6e2f1001804b082076641bbedbc9f3a7c33c084b", "$keychain$*a88cd6fbaaf40bc5437eee015a0f95ab8ab70545*b12372b1b7cb5c1f*1f5c596bcdd015afc126bc86f42dd092cb9d531d14a0aafaa89283f1bebace60562d497332afbd952fd329cc864144ec", "$keychain$*3a473dd308b1713ddc76fc976758eb543779a228*570b762ec2b177d0*a1f491231412ff74344244db4d98b1dab6e40a8fc63a11f0d5cdabf97fce5c4fa8ae0a1f95d0398d37e3d45e9fa07aa7" ] } ] }, { "regex": "^\\$PEM\\$1\\$\\d\\$[a-f0-9]{16}\\$\\d{1,8}\\$[a-f0-9]{16,32}\\$\\d{1,8}\\$[a-f0-9]{64,}$", "modes": [ { "john": "pem", "hashcat": 24410, "extended": false, "name": "PKCS#8 Private Keys (PBKDF2-HMAC-SHA1 + 3DES/AES)", "samples": [ "$PEM$1$4$f5662bd8383b4b40$2048$2993b585d3fb2e7b235ed13d90f637e2$1232$73984f2cba4d5e1d327a3f5a538a946099976ab865349091a452a838dc6855b6e539f920a078b14d949d8c739ea7ce26769dc0ba1619a9c0ee1864d1cfca9e61ddf6d9582439f2b65d00a3ff57c78d3176e9e88fc12da7acd421b624ba76f3d5f12926a3a9acd82f502d7638cfe2063fb2c773a56299ae1ec2c85641d33f5f8b3edfc6687fa9898325d384b3db7a7686704facb880c3898f69dd353a5d5d136b58a1e00e4711d3a01e0c632a5f3d5eff64c9e88166296b9b26f072a52bdc4893377e247b5cdb052f34e0b5d4de10a5dffe443a03b1a23f1edbcb00361334dbd6a6d31e16887b5290da2f865fbe1fef7b43c8f8f3432815ca860946560cb601ab83d417e6a4734aaf75692195566bde61e04610a9eff752c08f9ff85a48959daa7c65d03a0eca62e92bf10a55fb4834a49745a6c53d9c79d0591cb13cfa54f0d437d001b7924fd9dd69c98aa25e5d3f19649f79913bca827e7636ede04bf7c41ef54c42936b4eb93c75d941853dc7dda42b51ac5e4f5602fe2c3e62f252d28e02398943780598cf2bd41d183425daf34e86099c748eda2d5372029ebd089f619dab327ea728eb90342f2b48cd364e914a6078599afdb22a6fac6b55e1bf28b3284a0edc748b59c2eaa97e35d457d4c049f86fd3fc618c4c52f08776c0efb33011b96ef6f0b0e6ecf6d37dc20da8ab7d9b8154371c8e396d9b89ee02e6e6b013a0985b1f47c91f3b5a9e6c33736840e6044f46be1dbea4ec7730eccc6e993cb522bb220de4ed55156129f821d7df19439ab86990991cfd1992681716b5ff012ffa5519ad0baa01885f77f6a522469979f449232d408379558fcdfe5253371da835e0c77706dfa67ff28b1cd8d7fdf9e386899838532d8e57ec1ed3d31a96ae03f37b976fb6c503cc247113deaa070697728e3b36ce43de051ce13a4df91d22157c6281e8f9a16de007c6dddf03ffc79a9f4cfc3eaddd637a9a902fdba1c9e857a9ccd7c318db17cd40d8b588b5d97c7d03c0404473dd201aa5c6637e952c6299e35374127276b3eb4aeba754f3176fecea1731a0f917dd049fcdab34264a8c635ba90eec941aeb449a7eca263aaec9e46758bdf21caa896adb4652e9564d75c20e296fcdf28cbdeb702a1e7acf2374d24b51e6492b0bcc72a58748666a7278e2cb54fbdb68c6736ceb85dd92cd0465b19a65f7ad47e25658a34c3531db48c37ef279574e1892d80d80f3e9dee385ab65e6a4537f6e318817a785228160939d01632b8269858ce9092359048b09ae8b9c17ceb575216988bbeb91c1b5861c931f21e07d888ceb9b89d89d17608e2d5f0ae66b6e756f1eac9f80e13749f866ea6b741158296d3ced761999ad901a2121e233bf173865b6c0b32d68e6ef1d39bb411a1ee9d4d1cde870645b9922051b31cc0df640fb01d23c613091ba538999254b873fbb5996efdfbde5c933e1b6ef6d1c7d5e1a9bff6800c8625b07aba2c14143c1a33a0661c357e5db59a2f49aab35c13531774fb5b3795ed853d7f4e38910c7eeb3435353e2cfd0c94e61c16c8126928343f86222c5ef320b9e043d3cd357af4e065500f50e6bf9c260ca298bd5507c9498dbcea4ceec834449b7fb7249fdf199f66aa98d0a820b1057df1d67c43f49c6d18c3c902466b2b2b528075489261ef73bf711c7988fed65693798568bed43e4d70a800cd25b1773c455aaa153cea8f7013eae1e8f24c6793f590c8f6a112b46", "$PEM$1$1$cbb6cdcfc1b27cc8$2048$9b9e633ba83d48c2$144$54f2ab743656618ae51062fd6f2ff07a5078dcf3a1fa52075f50f4508e0c342b1f3e29703f4932c689e29f385f7ad73bf96ec7bb536ea8dafd40b9e5aee6f3e27dc21ee538d9e146a9361fc34ae5dd818b23c106688a451a5e180362954698a35111cef9315ffcd6cb4d440a6899177ff0384a9533923c05f97a5bbd3f94415688ca5c3af97f9edab771dc84807a6bcc" ] } ] }, { "regex": "^\\$PEM\\$2\\$\\d\\$[a-f0-9]{16}\\$\\d{1,8}\\$[a-f0-9]{16,32}\\$\\d{1,8}\\$[a-f0-9]{64,}$", "modes": [ { "john": null, "hashcat": 24420, "extended": false, "name": "PKCS#8 Private Keys (PBKDF2-HMAC-SHA256 + 3DES/AES)", "samples": [ "$PEM$2$4$ed02960b8a10b1f1$2048$a634c482a95f23bd8fada558e1bac2cf$1232$50b21db4aededb96417a9b88131e6bc3727739b4aa1413417338efaa6a756f27c32db5c339d9c3ba61c746bbe3d6c5e0a023f965e70fb617e78a00890b8c7fc7c9f5e0ab39f35bf58ab40f6ed15441338134d041ca59783437ef681a51132c085abb3830df95e9f94d11da54d61679ca6e40136da96ffe205ce191002458143f03cba3aeca6b22a3f0689d5582b3e6c01baee7a04d875ed44bb84fa0ed0a3aae1ed392645cced385498eef4ec25bf6d1399f1487f3625fad9fee25aabf18edb1ce5e640e834d31251b882601f23c2b2d77a45c84e0fc8a3a42e3ff9f75e7ac815c57a7e943ad803ab3672f85a37c6b92d0813590d47a31788643449dce67f135363a0c14f089629a1274b124539535df5f50df5d4402f7a109738f56467725a8aa3884562c8b4c42c068c3502be86e20ac9c52c0daec22e47dcbefebe902b1dc791ed3cd069c7f9211e43f5a3274450f4b0f0b7c6f59adeca8b39ed130b6cbda7cf98e15bbba21fa1758a28dc2edf2e2f17fc353853dc881458e59184f5a8f6e09456e4d71d90135a8ce67350f7bcb3d900e75585e3a87c0c8482f3917347fcfad4fdb8915991cffd20dae1502d0f69d385244e489e50cc9f24b15a5f9d0b00d62805026db5378b5408d7d719786eb043659a452096736e4a7501548655df83045dc4e86bd3319f2982e6db2bbb239019202cebf2ca68c05b578ba95cef82397b145c80208cd7ffd9b0cd5fc3d0d7ea26401c8e11c28ab8d1a524b884962e7fee597943a5e38137abb8b26a7772f0ad6dad074dcfd0b5794822aa7e43d10cab2c95e63b6459706dc21a1cbbd7ae4c96b40ee4d7039cf84c416cb879b2d30b7ac5e1860dcd2ab5479c39b748f5fd9336934c9c1e8064ffb0906c0c2898479209d1a9c97c3cd1782d7514e94d01b242a371a2df5592d620ebd6e18e63ff24ee8ba182f17e6c578431d738e955a957469e8069a919fd3a15532d460201d4e38ac04ac494b9cde1731d4511bf8faf8420a9de4f8c7d3d721fc30d8c3664683fd91ad3515e97092fb652205fb087890cb594947f5372c9b0b27f08b4b57bf610f777fcf040e6e7b8cedf85113dfd909cbac4b774c7580686f2e1f261898da4c6804d573fb22248005f5e0d3b256a0f3dcb71c47b3d674352bda82c22a513e381f990b6100328185511de9b3352126c5aedb9b0bde15743b42e231ef7227c0fe478044ce69474a740366058f07e56dde7d6089cb76e606482e7ba206355fc0fa180c4a41ae781e4723120e3d5a1dd40224db2c959ecbc9bce88bfeed64082d07b111e88a2d8a6a6fe097c9a298a6c3f76beb5b3b5aecedbbbcd404aac8fd25c069c747338ca0c81e6b63d87fc4f0bc18a86b721e3a16e9875741e0313057de8476ee84e36efe557dc33a7d23a9426f2e359781147607ad79235c9d7846320fe2d963fac79a5c92ff3067595273931174d2173f63cfceb9f62a873e7c240d3c260bcfb02b2697911321a72455cacc6929133d0af2cdf6d59a63293ac508786a4850267f90993fff3b6c07bbf3af0e3c08638148101ae1495da3360614866e238c4f60ca00f615877be80cc708da5ea1c30032acffd0e55429ba29dca409349d901a49831db44c1e58b7530b383d3f7e1cac79200cad9bdf87451783f2ffdab09b230aab52b41fa42fdd9f1f05a3dda0fa16b011c51e330d044adf394bbbb7fa25efc860f3082e42824be3b96943afbe641fe6bb" ] } ] }, { "regex": "^\\$multibit\\$\\d\\*\\d{5}\\*\\d\\*\\d\\*[a-f0-9]{16}\\*[a-f0-9]{64}$", "modes": [ { "john": "multibit", "hashcat": 27700, "extended": false, "name": "MultiBit Classic >= 0.5.19 .wallet", "samples": [ "$multibit$3*16384*8*1*7523cb5482e81b81*91780fd49b81a782ab840157a69ba7996d81270eaf456c850f314fc1787d9b0b", "$multibit$3*16384*8*1*1bf663752dade439*d2a4810673c311f6cdd4cebceadbd564c05d408ba9c74912a187953eabc20bee", "$multibit$3*16384*8*1*1bf663752dade439*956a6f229c25154832bab8f4ddfe83e985631678fb8df33aad1b5128a55ea0e2" ] } ] }, { "regex": "^\\$multibit\\$\\d\\*[a-f0-9]{16}\\*[a-f0-9]{64}$", "modes": [ { "john": "multibit", "hashcat": null, "extended": false, "name": "MultiBit Classic =< 0.5.18 .wallet", "samples": [ "$multibit$1*0908a1bd44147709*c82b6d0409c1e46a4660ea6d4fa9ae12e4e234c98a71a51ced105c7e66a57ca3", "$multibit$1*2043ebb14b6d9670*24284a38a62b6a63fb0912ebc05aa9d26d6fd828134d20b9778d8d841f65f584" ] } ] }, { "regex": "^\\$multibit\\$\\d\\*[a-f0-9]{32}\\*[a-f0-9]{32}\\*[a-f0-9]{32}$", "modes": [ { "john": "multibit", "hashcat": null, "extended": false, "name": "MultiBit HD wallet >= 0.5.0", "samples": [ "$multibit$2*081e3a1252c26731120d0d63783ae46f*8354d5b454e78fb15f81c9e6289ba9b8*081e3a1252c26731120d0d63783ae46f" ] } ] }, { "regex": "^\\$WINHELLO\\$\\*SHA512\\*10000\\*[a-f0-9]{8}\\*[a-f0-9]{128}\\*[a-f0-9]{128}\\*[a-f0-9]{64}\\*[a-f0-9]{1384}\\*[a-f0-9]{34}$", "modes": [ { "john": null, "hashcat": 28100, "extended": false, "name": "Windows Hello PIN/Password", "samples": [ "$WINHELLO$*SHA512*10000*00761655*3b3d3197efb2839a6072e922cc03be910be55d1e60389689c05b520d2d57c06258dc5a48798ba65424004cbe2e003d0509036f3394bcae108eb6b77c7eb306d7*c0772a3aca949db60f274f315b3a5f63fea552fc0d1f2032db5293ca9690735217d918d4cf697aa45b2fe598168804040e18fe00758be94aac971985ea7a5521*bff47e398df761733b5aeda7035cdf289547db3afb94b70cbad2aaea21a5cd58*8a4d5b88832e10bad57303324e6c9021733733df4acbf91366f51cebdc755e00fe1d01b3202469ee6ad5e667975b4f50e3110b00ef60414cd2cf96cc47df532e36b997727ffec2924d979d3fb6e677cb5827f4313131a46be8712926c42158339b55183e2fd7f2f0761980b1413897825c3759c566ff8a438189a6c8fb2d630dc33c6330de45c784d11957c686b40b6fe31fd8f2b1b664f542392326af5d334fdf92155343335e1b964955ac0b0e6f7254a599f0f0dc99becc2216515ba9e9472a54e60a14507fc353ebc47b9f0a8249a2a1bfa5d2cf526bd15ee68bd52e944ece9de6bbda913bc5083e26229673340fcc5285df0d38cbc7bb14584ced2fe9e9b3c283fa3c5ad4dd2034b7a67c8e7a1632fae8979a0abdd19be91c6bc371966121e04d433923e44df0b60c156bd90bc61c9fed01a7a76353f79dd4da3e07e12810ec3765128ec44b44b0789d6aa9e9702211a22ab8055ea32e9513fb1bd9d24ca04b33282632f63ab1b213e9644f97bc31dc4d2e7050c1fa23c0000facbf7c76fd7be4b112586f73f0c27abcf7cbe8c9d9fb83af70f60c490936fef84ed5301f73917b4e4170674a5d5e4bfbebdfeda9584221a0f190545efea7245dd2517ade393bedc255c4e016d9919e6e3f3711bca677fc099bf4e1730a752ea2a90a20ff3d09c909771849d3b009ba8d95d2b84fff889e38b079f1325aa42daa067a52abb5c064de3a5040e4a64e76b397b5c9ee6d045f3b5150cf428a92c141735908bb278077d52beefdc87efa156b8ebda071cb425fad0372a8a7cb6eb29926e8f6411ff1b818750c5b6888302fee9b1591b1c23db131538db2aa3de61dcd76fb7067be7ab71ee372bac18be0f446c974e92e79e27e7e3b2aa5ffc3f5f923f2df8ac2edcbb9392d1ac35e4cd52037d9dceedec6391e713e78770307bfde6a31b4e115904d285ac35db055ae8253b9968b7ed7b948da5f*785435725a573571565662727670754100" ] } ] }, { "regex": "^\\$vbox\\$0\\$\\d{1,9}\\$[a-f0-9]{64}\\$\\d{1,2}\\$[a-f0-9]{64}\\$\\d{1,9}\\$[a-f0-9]{64}\\$[a-f0-9]{64}$", "modes": [ { "john": null, "hashcat": 27500, "extended": false, "name": "VirtualBox (PBKDF2-HMAC-SHA256 & AES-128-XTS)", "samples": [ "$vbox$0$260000$fcc37189521686699a43e49514b91f159306be108b98895666583cd15c3e206b$8$288c3957db47e7c3dff2f7932121eb3395d21ab76b9cf3de2dc660310a25e7ad$20000$8847cd90f8acef74bae41155392908780eebb1d16452aa09b2f7b6cd7d8a4096$9f4d615b484f95c73944a98f392a3ce04f93403e8bb6257e6b6c854273d3a08a" ] } ] }, { "regex": "^\\$vbox\\$0\\$\\d{1,9}\\$[a-f0-9]{64}\\$\\d{1,2}\\$[a-f0-9]{128}\\$\\d{1,9}\\$[a-f0-9]{64}\\$[a-f0-9]{64}$", "modes": [ { "john": null, "hashcat": 27600, "extended": false, "name": "VirtualBox (PBKDF2-HMAC-SHA256 & AES-256-XTS)", "samples": [ "$vbox$0$160000$54aff69fca91c20b3b15618c6732c4a2f953dd88690cd4cc731569b6b80b5572$16$cfb003087e0c618afa9ad7e44adcd97517f039e0424dedb46db8affbb73cd064019abae19ee5e4f5b05b626e6bc5d7da65c61a5f94d7bcac521c388276e5358b$20000$2e5729055136168eea79cb3f1765450a35ab7540125f2ca2a46924a99fd0524d$b28d1db1cabe99ca989a405c33a27beeb9c0683b8b4b54b0e0d85f712f64d89c" ] } ] }, { "regex": "^\\$SNMPv3\\$0\\$\\d{1,8}\\$[a-f0-9]{2,}\\$[a-f0-9]{26,}\\$[a-f0-9]{2,}$", "modes": [ { "john": null, "hashcat": 25000, "extended": false, "name": "SNMPv3 HMAC-MD5-96/HMAC-SHA1-96", "samples": [ "$SNMPv3$0$45889431$30818f0201033011020409242fc0020300ffe304010102010304383036041180001f88808106d566db57fd600000000002011002020118040a6d61747269785f4d4435040c0000000000000000000000000400303d041180001f88808106d566db57fd60000000000400a226020411f319300201000201003018301606082b06010201010200060a2b06010401bf0803020a$80001f88808106d566db57fd6000000000$1b37c3ea872731f922959e90" ] } ] }, { "regex": "^\\$SNMPv3\\$1\\$\\d{1,8}\\$[a-f0-9]{2,}\\$[a-f0-9]{26,}\\$[a-f0-9]{2,}$", "modes": [ { "john": null, "hashcat": 25100, "extended": false, "name": "SNMPv3 HMAC-MD5-96", "samples": [ "$SNMPv3$1$45889431$30818f0201033011020409242fc0020300ffe304010102010304383036041180001f88808106d566db57fd600000000002011002020118040a6d61747269785f4d4435040c0000000000000000000000000400303d041180001f88808106d566db57fd60000000000400a226020411f319300201000201003018301606082b06010201010200060a2b06010401bf0803020a$80001f88808106d566db57fd6000000000$1b37c3ea872731f922959e90" ] } ] }, { "regex": "^\\$SNMPv3\\$2\\$\\d{1,8}\\$[a-f0-9]{2,}\\$[a-f0-9]{26,}\\$[a-f0-9]{2,}$", "modes": [ { "john": null, "hashcat": 25200, "extended": false, "name": "SNMPv3 HMAC-SHA1-96", "samples": [ "$SNMPv3$2$45889431$30818f02010330110204371780f3020300ffe304010102010304383036041180001f88808106d566db57fd600000000002011002020118040a6d61747269785f534841040c0000000000000000000000000400303d041180001f88808106d566db57fd60000000000400a2260204073557d50201000201003018301606082b06010201010200060a2b06010401bf0803020a$80001f88808106d566db57fd6000000000$81f14f1930589f26f6755f6b" ] } ] }, { "regex": "^\\$SNMPv3\\$3\\$\\d{1,8}\\$[a-f0-9]{2,}\\$[a-f0-9]{26,}\\$[a-f0-9]{2,}$", "modes": [ { "john": null, "hashcat": 26700, "extended": false, "name": "SNMPv3 HMAC-SHA224-128", "samples": [ "$SNMPv3$3$45889431$308197020103301102047aa1a79e020300ffe30401010201030440303e041180001f88808106d566db57fd600000000002011002020118040e6d61747269785f5348412d3232340410000000000000000000000000000000000400303d041180001f88808106d566db57fd60000000000400a2260204272f76620201000201003018301606082b06010201010200060a2b06010401bf0803020a$80001f88808106d566db57fd6000000000$2f7a3891dd2e27d3f567e4d6d0257962" ] } ] }, { "regex": "^\\$SNMPv3\\$4\\$\\d{1,8}\\$[a-f0-9]{2,}\\$[a-f0-9]{26,}\\$[a-f0-9]{2,}$", "modes": [ { "john": null, "hashcat": 26800, "extended": false, "name": "SNMPv3 HMAC-SHA256-192", "samples": [ "$SNMPv3$4$45889431$30819f020103301102047fc51818020300ffe304010102010304483046041180001f88808106d566db57fd600000000002011002020118040e6d61747269785f5348412d32353604180000000000000000000000000000000000000000000000000400303d041180001f88808106d566db57fd60000000000400a22602040efec2600201000201003018301606082b06010201010200060a2b06010401bf0803020a$80001f88808106d566db57fd6000000000$36d655bfeb59e933845db47d719b68ac7bc59ec087eb89a0" ] } ] }, { "regex": "^\\$SNMPv3\\$5\\$\\d{1,8}\\$[a-f0-9]{2,}\\$[a-f0-9]{26,}\\$[a-f0-9]{2,}$", "modes": [ { "john": null, "hashcat": 26900, "extended": false, "name": "SNMPv3 HMAC-SHA384-256", "samples": [ "$SNMPv3$5$45889431$3081a70201033011020455c0c85c020300ffe30401010201030450304e041180001f88808106d566db57fd600000000002011002020118040e6d61747269785f5348412d333834042000000000000000000000000000000000000000000000000000000000000000000400303d041180001f88808106d566db57fd60000000000400a226020411b3c3590201000201003018301606082b06010201010200060a2b06010401bf0803020a$80001f88808106d566db57fd60$89424907553231aaa27055f4b3b0a97c626ed4cdc4b660d903765b607af792a5" ] } ] }, { "regex": "^\\$SNMPv3\\$6\\$\\d{1,8}\\$[a-f0-9]{2,}\\$[a-f0-9]{26,}\\$[a-f0-9]{2,}$", "modes": [ { "john": null, "hashcat": 27300, "extended": false, "name": "SNMPv3 HMAC-SHA512-384", "samples": [ "$SNMPv3$6$45889431$3081b702010330110204367c80d4020300ffe30401010201030460305e041180001f88808106d566db57fd600000000002011002020118040e6d61747269785f5348412d35313204300000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000400303d041180001f88808106d566db57fd60000000000400a22602046ea3546f0201000201003018301606082b06010201010200060a2b06010401bf0803020a$80001f88808106d566db57fd6000000000$9e4681768d5dee9e2d0ca7380dfa19f0a0f805c550142b889af548f5506c2c3587df980707600b58d97ed1beaa9feaf9" ] } ] }, { "regex": "^v1;PPH1_MD4,[a-f0-9]{20},\\d{1,6},[a-f0-9]{64};?$", "modes": [ { "john": "azuread", "hashcat": 12800, "extended": false, "name": "AzureAD (MS-AzureSync) PBKDF2-HMAC-SHA256", "samples": [ "v1;PPH1_MD4,54188415275183448824,100,55b530f052a9af79a7ba9c466dddcb8b116f8babf6c3873a51a3898fb008e123", "v1;PPH1_MD4,724b754c4b6d30526f36,100,367ff0ac2a1cb334bb26609c8bfc8ae5f619d1eaf07568df040f407504a20241;", "v1;PPH1_MD4,465564476f786e705069,100,612a80cb011bee1f929c7a9e2bd16d98a79f2deb9f44919100f7c0ec74508560;", "v1;PPH1_MD4,31414275383876386e32,100,102ce242cde4339e934d7c6b539d49ae340b02dd380815666b98bd036cd4dc4f;" ] } ] }, { "regex": "^\\$response\\$[a-f0-9]{32}\\$.+\\$.+\\$.+\\$.+\\$.+(?:\\$\\d{8}\\$[a-f0-9]{4,16}\\$.+)?$", "modes": [ { "john": "hdaa", "hashcat": null, "extended": false, "name": "HTTP Digest access authentication", "samples": [ "$response$679066476e67b5c7c4e88f04be567f8b$user$myrealm$GET$/$8c12bd8f728afe56d45a0ce846b70e5a$00000001$4b61913cec32e2c9$auth", "$response$faa6cb7d676e5b7c17fcbf966436aa0c$moi$myrealm$GET$/$af32592775d27b1cd06356b3a0db9ddf$00000001$8e1d49754a25aea7$auth", "$response$56940f87f1f53ade8b7d3c5a102c2bf3$usrx$teN__chars$GET$/4TLHS1TMN9cfsbqSUAdTG3CRq7qtXMptnYfn7mIIi3HRKOMhOks56e$2c0366dcbc$00000001$0153$auth", "$response$8663faf2337dbcb2c52882807592ec2c$user$myrealm$GET$/$8c12bd8f728afe56d45a0ce846b70e5a$", "$response$8663faf2337dbcb2c52882807592ec2c$user$myrealm$GET$/$8c12bd8f728afe56d45a0ce846b70e5a", "$response$b9b9cb1fcce017ec497b31cc33a572b0$lulu$hyperion$GET$/$IERozb5mBQA=de6a5916efca4c24959b5be7e4ed3fc0c7f1f765$00000006$1bd5678ca084bc0d$auth", "$response$abe32fa35969fd6d77bad0ce3dbfdd3a$lulu$hyperion$GET$/icons/poweredby.png$XkZ1Dr9mBQA=6258d402c7c95b352bab0ba774d6974506e3318b$00000003$bd29e3b874427c73$auth" ] } ] }, { "regex": "^\\$IPB2\\$[a-f0-9]{2,}\\$[a-f0-9]{32}$", "modes": [ { "john": "ipb2", "hashcat": null, "extended": false, "name": "IPB 2.x (Invision Power Board)", "samples": [ "$IPB2$2e75504633$d891f03a7327639bc632d62a7f302604", "$IPB2$735a213a4e$4f23de7bb115139660db5e953153f28a", "$IPB2$5d75343455$de98ba8ca7bb16f43af05e9e4fb8afee", "$IPB2$556c576c39$16d4f29c71b05bd75e61d0254800bfa3" ] } ] }, { "regex": "^\\$AWS-Sig-v4\\$0\\$[^$]{16}\\$[^$]{1,16}\\$[^$]{1,16}\\$[a-f0-9]{64}\\$[a-f0-9]{64}$", "modes": [ { "john": null, "hashcat": 28700, "extended": false, "name": "Amazon AWS4-HMAC-SHA256", "samples": [ "$AWS-Sig-v4$0$20220221T000000Z$us-east-1$s3$421ab6e4af9f49fa30fa9c253fcfeb2ce91668e139e6b23303c5f75b04f8a3c4$3755ed2bc1b2346e003ccaa7d02ae8b73c72bcbe9f452ccf066c78504d786bbb" ] } ] }, { "regex": "^[a-z0-9]{26,34}$", "modes": [ { "john": null, "hashcat": 28501, "extended": false, "name": "Bitcoin WIF private key (P2PKH), compressed", "samples": [ "1Jv6EonXm9x4Dw4QjEPAhGfmzFxTL7b3Zj" ] }, { "john": null, "hashcat": 28502, "extended": false, "name": "Bitcoin WIF private key (P2PKH), uncompressed", "samples": [ "1L9nr4GX4Zmd7gDL1UT75QPUqxSgNTvdHb" ] } ] }, { "regex": "^bc1[a-z0-9]{39}$", "modes": [ { "john": null, "hashcat": 28503, "extended": false, "name": "Bitcoin WIF private key (P2WPKH, Bech32), compressed", "samples": [ "bc1qxd76a5zamfyw0g2d2rxkdh0zt9m0uzmxmwjf0q" ] }, { "john": null, "hashcat": 28504, "extended": false, "name": "Bitcoin WIF private key (P2WPKH, Bech32), uncompressed", "samples": [ "bc1qv8e65p73gmp4w3z6fqnyu8t6ct69vetsda3snd" ] } ] }, { "regex": "^[a-z0-9]{34}$", "modes": [ { "john": null, "hashcat": 28505, "extended": false, "name": "Bitcoin WIF private key (P2SH(P2WPKH)), compressed", "samples": [ "3H1YvmSdrjEfj9LvtiKJ8XiYq5htJRuejA" ] }, { "john": null, "hashcat": 28506, "extended": false, "name": "Bitcoin WIF private key (P2SH(P2WPKH)), uncompressed", "samples": [ "3LovFVx5zBRvusVcj7pf3JxV9V46kjKhKu" ] } ] }, { "regex": "^\\$DPAPImk\\$1\\*[12]\\*[S\\-0-9]{10,60}\\*[^*]{4,6}\\*[^*]{4,6}\\*\\d{1,6}\\*[a-f0-9]{32}\\*\\d{1,6}\\*[a-f0-9]{0,1024}$", "modes": [ { "john": "DPAPImk", "hashcat": 15300, "extended": false, "name": "DPAPI masterkey file v1 (context 1 and 2)", "samples": [ "$DPAPImk$1*1*S-15-21-466364039-425773974-453930460-1925*des3*sha1*24000*b038489dee5ad04e3e3cab4d957258b5*208*cb9b5b7d96a0d2a00305ca403d3fd9c47c561e35b4b2cf3aebfd1d3199a6481d56972be7ebd6c291b199e6f1c2ffaee91978706737e9b1209e6c7d3aa3d8c3c3e38ad1ccfa39400d62c2415961c17fd0bd6b0f7bbd49cc1de1a394e64b7237f56244238da8d37d78", "$DPAPImk$1*1*S-15-21-447321867-460417387-480872410-1240*des3*sha1*24000*9b49e2d3b25103d03e936fdf66b94d26*208*ec96025ed4b023ebfa52bdfd91dfeb64edf3f3970b347ee8bb8adfb2a686a0a34792d40074edd372f346da8fcd02cc5d4182c2fd09f4549ec106273926edd05c42e4b5fc8b8758a7c48f6ddae273f357bcb645c8ad16e3161e8a9dbb5002454f4db5ef0d5d7a93ac", "$DPAPImk$1*2*S-15-21-458698633-447735394-485599537-1788*des3*sha1*24000*96b957d9bf0f8846399e70a84431b595*208*0ee9fa2baf2cf0efda81514376aef853c6c93a5776fa6af66a869f44c50ac80148b7488f52b4c52c305e89a497a583e17cca4a9bab580668a8a5ce2eee083382c98049e481e47629b5815fb16247e3bbfa62c454585aaaf51ef15555a355fcf925cff16c0bb006f8", "$DPAPImk$1*1*S-1-5-21-1482476501-1659004503-725345543-1003*des3*sha1*4000*b3d62a0b06cecc236fe3200460426a13*208*d3841257348221cd92caf4427a59d785ed1474cab3d0101fc8d37137dbb598ff1fd2455826128b2594b846934c073528f8648d750d3c8e6621e6f706d79b18c22f172c0930d9a934de73ea2eb63b7b44810d332f7d03f14d1c153de16070a5cab9324da87405c1c0" ] } ] }, { "regex": "^\\$DPAPImk\\$1\\*3\\*[S\\-0-9]{10,60}\\*[^*]{4,6}\\*[^*]{4,6}\\*\\d{1,6}\\*[a-f0-9]{32}\\*\\d{1,6}\\*[a-f0-9]{0,1024}$", "modes": [ { "john": "DPAPImk", "hashcat": 15310, "extended": false, "name": "DPAPI masterkey file v1 (context 3)", "samples": [ "$DPAPImk$1*3*S-15-21-407415836-404165111-436049749-1915*des3*sha1*14825*3e86e7d8437c4d5582ff668a83632cb2*208*96ad763b59e67c9f5c3d925e42bbe28a1412b919d1dc4abf03b2bed4c5c244056c14931d94d441117529b7171dfd6ebbe6eecf5d958b65574c293778fbadb892351cc59d5c65d65d2fcda73f5b056548a4a5550106d03d0c39d3cca7e5cdc0d521f48ac9e51cecc5", "$DPAPImk$1*3*S-1-5-21-1857904334-2267218879-1458651445-1123*des3*sha1*18000*e4c529ba8975e4ed56f5fb8b1e85be43*208*af96b391f1d6e2d37a4de3b4c412ce78f032d446d77ea1fb6a0782f47c390c844349c2bcaeba9fd570b39def6f67a369aa2e266e8d017689d8a09667fdfb640feb3e19ca22067cc5704644c1dcc43d4cccac667391f4918d0de77f36569fd2e104ef0619a46edcfc" ] } ] }, { "regex": "^\\$DPAPImk\\$2\\*[12]\\*[S\\-0-9]{10,60}\\*[^*]{4,6}\\*[^*]{4,6}\\*\\d{1,6}\\*[a-f0-9]{32}\\*\\d{1,6}\\*[a-f0-9]{0,1024}$", "modes": [ { "john": "DPAPImk", "hashcat": 15900, "extended": false, "name": "DPAPI masterkey file v2 (context 1 and 2)", "samples": [ "$DPAPImk$2*1*S-15-21-439882973-489230393-482956683-1522*aes256*sha512*12900*79f7ca399f2626e21aad108c3922af7c*288*c47bc8a985ca6aa708b01c97b004bff20cc52379dc2635b4acf59ce17970a2cb47ace98c7e8de977f265243c5c03d0a97e4b954b494d9e38d9158d0c1e729d16a28ba69e2e7c6c3bc0e3afc9c9b6306b83372ccb35d89b98925728fd36315b8ee95b4d4eccdcb31564769f9a4b9ee10828184e16d4af336675d5e31d987dd87233d34fbbb98880c5e1f64cbb9b043ad8", "$DPAPImk$2*1*S-15-21-417226446-481759312-475941522-1494*aes256*sha512*8000*1e6b7a71a079bc12e71c75a6bcfd865c*288*5b5d651e538e5185f7d6939ba235ca2d8a2b9726a6e95b59844320ba1d1f22282527210bc784d22075e596d113927761a644ad4057cb4dbb497bd64ee6c630930a4ba388eadb59484ec2be7fb4cc79299a87f341d002d25b5b187c71fa19417ec9d1b65568a79c962cb3b5bcb1b8df5f968669af35eec5a24ed5dcee46deef42bfee5ad665dd4de56ccd9c6ba26b2acd", "$DPAPImk$2*2*S-15-21-402916398-457068774-444912990-1699*aes256*sha512*17000*4c51109a901e4be7f1e208f82a56e690*288*bb80d538ac4185eb0382080fda0d405bb74da3a6b98e96f222292b819fa9168cf1571e9bc9c698ad10daf850ab34de1a1765cfd5c0fb8a63a413a767d241dfe6355804af259d24f6be7282daac0a9e02d7fbe20675afb3733141995990a6d11012edfb7e81b49c0e1132dbc4503dd2206489e4f512e4fe9d573566c9d8973188b8d1a87610b8bef09e971270a376a52b" ] } ] }, { "regex": "^\\$DPAPImk\\$2\\*3\\*[S\\-0-9]{10,60}\\*[^*]{4,6}\\*[^*]{4,6}\\*\\d{1,6}\\*[a-f0-9]{32}\\*\\d{1,6}\\*[a-f0-9]{0,1024}$", "modes": [ { "john": "DPAPImk", "hashcat": 15910, "extended": false, "name": "DPAPI masterkey file v2 (context 3)", "samples": [ "$DPAPImk$2*3*S-15-21-464497560-472124119-475628788-1088*aes256*sha512*13450*685165fdb6d0627a15100215ec331ed8*288*7e1ea6f7ec3c2111f2a3903c73aefe66e524d8b241dc1482d0bd07cc1f3ccdadd8cebd4263b3b7c2496da48f40d2eb4890513e6624aeefbe6bbc6ea73f2f71fecf9cc5fef3891a2e697a4415ba7a069642069c142335d53cc750d42a4f4d2b0592956b4a0e57a5d5b1bfd27f0a8eac9d0d5fc5c5e5e23af18ce1a8eff442ed335e5db3bad6e89146f71aa9351e132fd9" ] } ] }, { "regex": "^EXODUS:\\d{1,6}:\\d{1,6}:\\d{1,6}:(?=[^:]{44})(?:[a-z0-9+\/]{4})*(?:|(?:[a-z0-9+\/]{3}=)|(?:[a-z0-9+\/]{2}==)|(?:[a-z0-9+\/]{1}===)):(?=[^:]{16})(?:[a-z0-9+\/]{4})*(?:|(?:[a-z0-9+\/]{3}=)|(?:[a-z0-9+\/]{2}==)|(?:[a-z0-9+\/]{1}===)):(?=[^:]{44})(?:[a-z0-9+\/]{4})*(?:|(?:[a-z0-9+\/]{3}=)|(?:[a-z0-9+\/]{2}==)|(?:[a-z0-9+\/]{1}===)):(?=[^:]{24})(?:[a-z0-9+\/]{4})*(?:|(?:[a-z0-9+\/]{3}=)|(?:[a-z0-9+\/]{2}==)|(?:[a-z0-9+\/]{1}===))$", "modes": [ { "john": null, "hashcat": 28200, "extended": false, "name": "Exodus Desktop Wallet (scrypt)", "samples": [ "EXODUS:16384:8:1:IYkXZgFETRmFp4wQXyP8XMe3LtuOw8wMdLcBVQ+9YWE=:lq0W9ekN5sC0O7Xw:UD4a6mUUhkTbQtGWitXHZUg0pQ4RHI6W/KUyYE95m3k=:ZuNQckXOtr4r21x+DT1zpQ==" ] } ] }, { "regex": "^[a-z0-9\\-_]+\\.[a-z0-9\\-_]{1,6}\\.[a-z0-9\\-_]{20,27}$", "modes": [ { "john": null, "hashcat": 29100, "extended": false, "name": "Flask Session Cookie ($salt.$salt.$pass)", "samples": [ "eyJ1c2VybmFtZSI6ImFkbWluIn0.YjdgRQ.1OTlf1PD0H9wXsu_qS0aywAJVD8" ] } ] }, { "regex": "^\\$keepass\\$\\*1\\*\\d{1,10}\\*\\d{1,3}\\*[a-f0-9]{32}\\*[a-f0-9]{64}\\*[a-f0-9]{32}\\*[a-f0-9]{64}\\*\\d\\*\\d{1,8}\\*[a-f0-9]{2,}$", "modes": [ { "john": "keepass", "hashcat": 13400, "extended": false, "name": "KeePass 1 AES / without keyfile", "samples": [ "$keepass$*1*50000*0*375756b9e6c72891a8e5645a3338b8c8*82afc053e8e1a6cfa39adae4f5fe5e59f545a54d6956593d1709b39cacd7f796*c698fbfc7d1b71431d10611e2216ab21*24a63140f4eb3bfd7d59b7694eea38d1d93a43bc3af989755d2b326286c4d510*1*192*1a65072f436e9da0c9e832eca225a04ab78821b55d9f550860ade2ef8126a2c4050cf4d033374abd3dac6d0c5907c6cbb033643b203825c12e6c9853b5ac17a4809559fe723e01b4a2ab87cc83c8ba7ee4a757b8a0cf1674106f21f6675cba12064443d65436650df10ea0923c4cadfd4bfe341a6f4fa23a1a67f7d12a489fc5410ef6db9f6607905de491d3b3b915852a1b6c231c96366cbdee5ea9bd7f73ffd2f7a579215528ae1bf0ea540947ebfe39ca84bc6cbeded4f8e8fb6ed8f32dd5", "$keepass$*1*50000*124*60eed105dac456cfc37d89d950ca846e*72ffef7c0bc3698b8eca65184774f6cd91a9356d338e5140e47e319a87f5e46a*8725bdfd3580cf054a1564dc724aaffe*8e58cc08af2462ddffe2ee39735ad14b15e8cb96dc05ef70d8e64d475eca7bf5*1*752*71d7e65fb3e20b288da8cd582b5c2bc3b63162eef6894e5e92eea73f711fe86e7a7285d5ac9d5ffd07798b83673b06f34180b7f5f3d05222ebf909c67e6580c646bcb64ad039fcdc6f33178fe475739a562dc78012f6be3104da9af69e0e12c2c9c5cd7134bb99d5278f2738a40155acbe941ff2f88db18daf772c7b5fc1855ff9e93ceb35a1db2c30cabe97a96c58b07c16912b2e095e530cc8c24041e7d4876b842f2e7c6df41d08da8c5c4f2402dd3241c3367b6e6e06cd0fa369934e78a6aab1479756a15264af09e3c8e1037f07a58f70f4bf634737ff58725414db10d7b2f61a7ed69878bc0de8bb99f3795bf9980d87992848cd9b9abe0fa6205a117ab1dd5165cf11ffa10b765e8723251ea0907bbc5f3eef8cf1f08bb89e193842b40c95922f38c44d0c3197033a5c7c926a33687aa71c482c48381baa4a34a46b8a4f78715f42eccbc8df80ee3b43335d92bdeb3bb0667cf6da83a018e4c0cd5803004bf6c300b9bee029246d16bd817ff235fcc22bb8c729929499afbf90bf787e98479db5ff571d3d727059d34c1f14454ff5f0a1d2d025437c2d8db4a7be7b901c067b929a0028fe8bb74fa96cb84831ccd89138329708d12c76bd4f5f371e43d0a2d234e5db2b3d6d5164e773594ab201dc9498078b48d4303dd8a89bf81c76d1424084ebf8d96107cb2623fb1cb67617257a5c7c6e56a8614271256b9dd80c76b6d668de4ebe17574ad617f5b1133f45a6d8621e127fcc99d8e788c535da9f557d91903b4e388108f02e9539a681d42e61f8e2f8b06654d4dec308690902a5c76f55b3d79b7c9a0ce994494bc60eff79ff41debc3f2684f40fc912f09035aae022148238ba6f5cfb92f54a5fb28cbb417ff01f39cc464e95929fba5e19be0251bef59879303063e6392c3a49032af3d03d5c9027868d5d6a187698dd75dfc295d2789a0e6cf391a380cc625b0a49f3084f45558ac273b0bbe62a8614db194983b2e207cef7deb1fa6a0bd39b0215d72bf646b599f187ee0009b7b458bb4930a1aea55222099446a0250a975447ff52" ] }, { "john": "keepass", "hashcat": null, "extended": false, "name": "KeePass 1 Twofish / without keyfile", "samples": [ "$keepass$*1*50000*1*1ff21bd79aa8e9c3f439281a4ce6a97b*cfbdb00057ee0c9e889ca9d93b069ab5ae19f78852bc21aae4f60d0d325e0034*c1a7e6138a49a2dcfb3a84afbc1d918b*a704f9d060f0de5a070155d1d5a8727da92f404242cb3aa2b9aa53a145f87474*1*608*c2d3d18e416af56788d1c3e4257da9ce6e5dcad4db012d7422d17b4527bbb2bb994d9db03907ae01cc1565f5fd0729b930c9ee352426c57de5dee7e941e1d6aedeaf2b0e6509819385de9b4dd6a09979b3edfa0959a7186c422031e426f18d295c55ac616aabeec99f89e696be1d585950ef16a94ae610f2449cc3964bb63ec6043ef36c89117bc78e99e5fbf083b48cb84f85a964e8a037018b3afc2cc55fbe7d74cbdb53d5a54bcd202a1d0a342dbf48a8f7a24264cde8d800a506bf134008b1d8d9b8dd80c19511d9f43b3c23b19eb4a7dcf584f80c49961f73dcba3d2d0390a39a683ddcc8771b49cc3c673ea0aa902d075e25bc814608e2e6d1d6218a6379fd677bc5daaa18b6f5a021d2f661338ca8cc3645dc6cddb860af222a5cdb59a5e2a2c1921203344ced4e2154446239f6c1af8c1bace8207e0f519ea9c08db2f5d0bde0416b09ef6c530213e648641ae56c9af9fbdcb0a286cc4de121655697b9eb00c0fd89ed7269c3859eca20e0c7b60be8d2a1323eb915139cf90c55f9cff01a5bdf757e09ee6d64c2de9aec8d3ea42feeb67caf51b9ba1a80b435e271fdb7f9144ca31e41671768b2c5e8adf70245fdf52005de418efbe2a156d19eeb2ed9e97a0ddb133d11bd8655356d9d3edbbdbf9d0db345b2eb2c1f550ce070f5b0f8f8e58a6ffd52ae8089627dc4a0dac4b4846349066bfa0d2f395d2cb3871e57e353d622e0904a9f54a3e4706797d95b34619f792c15ab8efb3ac523becc3023f01aaad169bc08db8d01e2dd22eff8f6b4f7b741d196bc3de466590011e6d5c9703a19c07d96d26fe1ad93d0931454730ee1f3146428a126d1ed02763f827ff4" ] } ] }, { "regex": "^\\$keepass\\$\\*1\\*\\d{1,10}\\*\\d{1,3}\\*[a-f0-9]{32}\\*[a-f0-9]{64}\\*[a-f0-9]{32}\\*[a-f0-9]{64}\\*\\d\\*\\d{1,8}\\*[a-f0-9]{2,}\\*\\d\\*\\d{2}\\*[a-f0-9]{64}$", "modes": [ { "john": "keepass", "hashcat": 13400, "extended": false, "name": "KeePass 1 Twofish / with keyfile", "samples": [ "$keepass$*1*6000*1*31c087828b0bb76362c10cae773aacdf*6d6c78b4f82ecbcd3b96670cf490914c25ea8c31bc3aeb3fc56e65fac16d721f*a735ec88c01816bc66200c8e17ee9110*08334be8523f4b69bd4e2328db854329bfc81e2ea5a46d8ccf3bccf7c03d879d*1*1360*f1e2c6c47f88c2abf4e79dbe73339b77778233a6c7d7f49f6b7d5db6a4885ff33585e221f5e94e8f7cc84ddcbe9c61a3d40c4f503a4ec7e91edca5745454588eebb4f0dc4d251c0d88eb5fae5d5b651d16e56ef830f412cb7fccf643de4963b66852d3a775489b5abb394b6fa325c3dbb4a55dd06d44c5fc911f1305e55accf0dc0eb172788f5400aab3c867cc6c5ddb7cd3e57bb78a739416985a276825171f5a19750dede055aa3e5fca9b11e3606beae97d68e593631a2efd88cdeb9f43b5ac1d1d9f0164f0fb022ea44a4a48061629c83d8f5bc594e3655ee684102fe706d1e96178bb805105fe1c5326c951401a6e7c9a0b8b572e7b74c3fb25e8700a2e0e70b4621ae3878805397ea1b873ea5218fdaa4fc5d11cdf7ea3579601eca3750fa347edc08569b1f51606d35920253f85f33e6a757a585adf079173161af919f7ea0d78ca6ca1513d01855057373c4f9fe22aba1fc4b18708d329500c127b865a528435e9e00d0a80554ae6eaf4d58bf85a959f37d0854b36c782991c36120b41ee2d9905b18d525b6bffef310e90dbfbe9be853614e6559737f1141f725902f59ee02789c6490c16adf0957e36dc4101c57ba35acb4ca9ec60f5585b60e74342921bbc7e56df5ad942b6deb7936532439b1dae39b9709cf282239c57b434d6f65ba277012ccddce32a217964f974c16f96d8b078ceaad43de9f3d5309279843f2f347ad8ae6eab3a998bb99a421b22b806e2f2302f9dcf3ba54e3d3f1ee64ef3b202194912eec202c2f44847ad5293b03b6b22df35f505670a79219efc399c6a4fa3fd4be7953e5df9baf94101c0a7036b82b6950ab2b722e38aec47bf1c7ffb4e82f43b9ca18d2a8b0b2a7b92015b01d07a429d2660902185cf143f871ff49dde73acf7c3bfd9c124733bd90ffe0fd1cc9090d56dd70bd62f9df1bfa4748ea3438f669d5691c61ec7fbc9d53ab4d8c2dda2cf203f7a5a7fac72eb2efe1d9a27b8c5b14e07a55c530dfd7b7c69dcf478590b7b364f5379f92a0762be0005c4cbc5285d7828248159286fe6d29c02c7de04e96e737a2d30ce75ff774982433f75ca16f09ad668e5b13f0a2e84886773d8fff67f71c1a9dab13f78e5b2da9b1eed9ab2208934a6da7eab32b3e8da1599d6cfa7e9c19ad8efc85dd9a2a4b95832c435381c2fe7e44c58045ce91e40d58c36924b38b19cbafd696bac8761229de9099ce31ee1c93a98aa0cb2a7c60b71b7f1998690e5eae623827727cfe7e8eed94ffc927a1e15aac32292daccda4f0d35383ce87f7e872fc3fe8f01f4a44de4f7b76257abc9c056ab8ae0d96d2dc3a154408c28a2e7befbd515cb5013cbfed31af456ac2b596b5d8095420c411b981d48741dc7ed1e8de4e428bd5e5a553348e2890b1ed12b7dc88261ab921a12da43e6344bbb4a0e0ce2b84c2d1d6c1f51b88202743433ac24340ae00cf27d43346240f4dc5e35ec29fcf1bf6de3bcc09ee8db3f49c3b6615bd8796bbe2cf4b914766779408e772123d9e51cc92ed5dedafa427fd767198cb97674eded4e4df84716aec75cbe7a54620c283fa60780be3cd66ea4167f46cdea1506be92a5102317c8ab8be097c993d82bd831818fe7cb1fbfecc3432d93e0f6d36da8a65ed15c78e623d59980be7ff54bdb1786de2ca9e7a11f0fe067db9ec42ade3bbaad10adae5ea77ba76fa2d0723a35891bde91da540a58e343c23afa9e22b38a66171eb9dbbd55f9e0f014e9de3943388fe0990cc801bbb978c02bf680b3c63a747e22a6317440c40e6844987e936c88c25f49e601ec3486ab080165b5e01dbee47a0a385dfba22ec5ed075f94052bdddabde761bbcc79852402c5b22ded89af4c602922099e37d71b7f87f4ffa614b4ca106fca6b062cba350be1fd12c6812db82f3e02a81e42*1*64*bbc3babf62557aa4dfba705e24274e1aebf43907fe12f52eaf5395066f7cbdba", "$keepass$*1*6000*0*1a1d38235ccbeae4ca2a9edfbd3b290c*8e1e81b37a6161b6033fbd6dd350aaeaa0712cf2649fe40e3fbbaa4b61684f54*d9517d352aea00c2b7f57f1154b9c0a0*0a8ae9b13347402c242d7cde4d58d01f1e129287eaf62df768856bbb9d0633a1*1*1360*6555a7e9eca9d5a2c9504a5c888846f0a8902fa31e3dc90f8fcc118856d5daabcaaf4316c4d589e11cce5b9a209e9a7ec1db5b848a706c78f7c7dfac4fd9ea86ac15af500518766dbf4525ee7c1b477a8fec4abdd6f4ad36894ec5aee0c9a5662c5091ceb61b3aa99ff3eacd687ed797b0a1e8ceecd5c51456cb1f70dadf0fda190752e4efe4fb101d5fc5d7745ff01d68cb4c0cc32c6003f85c310e43d7d659748bfc260cbb329c4076c2c9948386c74bb967362a98d6490dbe340f5d440b557b105edd5561836fbb6894f4a1d9a5cd0182536a28f60ca268d682065f8f5226e24a07d635a3c4f04760094cee033fb2f7c3a0cbdf7f174d31c827f6911a75ca95b21332bb47ea6359aa2d70ff4b16e8481cd536e0ec4ba90963edda754b6e0e694855e4f266899b3dd2b0f74c3e688caa376b22810945249ac4e1c38e8d1093ce272ed45d26037a1fd6e0cfcdbdf096c8b2795ba736641bafe9938b6eb2b40ea347f9c49952c118d86ec671c065e3c94f0de2409fec2fde318ad7e6dd0189baf4fa0044fc1d2974b9dafb1608f4bca525706e44ca6af09e305ad29f5e4ba0831145713d5d8b6d6d955c4b5ca031e34b4292aee5383179e1e0afe92ee6565e69825c90bb5e79612a4ad4a3babbd4a75b5481ea710c93595781b71532c17730409482e6b59bb9831be4efadadf36eda5bc5fcf0f3541aaba6662807e531a3e28078f5960e50f80e624c5434b545c1232fdd64359f53b90d6635107f4f005ac02110eebdbdda4f2c92addd686059e9d799a55902526f87f78b8844e2000f82e7b5c8ba3a19fe26117c43f69ba26eee75cc385737791ca4554ce935af26c50331963e500605e87ac3602a76669bf6318e797ef01fe1c25e567cc864de11bd00f555fdf188648bf4179658e325be39a4050b7b01553422e5cd1bbaf5e8f75ce34f0e92f1253c880d4e77f484f14817e288f01efbfe1a8f8b90e9d18b86898856bdf3ee6b5754853cb99a746fa0b753f1a49f529a89d9a0c2fbd5365477be829190dbf491bc886f66ae1bfe014a7e23a420f76a4a0d0d5ebcea51dc0021651a6cdbe5c89a7ae8bfdae2e30d404c31790c0aba8791793ce3072adf21e5a3c5b5e4f9cea82ebff5070e13f94300d5688523ba2a142ae8f82f6ef940e69beba1d665ab17a2ae471500fc48ded336b27450f08dfe07fa5e556963f035a01950f43b2f649bf7f552e9ee7154f5ffdec109fd5bdf0e879d044ef4b78e590ac769efcdd7dad74228872af966d2e8d976336de1ee4289e933288b5b0b43195df1c248176ac944f5e99918dbc067f93d15e95602c9cb8246f378377785b7ebfee44f81b385a3e1c9c5276e4b477c4841af871e6b0e3f4387c58cea01fe2aff04df0f51ac93757172d7537ee0df51ec931564ed2c8a11a45da8c03644d0bc93a14d9f79555250b9c8245690bc1c72ea7e9104a9f570680f704c1f8759a65e210e1b9a855b46ed6801354175b27fc288a7bc39a2003f4400c124ec41d7f54f67be99f778895d9c3e33623a346021215a369487457e78322dbd71a3d969b3e22dfea987ac93d5c4f8252142824f5a67e54a2b1b78ea928fbb63653e122555f6c76150f2541bdad6524f69964c91e9175406d0b824e175e63c7677d990341ee69c4ca9612a05e3bd2ed304c45cd97051aaf0b63c0d917af8d01723e215bb93f816b51d79e29e4e885b98f8ca8320443503c07e67b4d546f544ffced62ef7298a8ac6175f77c180900f638466cd15d6511d7b16992a8e0674563c02fe7776079ee92739bc142a1e601b3aaee284f6f828656e43e58b93bcfd5f69b6aa8c003788d1ae88f569f64402d64e18cb8ffc2268013fe4da9ba7da557da3e259623168b7fd57cf0e4c8327bae66e02bc12978725022ef4cc03b4021d3a*1*64*3a96fb77fbbbca7336ee699f17be31fde552191128553c6d89bfce4035dc0af0" ] } ] }, { "regex": "^\\$keepass\\$\\*2\\*\\d{1,10}\\*\\d{1,3}\\*[a-f0-9]{64}\\*[a-f0-9]{64}\\*[a-f0-9]{32}\\*[a-f0-9]{64}\\*[a-f0-9]{64}$", "modes": [ { "john": "keepass", "hashcat": 13400, "extended": false, "name": "KeePass 2 AES / without keyfile", "samples": [ "$keepass$*2*6000*222*a279e37c38b0124559a83fa452a0269d56dc4119a5866d18e76f1f3fd536d64d*7ec7a06bc975ea2ae7c8dcb99e826a308564849b6b25d858cbbc78475af3733f*d477c849bf2278b7a1f626c81e343553*38c8ec186141c2705f2bcb334a730933ed3b0ee11391e1100fbaf429f6c99078*1ada85fe78cf36ab0537562a787dd83e446f13cd3d9a60fd495003de3537b702", "$keepass$*2*6000*222*e54497d3d9be3e310a817a13515225a87773ba71557a88673c34db824550be7b*d405c4f7e3c7b2b142fda44c3d55d3afab1c91a6aca7c81c1ff7e61b3f03be85*7eb45af0af777ecb57f0159b9ffa528b*0af7d9facefb20378e8666389de7586ea72e9527dc78bf5dfe5f1b455060a3e6*9b0d1893678dea77f88bf66e6986adbc5a8095e4a09c7e9744bad42ac49133a7", "$keepass$*2*6000*222*a279e37c38b0124559a83fa452a0269d56dc4119a5866d18e76f1f3fd536d64d*7ec7a06bc975ea2ae7c8dcb99e826a308564849b6b25d858cbbc78475af3733f*d477c849bf2278b7a1f626c81e343553*e61db922e9b77a161e9b674ddadfb8c660d61b5f68d97a3b1596ae94cfa9d169*7c80c7db9de77f176e86ba11697152c4c8f182bdb8133ad1bca22e9ec5bc275b" ] } ] }, { "regex": "^\\$keepass\\$\\*2\\*\\d{1,10}\\*\\d{1,3}\\*[a-f0-9]{64}\\*[a-f0-9]{64}\\*[a-f0-9]{32}\\*[a-f0-9]{64}\\*[a-f0-9]{64}\\*\\d\\*\\d{2}\\*[a-f0-9]{64}$", "modes": [ { "john": "keepass", "hashcat": 13400, "extended": false, "name": "Keepass 2 AES / with keyfile", "samples": [ "$keepass$*2*6000*222*15b6b685bae998f2f608c909dc554e514f2843fbac3c7c16ea3600cc0de30212*c417098b445cfc7a87d56ba17200836f30208d38f75a4169c0280bab3b10ca2a*0d15a81eadccc58b1d3942090cd0ba66*57c4aa5ac7295a97da10f8b2f2d2bfd7a98b0faf75396bc1b55164a1e1dc7e52*2b822bb7e7d060bb42324459cb24df4d3ecd66dc5fc627ac50bf2d7c4255e4f8*1*64*aaf72933951a03351e032b382232bcafbeeabc9bc8e6988b18407bc5b8f0e3cc", "$keepass$*2*24569*0*c40432355cce7348c48053ceea0a28e7d18859c4ea47e3a799c6300861f64b95*265dafcc42e1537ff42e97e1e283c70014133be0fe2d420b4d24c6d57c9d2207*a00e20a852694c15aabb074d61b902fa*48dd553fb96f7996635f2414bfe6a1a8429ef0ffb71a1752abbef31853172c35*a44ae659958ad7fae8c8952cb83f3cf03fec2371ce22a8bf7fac1e687af2f249*1*64*5a26ea376cc5afc955104c334571d30486acbac512a94b75ca82a9e31dd97bf7", "$keepass$*2*6000*222*aa511591cb50394d044f31abb2febdb2788c9ee41d78a53f3efe0f83fdd64e81*7ceab79302a794cef818d9426e53a78458f82e72575967c4fb3788d4bc685874*1c5c1c0c475ee2f22bd56e9c75cfd67c*e7bf79115c83a0236260c71c17a816f9bd9288a683eb4b5e0d48666c66e97774*53f26838a293b392bfde1ad21b444b834cf5c02155a1378ac496653b2f3779ec*1*64*98df4f35fe74c031992d81a639305c4520f303fd1ca4bb09b53e33032b44c46a" ] } ] }, { "regex": "^\\$keepass\\$\\*2\\*\\d{1,10}\\*\\d{1,3}\\*[a-f0-9]{64}\\*[a-f0-9]{64}\\*[a-f0-9]{24}\\*[a-f0-9]{64}\\*[a-f0-9]{64}$", "modes": [ { "john": "keepass", "hashcat": null, "extended": false, "name": "KeePass 2 ChaCha20 (KDBX 3) / without keyfile", "samples": [ "$keepass$*2*6000*2*e852737a797fb642a2814e5965aba3473644a56ea67998526ce5e6f0e256a56a*fb300459b1e8c52fefa8e72676b57563565475b1c1306c266a48ccc2010e6a94*03027f86819941d1d0f3f2f5*af0f6c5e4319e6c10fdb95f44ded70f3115ae7dc28ec83fd3676c92076505ded*e0ab7f438903eb91dd8bc13c52c5a1c02e34b107ae16710bc57858c8c85fecd0" ] } ] }, { "regex": "^SCRAM-SHA-256\\$\\d{1,7}:(?=[^:$]{1,88}\\$)(?:[a-z0-9+\/]{4})*(?:|(?:[a-z0-9+\/]{3}=)|(?:[a-z0-9+\/]{2}==)|(?:[a-z0-9+\/]{1}===))\\$(?=[^:]{44}:)(?:[a-z0-9+\/]{4})*(?:|(?:[a-z0-9+\/]{3}=)|(?:[a-z0-9+\/]{2}==)|(?:[a-z0-9+\/]{1}===)):(?=[^:]{44})(?:[a-z0-9+\/]{4})*(?:|(?:[a-z0-9+\/]{3}=)|(?:[a-z0-9+\/]{2}==)|(?:[a-z0-9+\/]{1}===))$", "modes": [ { "john": null, "hashcat": 28600, "extended": false, "name": "PostgreSQL SCRAM-SHA-256", "samples": [ "SCRAM-SHA-256$4096:IKfxzJ8Nq4PkLJCfgKcPmA==$iRw3qwTp18uaBnsTOEExbtgWdKeBMbSSnZvqD4sdqLQ=:hPciC1CcnBna3szR8Mf3MVc8t0W7QPbIHoMMrh4zRV0=" ] } ] }, { "regex": "^\\$radmin3\\$[^*]{0,511}\\*[a-f0-9]{64}\\*[a-f0-9]{512}$", "modes": [ { "john": null, "hashcat": 29200, "extended": false, "name": "Radmin3", "samples": [ "$radmin3$75007300650072006e0061006d006500*c63bf695069d564844c4849e7df6d41f1fbc5f3a7d8fe27c5f20545a238398fa*0062fb848c21d606baa0a91d7177daceb69ad2f6d090c2f1b3a654cfb417be66f739ae952f5c7c5170743459daf854a22684787b24f8725337b3c3bd1e0f2a6285768ceccca77f26c579d42a66372df7782b2eefccb028a0efb51a4257dd0804d05e0a83f611f2a0f10ffe920568cc7af1ec426f450ec99ade1f2a4905fd319f8c190c2db0b0e24627d635bc2b4a2c4c9ae956b1e02784c9ce958eb9883c60ba8ea2731dd0e515f492c44f39324e4027587c1330f14216e17f212eaec949273797ae74497782ee8b6f640dd2d124c59db8c37724c8a5a63bad005f8e491b459ff1b92f861ab6d99a2548cb8902b0840c7f20a108ede6bf9a60093053781216fe" ] } ] }, { "regex": "^\\$teamspeak\\$3\\$(?=[^$]{28}\\$)(?:[a-z0-9+\/]{4})*(?:|(?:[a-z0-9+\/]{3}=)|(?:[a-z0-9+\/]{2}==)|(?:[a-z0-9+\/]{1}===))\\$(?=[^$]{152}$)(?:[a-z0-9+\/]{4})*(?:|(?:[a-z0-9+\/]{3}=)|(?:[a-z0-9+\/]{2}==)|(?:[a-z0-9+\/]{1}===))$", "modes": [ { "john": null, "hashcat": 28300, "extended": false, "name": "Teamspeak 3 (channel hash)", "samples": [ "$teamspeak$3$E0aV0IQ29EDyxRfkFoQflUGJ6zo=$mRgDUkNpd0IwUEcTJQBmE0NHYwdDEhFzQ0VgMRcFJUIRYnaHBwNXRZJwk2ZUaURzdXkVYiUROERmI0hYYGFYCDiIJCeIU3N5EhRVcZFnSIRCJlkUFkY4YFMDcheYeTl4RYZEdpKGJYhxAIQJEYGYEA==" ] } ] }, { "regex": "^[a-f0-9]{32}[a-f0-9]{32}(?=[^$]{108}$)(?:[a-z0-9+\/]{4})*(?:|(?:[a-z0-9+\/]{3}=)|(?:[a-z0-9+\/]{2}==)|(?:[a-z0-9+\/]{1}===))$", "modes": [ { "john": null, "hashcat": 29600, "extended": false, "name": "Terra Station Wallet (AES256-CBC(PBKDF2($pass)))", "samples": [ "67445496c838e96c1424a8dae4b146f0fc247c8c34ef33feffeb1e4412018512wZGtBMeN84XZE2LoOKwTGvA4Ee4m7PR1lDGIdWUV6OSUZKRiKFx9tlrnZLt8r8OfOzbwUS2a2Uo+nrrP6F85fh4eHstwPJw0KwzHWB8br58=" ] } ] } ]