[ { "regex": "^[a-f0-9]{4}$", "modes": [ { "john": null, "hashcat": null, "extended": false, "name": "CRC-16" }, { "john": null, "hashcat": null, "extended": false, "name": "CRC-16-CCITT" }, { "john": null, "hashcat": null, "extended": false, "name": "FCS-16" } ] }, { "regex": "^[a-f0-9]{8}$", "modes": [ { "john": null, "hashcat": null, "extended": false, "name": "Adler-32" }, { "john": null, "hashcat": null, "extended": false, "name": "CRC-32B" }, { "john": null, "hashcat": null, "extended": false, "name": "FCS-32" }, { "john": null, "hashcat": null, "extended": false, "name": "GHash-32-3" }, { "john": null, "hashcat": null, "extended": false, "name": "GHash-32-5" }, { "john": null, "hashcat": null, "extended": false, "name": "FNV-132" }, { "john": null, "hashcat": null, "extended": false, "name": "Fletcher-32" }, { "john": null, "hashcat": null, "extended": false, "name": "Joaat" }, { "john": null, "hashcat": null, "extended": false, "name": "ELF-32" }, { "john": null, "hashcat": null, "extended": false, "name": "XOR-32" } ] }, { "regex": "^[a-f0-9]{6}$", "modes": [ { "john": null, "hashcat": null, "extended": false, "name": "CRC-24" } ] }, { "regex": "^(\\$crc32\\$)?([a-f0-9]{8}.)?[a-f0-9]{8}$", "modes": [ { "john": "crc32", "hashcat": 11500, "extended": false, "name": "CRC-32", "samples": [ "c762de4a:00000000", "$crc32$00000000.fa455f6b", "$crc32$4ff4f23f.ce6eb863" ] }, { "john": "crc32", "hashcat": 27900, "extended": false, "name": "CRC-32C", "samples": [ "5e23d60f:00000000" ] } ] }, { "regex": "^\\+[a-z0-9\\/.]{12}$", "modes": [ { "john": "bfegg", "hashcat": null, "extended": false, "name": "Eggdrop IRC Bot", "samples": [ "+9F93o1OxwgK1", "+C/.8o.Wuph9.", "+Obytd.zXYjH/" ] } ] }, { "regex": "^[a-z0-9\\/.]{13}$", "modes": [ { "john": "descrypt", "hashcat": 1500, "extended": false, "name": "DES(Unix)", "samples": [ "CCNf8Sbh3HDfQ", "CCX.K.MFy4Ois", "CC4rMpbg9AMZ." ] }, { "john": "descrypt", "hashcat": 1500, "extended": false, "name": "Traditional DES", "samples": [ "CCNf8Sbh3HDfQ", "CCX.K.MFy4Ois", "CC4rMpbg9AMZ." ] }, { "john": "descrypt", "hashcat": 1500, "extended": false, "name": "DEScrypt", "samples": [ "CCNf8Sbh3HDfQ", "CCX.K.MFy4Ois", "CC4rMpbg9AMZ." ] } ] }, { "regex": "^[a-f0-9]{16}$", "modes": [ { "john": "mysql", "hashcat": 200, "extended": false, "name": "MySQL323" }, { "john": null, "hashcat": 5100, "extended": false, "name": "Half MD5" }, { "john": null, "hashcat": null, "extended": false, "name": "FNV-164" }, { "john": null, "hashcat": null, "extended": false, "name": "CRC-64" } ] }, { "regex": "^[a-f0-9]{16}:[a-f0-9]{16}$", "modes": [ { "john": null, "hashcat": 28000, "extended": false, "name": "CRC64Jones", "samples": [ "65c1f848fe38cce6:4260950400318054" ] } ] }, { "regex": "^[a-f0-9]{16}:[a-f0-9]{0,30}$", "modes": [ { "john": null, "hashcat": 3100, "extended": false, "name": "DES(Oracle)", "samples": [ "792FCB0AE31D8489:7284616727" ] }, { "john": null, "hashcat": 3100, "extended": false, "name": "Oracle 7-10g", "samples": [ "792FCB0AE31D8489:7284616727" ] } ] }, { "regex": "^[a-z0-9\\/.]{16}$", "modes": [ { "john": "pix-md5", "hashcat": 2400, "extended": false, "name": "Cisco-PIX(MD5)" }, { "john": "dynamic_19", "hashcat": 2400, "extended": true, "name": "md5($pass)" } ] }, { "regex": "^\\([a-z0-9\\/+]{20}\\)$", "modes": [ { "john": "dominosec", "hashcat": 8700, "extended": false, "name": "Lotus Notes/Domino 6" } ] }, { "regex": "^_[a-z0-9\\/.]{19}$", "modes": [ { "john": "bsdicrypt", "hashcat": 12400, "extended": false, "name": "BSDi Crypt", "samples": [ "_GW..8841inaTltazRsQ", "_J9..XXXXsqM/YSSP..Y", "_J9..SDSD5YGyRCr4W4c" ] } ] }, { "regex": "^[a-f0-9]{24}$", "modes": [ { "john": null, "hashcat": null, "extended": false, "name": "CRC-96 (ZIP)" }, { "john": null, "hashcat": 20500, "extended": false, "name": "PKZIP Master Key", "samples": [ "f1eff5c0368d10311dcfc419" ] }, { "john": null, "hashcat": 20510, "extended": false, "name": "PKZIP Master Key (6 byte optimization)", "samples": [ "f1eff5c0368d10311dcfc419" ] } ] }, { "regex": "^[a-z0-9\\/.]{24}$", "modes": [ { "john": null, "hashcat": null, "extended": false, "name": "Crypt16" } ] }, { "regex": "^(\\$md2\\$)?[a-f0-9]{32}$", "modes": [ { "john": "md2", "hashcat": null, "extended": false, "name": "MD2" } ] }, { "regex": "^[a-f0-9]{32}(:.+)?$", "modes": [ { "john": "raw-md5", "hashcat": 0, "extended": false, "name": "MD5", "samples": [ "8743b52063cd84097a65d1633f5c74f5", "098F6BCD4621D373CADE4E832627B4F6" ] }, { "john": "raw-md4", "hashcat": 900, "extended": false, "name": "MD4" }, { "john": null, "hashcat": 2600, "extended": false, "name": "Double MD5" }, { "john": "lm", "hashcat": 3000, "extended": false, "name": "LM" }, { "john": "haval-128-4", "hashcat": null, "extended": false, "name": "Haval-128 (4 rounds)" }, { "john": "dynamic_160", "hashcat": null, "extended": false, "name": "Haval-128 (3 rounds)" }, { "john": "dynamic_180", "hashcat": null, "extended": false, "name": "Haval-128 (5 rounds)" }, { "john": null, "hashcat": null, "extended": false, "name": "Tiger-128" }, { "john": null, "hashcat": null, "extended": false, "name": "Skein-256(128)" }, { "john": null, "hashcat": null, "extended": false, "name": "Skein-512(128)" }, { "john": "lotus5", "hashcat": 8600, "extended": false, "name": "Lotus Notes/Domino 5" }, { "john": null, "hashcat": 23, "extended": false, "name": "Skype" }, { "john": null, "hashcat": null, "extended": true, "name": "ZipMonster" }, { "john": "dynamic_3", "hashcat": 3500, "extended": true, "name": "md5(md5(md5($pass)))", "samples": [ "9882d0778518b095917eb589f6998441" ] }, { "john": "dynamic_2", "hashcat": null, "extended": true, "name": "md5(md5($pass))" }, { "john": null, "hashcat": 4300, "extended": true, "name": "md5(uppercase(md5($pass)))" }, { "john": "dynamic_22", "hashcat": 4400, "extended": true, "name": "md5(sha1($pass))" }, { "john": "dynamic_1", "hashcat": 10, "extended": true, "name": "md5($pass.$salt)" }, { "john": "dynamic_4", "hashcat": 20, "extended": true, "name": "md5($salt.$pass)" }, { "john": null, "hashcat": 30, "extended": true, "name": "md5(unicode($pass).$salt)" }, { "john": null, "hashcat": 40, "extended": true, "name": "md5($salt.unicode($pass))" }, { "john": "hmac-md5", "hashcat": 50, "extended": true, "name": "HMAC-MD5 (key = $pass)" }, { "john": "hmac-md5", "hashcat": 60, "extended": true, "name": "HMAC-MD5 (key = $salt)" }, { "john": "dynamic_8", "hashcat": 3610, "extended": true, "name": "md5(md5($salt).$pass)", "samples": [ "7b57255a15958ef898543ea6cc3313bc:1234" ] }, { "john": "dynamic_9", "hashcat": 3710, "extended": true, "name": "md5($salt.md5($pass))" }, { "john": null, "hashcat": 3720, "extended": true, "name": "md5($pass.md5($salt))", "samples": [ "10ce488714fdbde9453670e0e4cbe99c:1234" ] }, { "john": "dynamic_5", "hashcat": 3810, "extended": true, "name": "md5($salt.$pass.$salt)" }, { "john": "dynamic_14", "hashcat": null, "extended": true, "name": "md5($salt.md5($pass).$salt)" }, { "john": "dynamic_13", "hashcat": 3910, "extended": true, "name": "md5(md5($pass).md5($salt))" }, { "john": "dynamic_12", "hashcat": null, "extended": true, "name": "md5(md5($salt).md5($pass))" }, { "john": "dynamic_6", "hashcat": null, "extended": true, "name": "md5(md5($pass).$salt)" }, { "john": "dynamic_10", "hashcat": 4010, "extended": true, "name": "md5($salt.md5($salt.$pass))" }, { "john": "dynamic_11", "hashcat": 4110, "extended": true, "name": "md5($salt.md5($pass.$salt))" }, { "john": null, "hashcat": 4210, "extended": true, "name": "md5($username.0.$pass)", "samples": [ "09ea048c345ad336ebe38ae5b6c4de24:1234" ] }, { "john": "dynamic_15", "hashcat": null, "extended": true, "name": "md5($username.md5($pass).$salt)" }, { "john": "dynamic_16", "hashcat": null, "extended": true, "name": "md5(md5(md5($pass).$salt).$salt2)" }, { "john": "dynamic_18", "hashcat": null, "extended": true, "name": "md5($salt.Y.$pass.0xF7.$salt)" }, { "john": "dynamic_29", "hashcat": null, "extended": true, "name": "md5(utf16($pass))" }, { "john": "dynamic_31", "hashcat": null, "extended": true, "name": "md4($salt.$pass)" }, { "john": "dynamic_32", "hashcat": null, "extended": true, "name": "md4($pass.$salt)" }, { "john": "dynamic_33", "hashcat": null, "extended": true, "name": "md4(utf16($pass))" }, { "john": "dynamic_34", "hashcat": null, "extended": true, "name": "md5(md4($pass))" }, { "john": "dynamic_39", "hashcat": null, "extended": true, "name": "md5($salt.pad16($pass))" }, { "john": null, "hashcat": null, "extended": false, "name": "MD6-128", "samples": [ "8cd9a30bfde990878c06be4a6111f726" ] } ] }, { "regex": "^[a-f0-9]{32}:.{56}$", "modes": [ { "john": null, "hashcat": 11000, "extended": false, "name": "PrestaShop", "samples": [ "f22cade043e7214200206dbffca49fd9:27167508161455764247627144160038845437138252877014827848", "810e3d12f0f10777a679d9ca1ad7a8d9:M2uZ122bSHJ4Mi54tXGY0lqcv1r28mUluSkyw37ou5oia4i239ujqw0l" ] } ] }, { "regex": "^(\\$netmd5\\$)?([a-f0-9]{88,96}\\$)?[a-f0-9]{32}$", "modes": [ { "john": "net-md5", "hashcat": null, "extended": false, "name": "Keyed MD5: RIPv2, OSPF, BGP, SNMPv2", "samples": [ "02020000ffff0003002c01145267d48d000000000000000000020000ac100100ffffff000000000000000001ffff0001$1e372a8a233c6556253a0909bc3dcce6", "$netmd5$0201002cac1001010000000000000002000001105267ff8fffffff00000a0201000000280000000000000000$445ecbb27272bd791a757a6c85856150" ] } ] }, { "regex": "^(\\$ripemd\\$)?[a-f0-9]{32}(:.+)?$", "modes": [ { "john": "ripemd-128", "hashcat": null, "extended": false, "name": "RIPEMD-128", "samples": [ "cdf26213a150dc3ecb610f18f6b38b46", "$ripemd$cdf26213a150dc3ecb610f18f6b38b46" ] } ] }, { "regex": "^(\\$snefru\\$)?[a-f0-9]{32}$", "modes": [ { "john": "snefru-128", "hashcat": null, "extended": false, "name": "Snefru-128" } ] }, { "regex": "^(\\$NT\\$)?[a-f0-9]{32}$", "modes": [ { "john": "nt", "hashcat": 1000, "extended": false, "name": "NTLM" } ] }, { "regex": "^(([^\\\\:*?\"<>|\\n]+:)|(M\\$.+#))?[a-f0-9]{32}(:[^\\\\\\/:*?\"<>|\\n]+)?$", "modes": [ { "john": "mscash", "hashcat": 1100, "extended": false, "name": "Domain Cached Credentials (DCC), MS Cache", "samples": [ "176a4c2bd45ac73687676c2f09045353", "M$test2#ab60bdb4493822b175486810ac2abe63", "M$#january#72488d8077e33d138b9cff94092716e4", "CORP1.COMPANY.LOCAL/Administrator:ab60bdb4493822b175486810ac2abe63:Administrator" ] } ] }, { "regex": "^([^\\\\:*?\"<>|\\n]+:)?(\\$DCC2\\$(\\d+#)?[^\\\\:*?\"<>|\\n]*#)?[a-f0-9]{32}$", "modes": [ { "john": "mscash2", "hashcat": 2100, "extended": false, "name": "Domain Cached Credentials 2 (DCC2), MS Cache 2", "samples": [ "cfc6a1e33eb36c3d4f84e4c2606623d2", "$DCC2$10240#test1#607bbe89611e37446e736f7856515bf8", "$DCC2$10000#Twelve_chars#54236c670e185043c8016006c001e982", "$DCC2$january#26b5495b21f9ad58255d99b5e117abe2", "$DCC2$#59137848828d14b1fca295a5032b52a1", "CORP1.COMPANY.LOCAL/Administrator:$DCC2$10240#Administrator#cceed966f6689269b758893bb6bbb985" ] } ] }, { "regex": "^{SHA}[a-z0-9\\/+]{27}=$", "modes": [ { "john": "nsldap", "hashcat": 101, "extended": false, "name": "SHA-1(Base64)" }, { "john": "nsldap", "hashcat": 101, "extended": false, "name": "Netscape LDAP SHA" } ] }, { "regex": "^\\$1\\$[a-z0-9\\/.]{0,8}\\$[a-z0-9\\/.]{22}(:.*)?$", "modes": [ { "john": "md5crypt", "hashcat": 500, "extended": false, "name": "MD5 Crypt" }, { "john": "md5crypt", "hashcat": 500, "extended": false, "name": "Cisco-IOS(MD5)" }, { "john": "md5crypt", "hashcat": 500, "extended": false, "name": "FreeBSD MD5" } ] }, { "regex": "^0x[a-f0-9]{32}$", "modes": [ { "john": null, "hashcat": null, "extended": false, "name": "Lineage II C4" } ] }, { "regex": "^\\$H\\$[a-z0-9\\/.]{31}$", "modes": [ { "john": "phpass", "hashcat": 400, "extended": false, "name": "phpBB v3.x" }, { "john": "phpass", "hashcat": 400, "extended": false, "name": "Wordpress v2.6.0/2.6.1" }, { "john": "phpass", "hashcat": 400, "extended": false, "name": "PHPass' Portable Hash" } ] }, { "regex": "^\\$P\\$[a-z0-9\\/.]{31}$", "modes": [ { "john": "phpass", "hashcat": 400, "extended": false, "name": "Wordpress \u2265 v2.6.2" }, { "john": "phpass", "hashcat": 400, "extended": false, "name": "Joomla \u2265 v2.5.18" }, { "john": "phpass", "hashcat": 400, "extended": false, "name": "PHPass' Portable Hash" } ] }, { "regex": "^[a-f0-9]{32}:[a-z0-9]{2}$", "modes": [ { "john": null, "hashcat": 21, "extended": false, "name": "osCommerce" }, { "john": null, "hashcat": 21, "extended": false, "name": "xt:Commerce" } ] }, { "regex": "^(?:\\$apr1\\$|\\$1\\$|{smd5})[a-z0-9\\/.]{0,8}\\$[a-z0-9\\/.]{22}$", "modes": [ { "john": "md5crypt-long", "hashcat": 1600, "extended": false, "name": "MD5 (APR)" }, { "john": "md5crypt-long", "hashcat": 1600, "extended": false, "name": "Apache MD5" }, { "john": "md5crypt-long", "hashcat": 1600, "extended": false, "name": "md5apr1" }, { "john": "md5crypt-long", "hashcat": 1600, "extended": false, "name": "crypt(3) MD5", "samples": [ "$apr1$71850310$gh9m4xcAn3MGxogwX/ztb.", "$1$12345678$aIccj83HRDBo6ux1bVx7D1", "{smd5}s8/xSJ/v$uGam4GB8hOjTLQqvBfxJ2/" ] } ] }, { "regex": "^{smd5}[a-z0-9$\\/.]{31}$", "modes": [ { "john": "aix-smd5", "hashcat": 6300, "extended": false, "name": "AIX(smd5)" } ] }, { "regex": "^[a-f0-9]{32}:.+$", "modes": [ { "john": null, "hashcat": 3721, "extended": false, "name": "WebEdition CMS", "samples": [ "fa01af9f0de5f377ae8befb03865178e:5678" ] }, { "john": null, "hashcat": 26401, "extended": true, "name": "AES-128-ECB NOKDF (PT = $salt, key = $pass)", "samples": [ "e7a32f3210455cc044f26117c4612aab:86046627772965328523223752173724" ] }, { "john": null, "hashcat": 26402, "extended": true, "name": "AES-192-ECB NOKDF (PT = $salt, key = $pass)", "samples": [ "2995e91b798ef51232a91579edb1d176:49869364034411376791729962721320" ] }, { "john": null, "hashcat": 26403, "extended": true, "name": "AES-256-ECB NOKDF (PT = $salt, key = $pass)", "samples": [ "264a4248c9522cb74d33fe26cb596895:61270210011294880287232432636227" ] } ] }, { "regex": "^[a-f0-9]{32}:.{5}$", "modes": [ { "john": null, "hashcat": 2811, "extended": false, "name": "IP.Board \u2265 v2+" } ] }, { "regex": "^[a-f0-9]{32}:.{8}$", "modes": [ { "john": null, "hashcat": 2811, "extended": false, "name": "MyBB \u2265 v1.2+" } ] }, { "regex": "^[a-z0-9]{34}$", "modes": [ { "john": null, "hashcat": null, "extended": false, "name": "CryptoCurrency(Adress)" } ] }, { "regex": "^[a-f0-9]{40}(:.+)?$", "modes": [ { "john": "raw-sha1", "hashcat": 100, "extended": false, "name": "SHA-1" }, { "john": null, "hashcat": 4500, "extended": false, "name": "Double SHA-1" }, { "john": "dynamic_190", "hashcat": null, "extended": false, "name": "Haval-160 (3 rounds)" }, { "john": "dynamic_200", "hashcat": null, "extended": false, "name": "Haval-160 (4 rounds)" }, { "john": "dynamic_210", "hashcat": null, "extended": false, "name": "Haval-160 (5 rounds)" }, { "john": null, "hashcat": null, "extended": false, "name": "Tiger-160" }, { "john": null, "hashcat": null, "extended": false, "name": "HAS-160" }, { "john": "raw-sha1-linkedin", "hashcat": 190, "extended": false, "name": "LinkedIn", "samples": [ "b89eaac7e61417341b710b727768294d0e6a277b" ] }, { "john": null, "hashcat": null, "extended": false, "name": "Skein-256(160)" }, { "john": null, "hashcat": null, "extended": false, "name": "Skein-512(160)" }, { "john": "dynamic_35", "hashcat": null, "extended": true, "name": "MangosWeb Enhanced CMS" }, { "john": "dynamic_36", "hashcat": null, "extended": true, "name": "MangosWeb Enhanced CMS v2" }, { "john": "dynamic_35", "hashcat": null, "extended": true, "name": "sha1(uppercase($username).:.$pass)" }, { "john": "dynamic_36", "hashcat": null, "extended": true, "name": "sha1($username.:.$pass)" }, { "john": null, "hashcat": 4600, "extended": true, "name": "sha1(sha1(sha1($pass)))", "samples": [ "dc57f246485e62d99a5110afc9264b4ccbfcf3cc" ] }, { "john": "dynamic_23", "hashcat": 4700, "extended": true, "name": "sha1(md5($pass))" }, { "john": "dynamic_24", "hashcat": 110, "extended": true, "name": "sha1($pass.$salt)" }, { "john": "dynamic_25", "hashcat": 120, "extended": true, "name": "sha1($salt.$pass)" }, { "john": null, "hashcat": 130, "extended": true, "name": "sha1(unicode($pass).$salt)" }, { "john": null, "hashcat": 140, "extended": true, "name": "sha1($salt.unicode($pass))" }, { "john": "hmac-sha1", "hashcat": 150, "extended": true, "name": "HMAC-SHA1 (key = $pass)" }, { "john": "hmac-sha1", "hashcat": 160, "extended": true, "name": "HMAC-SHA1 (key = $salt)" }, { "john": null, "hashcat": 4710, "extended": true, "name": "sha1($salt.$pass.$salt)" }, { "john": "dynamic_37", "hashcat": null, "extended": true, "name": "SMF" }, { "john": "dynamic_37", "hashcat": null, "extended": true, "name": "sha1(lowercase($username).$pass)" }, { "john": "dynamic_38", "hashcat": null, "extended": true, "name": "Wolt3BB" }, { "john": "dynamic_38", "hashcat": null, "extended": true, "name": "sha1($salt.sha1($salt.sha1($pass)))" }, { "john": "dynamic_40", "hashcat": null, "extended": true, "name": "net-sha1" }, { "john": "dynamic_40", "hashcat": null, "extended": true, "name": "sha1($salt.pad20($pass))" }, { "john": null, "hashcat": 24300, "extended": true, "name": "sha1($salt.sha1($pass.$salt))", "samples": [ "94520b02c04e79e08a75a84c2a6e3ed4e3874fe8:ThisIsATestSalt" ] }, { "john": null, "hashcat": 27200, "extended": false, "name": "Ruby on Rails Restful Auth (one round, no sitekey)", "samples": [ "3999d08db95797891ec77f07223ca81bf43e1be2:5dcc47b04c49d3c8e1b9e4ec367fddeed21b7b85" ] } ] }, { "regex": "^(\\$ripemd\\$)?[a-f0-9]{40}(:.+)?$", "modes": [ { "john": "ripemd-160", "hashcat": 6000, "extended": false, "name": "RIPEMD-160", "samples": [ "9c1185a5c5e9fc54612808977ee8f548b2258d31", "$ripemd$9c1185a5c5e9fc54612808977ee8f548b2258d31", "012cb9b334ec1aeb71a9c8ce85586082467f7eb6" ] } ] }, { "regex": "^(\\*)?[a-f0-9]{40}$", "modes": [ { "john": "mysql-sha1", "hashcat": 300, "extended": false, "name": "MySQL5.x", "samples": [ "*2c905879f74f28f8570989947d06a8429fb943e6", "*A8A397146B1A5F8C8CF26404668EFD762A1B7B82" ] }, { "john": "mysql-sha1", "hashcat": 300, "extended": false, "name": "MySQL4.1", "samples": [ "*5AD8F88516BD021DD43F171E2C785C69F8E54ADB", "*be1bdec0aa74b4dcb079943e70528096cca985f8", "fcf7c1b8749cf99d88e5f34271d636178fb5d130" ] } ] }, { "regex": "^[a-z0-9]{43}$", "modes": [ { "john": null, "hashcat": 5700, "extended": false, "name": "Cisco-IOS(SHA-256)" } ] }, { "regex": "^{SSHA}[a-z0-9\\/+]{38}==$", "modes": [ { "john": "nsldaps", "hashcat": 111, "extended": false, "name": "SSHA-1(Base64)" }, { "john": "nsldaps", "hashcat": 111, "extended": false, "name": "Netscape LDAP SSHA" }, { "john": "nsldaps", "hashcat": 111, "extended": true, "name": "nsldaps" } ] }, { "regex": "^[a-z0-9=]{47}$", "modes": [ { "john": "fortigate", "hashcat": 7000, "extended": false, "name": "Fortigate(FortiOS)" } ] }, { "regex": "^[a-f0-9]{48}$", "modes": [ { "john": "dynamic_220", "hashcat": null, "extended": false, "name": "Haval-192 (3 rounds)" }, { "john": "dynamic_230", "hashcat": null, "extended": false, "name": "Haval-192 (4 rounds)" }, { "john": "dynamic_240", "hashcat": null, "extended": false, "name": "Haval-192 (5 rounds)" }, { "john": "tiger", "hashcat": null, "extended": false, "name": "Tiger-192" }, { "john": null, "hashcat": null, "extended": false, "name": "SHA-1(Oracle)" }, { "john": "xsha", "hashcat": 122, "extended": false, "name": "OSX v10.4" }, { "john": "xsha", "hashcat": 122, "extended": false, "name": "OSX v10.5" }, { "john": "xsha", "hashcat": 122, "extended": false, "name": "OSX v10.6" } ] }, { "regex": "^[a-f0-9]{51}$", "modes": [ { "john": null, "hashcat": null, "extended": false, "name": "Palshop CMS" } ] }, { "regex": "^[a-z0-9]{51}$", "modes": [ { "john": null, "hashcat": null, "extended": false, "name": "CryptoCurrency(PrivateKey)" } ] }, { "regex": "^{ssha1}[0-9]{2}\\$[a-z0-9$\\/.]{44}$", "modes": [ { "john": "aix-ssha1", "hashcat": 6700, "extended": false, "name": "AIX(ssha1)" } ] }, { "regex": "^0x0100[a-f0-9]{48}$", "modes": [ { "john": "mssql05", "hashcat": 132, "extended": false, "name": "MSSQL(2005)" }, { "john": "mssql05", "hashcat": 132, "extended": false, "name": "MSSQL(2008)" } ] }, { "regex": "^(\\$md5,rounds=[0-9]+\\$|\\$md5\\$rounds=[0-9]+\\$|\\$md5\\$)[a-z0-9\\/.]{0,16}(\\$|\\$\\$)[a-z0-9\\/.]{22}$", "modes": [ { "john": "sunmd5", "hashcat": 3300, "extended": false, "name": "Sun MD5 Crypt", "samples": [ "$md5$rounds=904$iPPKEBnEkp3JV8uX$0L6m7rOFTVFn.SGqo2M9W1" ] } ] }, { "regex": "^[a-f0-9]{56}$", "modes": [ { "john": "raw-sha224", "hashcat": 1300, "extended": false, "name": "SHA-224" }, { "john": "dynamic_51", "hashcat": null, "extended": true, "name": "sha224($salt.$pass)" }, { "john": "dynamic_52", "hashcat": null, "extended": true, "name": "sha224($pass.$salt)" }, { "john": "dynamic_53", "hashcat": null, "extended": true, "name": "sha224(sha224($pass))" }, { "john": "dynamic_54", "hashcat": null, "extended": true, "name": "sha224(sha224_raw($pass))" }, { "john": "dynamic_55", "hashcat": null, "extended": true, "name": "sha224(sha224($pass).$salt)" }, { "john": "dynamic_56", "hashcat": null, "extended": true, "name": "sha224($salt.sha224($pass))" }, { "john": "dynamic_57", "hashcat": null, "extended": true, "name": "sha224(sha224($salt).sha224($pass))" }, { "john": "dynamic_58", "hashcat": null, "extended": true, "name": "sha224(sha224($pass).sha224($pass))" }, { "john": "dynamic_250", "hashcat": null, "extended": false, "name": "Haval-224 (3 rounds)" }, { "john": "dynamic_260", "hashcat": null, "extended": false, "name": "Haval-224 (4 rounds)" }, { "john": "dynamic_270", "hashcat": null, "extended": false, "name": "Haval-224 (5 rounds)" }, { "john": "dynamic_370", "hashcat": 17300, "extended": false, "name": "SHA3-224" }, { "john": "dynamic_430", "hashcat": 17700, "extended": false, "name": "Keccak-224" }, { "john": null, "hashcat": null, "extended": false, "name": "Skein-256(224)" }, { "john": null, "hashcat": null, "extended": false, "name": "Skein-512(224)" }, { "john": "dynamic_330", "hashcat": null, "extended": false, "name": "Skein-224" }, { "john": null, "hashcat": null, "extended": false, "name": "BLAKE2-224" } ] }, { "regex": "^(\\$2[axy]|\\$2)\\$[0-9]{2}\\$[a-z0-9\\/.]{53}$", "modes": [ { "john": "bcrypt", "hashcat": 3200, "extended": false, "name": "Blowfish(OpenBSD)" }, { "john": null, "hashcat": null, "extended": false, "name": "Woltlab Burning Board 4.x" }, { "john": "bcrypt", "hashcat": 3200, "extended": false, "name": "bcrypt" }, { "john": null, "hashcat": 25600, "extended": true, "name": "bcrypt(md5($pass)) / bcryptmd5", "samples": [ "$2a$05$/VT2Xs2dMd8GJKfrXhjYP.DkTjOVrY12yDN7/6I8ZV0q/1lEohLru" ] }, { "john": null, "hashcat": 25800, "extended": true, "name": "bcrypt(sha1($pass)) / bcryptsha1", "samples": [ "$2a$05$Uo385Fa0g86uUXHwZxB90.qMMdRFExaXePGka4WGFv.86I45AEjmO" ] } ] }, { "regex": "^[a-f0-9]{40}:[a-f0-9]{16}$", "modes": [ { "john": null, "hashcat": 5800, "extended": false, "name": "Android PIN" } ] }, { "regex": "^(S:)?[a-f0-9]{40}(:)?[a-f0-9]{20}$", "modes": [ { "john": "oracle11", "hashcat": 112, "extended": false, "name": "Oracle 11g/12c" } ] }, { "regex": "^\\$bcrypt-sha256\\$(2[axy]|2)\\,[0-9]+\\$[a-z0-9\\/.]{22}\\$[a-z0-9\\/.]{31}$", "modes": [ { "john": null, "hashcat": null, "extended": false, "name": "bcrypt(SHA-256)" } ] }, { "regex": "^[a-f0-9]{32}:.{3}$", "modes": [ { "john": null, "hashcat": 2611, "extended": false, "name": "vBulletin < v3.8.5" } ] }, { "regex": "^[a-f0-9]{32}:.{30}$", "modes": [ { "john": null, "hashcat": 2711, "extended": false, "name": "vBulletin \u2265 v3.8.5" } ] }, { "regex": "^(\\$snefru\\$)?[a-f0-9]{64}$", "modes": [ { "john": "snefru-256", "hashcat": null, "extended": false, "name": "Snefru-256" } ] }, { "regex": "^[a-f0-9]{64}(:.+)?$", "modes": [ { "john": "raw-sha256", "hashcat": 1400, "extended": false, "name": "SHA-256" }, { "john": "dynamic_140", "hashcat": null, "extended": false, "name": "RIPEMD-256", "samples": [ "1419109aa0de60e6ba0b6d2b2f602c13b07e97b5ffc85b6be2297badc699262f", "f156e6c20042057840f3251ee041596d89fde06c2505f61764ad1c03c2fc1375" ] }, { "john": "haval-256-3", "hashcat": null, "extended": false, "name": "Haval-256 (3 rounds)" }, { "john": "dynamic_290", "hashcat": null, "extended": false, "name": "Haval-256 (4 rounds)" }, { "john": "dynamic_300", "hashcat": null, "extended": false, "name": "Haval-256 (5 rounds)" }, { "john": "gost", "hashcat": 6900, "extended": false, "name": "GOST R 34.11-94" }, { "john": null, "hashcat": null, "extended": false, "name": "GOST CryptoPro S-Box" }, { "john": "dynamic_380", "hashcat": 17400, "extended": false, "name": "SHA3-256" }, { "john": "raw-keccak-256", "hashcat": 17800, "extended": false, "name": "Keccak-256" }, { "john": "skein-256", "hashcat": null, "extended": false, "name": "Skein-256" }, { "john": null, "hashcat": null, "extended": false, "name": "Skein-512(256)" }, { "john": null, "hashcat": null, "extended": true, "name": "Ventrilo" }, { "john": "dynamic_62", "hashcat": 1410, "extended": true, "name": "sha256($pass.$salt)" }, { "john": "dynamic_61", "hashcat": 1420, "extended": true, "name": "sha256($salt.$pass)" }, { "john": null, "hashcat": 1430, "extended": true, "name": "sha256(unicode($pass).$salt)" }, { "john": null, "hashcat": 1440, "extended": true, "name": "sha256($salt.unicode($pass))" }, { "john": "hmac-sha256", "hashcat": 1450, "extended": true, "name": "HMAC-SHA256 (key = $pass)" }, { "john": "hmac-sha256", "hashcat": 1460, "extended": true, "name": "HMAC-SHA256 (key = $salt)" }, { "john": "dynamic_63", "hashcat": null, "extended": true, "name": "sha256(sha256($pass))" }, { "john": "dynamic_64", "hashcat": null, "extended": true, "name": "sha256(sha256_raw($pass))" }, { "john": "dynamic_65", "hashcat": null, "extended": true, "name": "sha256(sha256($pass).$salt)" }, { "john": "dynamic_66", "hashcat": null, "extended": true, "name": "sha256($salt.sha256($pass))" }, { "john": "dynamic_67", "hashcat": null, "extended": true, "name": "sha256(sha256($salt).sha256($pass))" }, { "john": "dynamic_68", "hashcat": null, "extended": true, "name": "sha256(sha256($pass).sha256($pass))" }, { "john": "dynamic_320", "hashcat": null, "extended": false, "name": "PANAMA" }, { "john": null, "hashcat": null, "extended": false, "name": "BLAKE2-256" }, { "john": null, "hashcat": null, "extended": false, "name": "MD6-256", "samples": [ "bc9e2022386d929ae3936306153d9366fc555dc868579c87c7faf8846f79f414" ] } ] }, { "regex": "^[a-f0-9]{32}:[a-z0-9]{32}$", "modes": [ { "john": null, "hashcat": 11, "extended": false, "name": "Joomla < v2.5.18" } ] }, { "regex": "^[a-f0-9]{32}:[a-f0-9]{32}$", "modes": [ { "john": null, "hashcat": null, "extended": false, "name": "SAM(LM_Hash:NT_Hash)" } ] }, { "regex": "^(\\$chap\\$0\\*)?[a-f0-9]{32}[\\*:][a-f0-9]{32}(:[0-9]{2})?$", "modes": [ { "john": "chap", "hashcat": 4800, "extended": false, "name": "MD5(Chap)" }, { "john": "chap", "hashcat": 4800, "extended": false, "name": "iSCSI CHAP Authentication" } ] }, { "regex": "^\\$episerver\\$\\*0\\*[a-z0-9\\/=+]+\\*[a-z0-9\\/=+]{27,28}$", "modes": [ { "john": "episerver", "hashcat": 141, "extended": false, "name": "EPiServer 6.x < v4" } ] }, { "regex": "^{ssha256}[0-9]{2}\\$[a-z0-9$\\/.]{60}$", "modes": [ { "john": "aix-ssha256", "hashcat": 6400, "extended": false, "name": "AIX(ssha256)" } ] }, { "regex": "^[a-f0-9]{80}$", "modes": [ { "john": "dynamic_150", "hashcat": null, "extended": false, "name": "RIPEMD-320", "samples": [ "303aa1dcb731cd4e4bff2a60971eb7376c6c47cb59947c804776d115470183c8cc2e487337b45412", "3c616c27aa7539c4726388c9e047aa4ea089dd739b3cfc470e964ea12e479da3cce437b9daa90214" ] } ] }, { "regex": "^\\$episerver\\$\\*1\\*[a-z0-9\\/=+]+\\*[a-z0-9\\/=+]{42,43}$", "modes": [ { "john": "episerver", "hashcat": 1441, "extended": false, "name": "EPiServer 6.x \u2265 v4" } ] }, { "regex": "^0x0100[a-f0-9]{88}$", "modes": [ { "john": "mssql", "hashcat": 131, "extended": false, "name": "MSSQL(2000)" } ] }, { "regex": "^[a-f0-9]{96}$", "modes": [ { "john": "raw-sha384", "hashcat": 10800, "extended": false, "name": "SHA-384" }, { "john": "dynamic_390", "hashcat": 17500, "extended": false, "name": "SHA3-384" }, { "john": "dynamic_440", "hashcat": 17900, "extended": false, "name": "Keccak-384" }, { "john": null, "hashcat": null, "extended": false, "name": "Skein-512(384)" }, { "john": null, "hashcat": null, "extended": false, "name": "Skein-1024(384)" }, { "john": "dynamic_71", "hashcat": null, "extended": true, "name": "sha384($salt.$pass)" }, { "john": "dynamic_72", "hashcat": null, "extended": true, "name": "sha384($pass.$salt)" }, { "john": "dynamic_73", "hashcat": null, "extended": true, "name": "sha384(sha384($pass))" }, { "john": "dynamic_74", "hashcat": null, "extended": true, "name": "sha384(sha384_raw($pass))" }, { "john": "dynamic_75", "hashcat": null, "extended": true, "name": "sha384(sha384($pass).$salt)" }, { "john": "dynamic_76", "hashcat": null, "extended": true, "name": "sha384($salt.sha384($pass))" }, { "john": "dynamic_77", "hashcat": null, "extended": true, "name": "sha384(sha384($salt).sha384($pass))" }, { "john": "dynamic_78", "hashcat": null, "extended": true, "name": "sha384(sha384($pass).sha384($pass))" }, { "john": "dynamic_350", "hashcat": null, "extended": true, "name": "Skein-384" }, { "john": null, "hashcat": null, "extended": false, "name": "BLAKE2-384" } ] }, { "regex": "^{SSHA512}[a-z0-9\\/+]{96}$", "modes": [ { "john": "ssha512", "hashcat": 1711, "extended": false, "name": "SSHA-512(Base64)" }, { "john": "ssha512", "hashcat": 1711, "extended": false, "name": "LDAP(SSHA-512)" } ] }, { "regex": "^{ssha512}[0-9]{2}\\$[a-z0-9\\/.]{16,48}\\$[a-z0-9\\/.]{86}$", "modes": [ { "john": "aix-ssha512", "hashcat": 6500, "extended": false, "name": "AIX(ssha512)" } ] }, { "regex": "^[a-f0-9]{128}(:.+)?$", "modes": [ { "john": "raw-sha512", "hashcat": 1700, "extended": false, "name": "SHA-512", "samples": [ "f342aae82952db35b8e02c30115e3deed3d80fdfdadacab336f0ba51ac54e297291fa1d6b201d69a2bd77e2535280f17a54fa1e527abc6e2eddba79ad3be11c0", "7aba4411846c61b08b0f2282a8a4600232ace4dd96593c755ba9c9a4e7b780b8bdc437b5c55574b3e8409c7b511032f98ef120e25467678f0458643578eb60ff", "12b03226a6d8be9c6e8cd5e55dc6c7920caaa39df14aab92d5e3ea9340d1c8a4d3d0b8e4314f1f6ef131ba4bf1ceb9186ab87c801af0d5c95b1befb8cedae2b9" ] }, { "john": "whirlpool", "hashcat": 6100, "extended": false, "name": "Whirlpool" }, { "john": null, "hashcat": null, "extended": false, "name": "Salsa10" }, { "john": null, "hashcat": null, "extended": false, "name": "Salsa20" }, { "john": "raw-sha3", "hashcat": 17600, "extended": false, "name": "SHA3-512" }, { "john": "dynamic_400", "hashcat": 17600, "extended": false, "name": "SHA3-512" }, { "john": "raw-keccak", "hashcat": 18000, "extended": false, "name": "Keccak-512" }, { "john": "raw-blake2", "hashcat": null, "extended": false, "name": "BLAKE2-512" }, { "john": "skein-512", "hashcat": null, "extended": false, "name": "Skein-512" }, { "john": null, "hashcat": null, "extended": false, "name": "Skein-1024(512)" }, { "john": "dynamic_82", "hashcat": 1710, "extended": true, "name": "sha512($pass.$salt)" }, { "john": "dynamic_81", "hashcat": 1720, "extended": true, "name": "sha512($salt.$pass)" }, { "john": null, "hashcat": 1730, "extended": true, "name": "sha512(unicode($pass).$salt)" }, { "john": null, "hashcat": 1740, "extended": true, "name": "sha512($salt.unicode($pass))" }, { "john": "hmac-sha512", "hashcat": 1750, "extended": true, "name": "HMAC-SHA512 (key = $pass)" }, { "john": "hmac-sha512", "hashcat": 1760, "extended": true, "name": "HMAC-SHA512 (key = $salt)" }, { "john": "dynamic_83", "hashcat": null, "extended": true, "name": "sha512(sha512($pass))" }, { "john": "dynamic_85", "hashcat": null, "extended": true, "name": "sha512(sha512($pass).$salt)" }, { "john": "dynamic_86", "hashcat": null, "extended": true, "name": "sha512($salt.sha512($pass))" }, { "john": "dynamic_87", "hashcat": null, "extended": true, "name": "sha512(sha512($salt).sha512($pass))" }, { "john": "dynamic_88", "hashcat": null, "extended": true, "name": "sha512(sha512($pass).sha512($pass))" }, { "john": null, "hashcat": null, "extended": false, "name": "MD6-512", "samples": [ "39990e5d4b65abd1c679b36fc7fa0b2f831144374ac3792736180bc5fc5ed4e93f177ed03f16ebac7327b9ddb7e4add838c3ce784653bbdd57d46a9a1d22932d" ] } ] }, { "regex": "^\\$BLAKE2\\$[a-f0-9]{128}$", "modes": [ { "john": "raw-blake2", "hashcat": 600, "extended": false, "name": "BLAKE2-512" } ] }, { "regex": "^[a-f0-9]{136}$", "modes": [ { "john": "xsha512", "hashcat": 1722, "extended": false, "name": "OSX v10.7" } ] }, { "regex": "^0x0200[a-f0-9]{136}$", "modes": [ { "john": "mssql12", "hashcat": 1731, "extended": false, "name": "MSSQL(2012)", "samples": [ "0x0200F733058A07892C5CACE899768F89965F6BD1DED7955FE89E1C9A10E27849B0B213B5CE92CC9347ECCB34C3EFADAF2FD99BFFECD8D9150DD6AACB5D409A9D2652A4E0AF16", "0x0200AB3E1F9028A739EEF62ABF672427276A32D5EDD349E638E7F2CD81DAA247CFE20EE4E3B0A30B2D0AE3C3FA010E61752F1BF45E045041F1B988C083C7F118527E3E5F0562" ] }, { "john": "mssql12", "hashcat": 1731, "extended": false, "name": "MSSQL(2014)", "samples": [ "0x02003788006711b2e74e7d8cb4be96b1d187c962c5591a02d5a6ae81b3a4a094b26b7877958b26733e45016d929a756ed30d0a5ee65d3ce1970f9b7bf946e705c595f07625b1", "0x02006BF4AB05873FF0C8A4AFD1DC5912CBFDEF62E0520A3353B04E1184F05C873C9C76BBADDEAAC1E9948C7B6ABFFD62BFEFD7139F17F6AFE10BE0FEE7A178644623067C2423" ] } ] }, { "regex": "^\\$ml\\$[0-9]+\\$[a-f0-9]{64}\\$[a-f0-9]{128}$", "modes": [ { "john": "pbkdf2-hmac-sha512", "hashcat": 7100, "extended": false, "name": "OSX v10.8" }, { "john": "pbkdf2-hmac-sha512", "hashcat": 7100, "extended": false, "name": "OSX v10.9" } ] }, { "regex": "^[a-f0-9]{256}$", "modes": [ { "john": null, "hashcat": null, "extended": false, "name": "Skein-1024" } ] }, { "regex": "^grub\\.pbkdf2\\.sha512\\.[0-9]+\\.([a-f0-9]{128,2048}\\.|[0-9]+\\.)?[a-f0-9]{128}$", "modes": [ { "john": null, "hashcat": 7200, "extended": false, "name": "GRUB 2" } ] }, { "regex": "^sha1\\$[a-z0-9]+\\$[a-f0-9]{40}$", "modes": [ { "john": null, "hashcat": 124, "extended": false, "name": "Django(SHA-1)" } ] }, { "regex": "^[a-f0-9]{49}$", "modes": [ { "john": "citrix_ns10", "hashcat": 8100, "extended": false, "name": "Citrix Netscaler" } ] }, { "regex": "^\\$S\\$[a-z0-9\\/.]{52}$", "modes": [ { "john": "drupal7", "hashcat": 7900, "extended": false, "name": "Drupal > v7.x" } ] }, { "regex": "^\\$5\\$(rounds=[0-9]+\\$)?[a-z0-9\\/.]{0,16}\\$[a-z0-9\\/.]{43}$", "modes": [ { "john": "sha256crypt", "hashcat": 7400, "extended": false, "name": "SHA-256 Crypt" } ] }, { "regex": "^0x[a-f0-9]{4}[a-f0-9]{16}[a-f0-9]{64}$", "modes": [ { "john": "sybasease", "hashcat": 8000, "extended": false, "name": "Sybase ASE" } ] }, { "regex": "^\\$6\\$(rounds=[0-9]+\\$)?[a-z0-9\\/.]{0,16}\\$[a-z0-9\\/.]{86}$", "modes": [ { "john": "sha512crypt", "hashcat": 1800, "extended": false, "name": "SHA-512 Crypt" } ] }, { "regex": "^\\$sha\\$[a-z0-9]{1,16}\\$([a-f0-9]{32}|[a-f0-9]{40}|[a-f0-9]{64}|[a-f0-9]{128}|[a-f0-9]{140})$", "modes": [ { "john": null, "hashcat": 20711, "extended": false, "name": "Minecraft (AuthMe Reloaded sha256)", "samples": [ "$SHA$7218532375810603$bfede293ecf6539211a7305ea218b9f3f608953130405cda9eaba6fb6250f824" ] } ] }, { "regex": "^sha256\\$[a-z0-9]+\\$[a-f0-9]{64}$", "modes": [ { "john": null, "hashcat": null, "extended": false, "name": "Django(SHA-256)" } ] }, { "regex": "^sha384\\$[a-z0-9]+\\$[a-f0-9]{96}$", "modes": [ { "john": null, "hashcat": null, "extended": false, "name": "Django(SHA-384)" } ] }, { "regex": "^crypt1:[a-z0-9+=]{12}:[a-z0-9+=]{12}$", "modes": [ { "john": null, "hashcat": null, "extended": false, "name": "Clavister Secure Gateway" } ] }, { "regex": "^[a-f0-9]{112}$", "modes": [ { "john": null, "hashcat": null, "extended": false, "name": "Cisco VPN Client(PCF-File)" } ] }, { "regex": "^[a-f0-9]{1329}$", "modes": [ { "john": null, "hashcat": null, "extended": false, "name": "Microsoft MSTSC(RDP-File)" } ] }, { "regex": "^[^\\/:*?\"<>|]{0,60}::[^\\/:*?\"<>|]{0,45}:[a-f0-9]{0,48}:[a-f0-9]{48}:[a-f0-9]{16}$", "modes": [ { "john": "netntlm / netntlm-naive", "hashcat": 5500, "extended": false, "name": "NetNTLMv1 / NetNTLMv1+ESS (vanilla)", "samples": [ "u4-netntlm::kNS:338d08f8e26de93300000000000000000000000000000000:9526fb8c23a90751cdd619b6cea564742e1e4bf33006ba41:cb8086049ec4736c", "CORP\\Administrator:::25B2B477CE101D83648BB087CE7A1C217F51C7FC64C0EBB1:C8BD0C1630A9ECF7A95F494A8F0B2CB4A3F25B1225514304:1122334455667788", "DOMAIN\\User:::c70e4fb229437ef300000000000000000000000000000000:abf7762caf2b1bbfc5cfc1f46665249f049e0af72ae5b5a9:24ca92fdab441aa4", "ESS:::4765f360625700b000000000000000000000000000000000:81f5ecd8a77fe819f7f6689a08a27ac705fc2e1bb00cecb2:c75c20bff9baa71f" ] }, { "john": "netntlm / netntlm-naive", "hashcat": 27000, "extended": false, "name": "NetNTLMv1 / NetNTLMv1+ESS (NT)", "samples": [ "::5V4T:ada06359242920a500000000000000000000000000000000:0556d5297b5daa70eaffde82ef99293a3f3bb59b7c9704ea:9c23f6c094853920" ] } ] }, { "regex": "^[^\\/:*?\"<>|]{0,60}::[^\\/:*?\"<>|]{0,45}:[a-f0-9]{16}:[a-f0-9]{32}:[a-f0-9]{2,1024}$", "modes": [ { "john": "netntlmv2", "hashcat": 5600, "extended": false, "name": "NetNTLMv2 (vanilla)", "samples": [ "admin::N46iSNekpT:08ca45b7d7ea58ee:88dcbe4446168966a153a0064958dac6:5c7830315c7830310000000000000b45c67103d07d7b95acd12ffa11230e0000000052920b85f78d013c31cdb3b92f5d765c783030", "ntlmv2test::WORKGROUP:1122334455667788:07659A550D5E9D02996DFD95C87EC1D5:0101000000000000006CF6385B74CA01B3610B02D99732DD000000000200120057004F0052004B00470052004F00550050000100200044004100540041002E00420049004E0043002D0053004500430055005200490000000000", "USER1::Domain:1122334455667788:5E4AB1BF243DCA304A00ADEF78DC38DF:0101000000000000BB50305495AACA01338BC7B090A62856000000000200120057004F0052004B00470052004F00550050000000000000000000", "TESTWORKGROUP\\NTlmv2:::1122334455667788:07659A550D5E9D02996DFD95C87EC1D5:0101000000000000006CF6385B74CA01B3610B02D99732DD000000000200120057004F0052004B00470052004F00550050000100200044004100540041002E00420049004E0043002D0053004500430055005200490000000000", "NTlmv2::TESTWORKGROUP:1122334455667788:07659A550D5E9D02996DFD95C87EC1D5:0101000000000000006CF6385B74CA01B3610B02D99732DD000000000200120057004F0052004B00470052004F00550050000100200044004100540041002E00420049004E0043002D0053004500430055005200490000000000", "TestUser::W2K3ADWIN7:1122334455667788:989B96DC6EAB529F72FCBA852C0D5719:01010000000000002EC51CEC91AACA0124576A744F198BDD000000000200120057004F0052004B00470052004F00550050000000000000000000", "user::W2K3ADWIN7:1122334455667788:5BD1F32D8AFB4FB0DD0B77D7DE2FF7A9:0101000000000000309F56FE91AACA011B66A7051FA48148000000000200120057004F0052004B00470052004F00550050000000000000000000", "W2K3ADWIN7\\user1:::1122334455667788:027EF88334DAA460144BDB678D4F988D:010100000000000092809B1192AACA01E01B519CB0248776000000000200120057004F0052004B00470052004F00550050000000000000000000", "W2K3ADWIN7\\TEST_USER:::1122334455667788:A06EC5ED9F6DAFDCA90E316AF415BA71:010100000000000036D3A13292AACA01D2CD95757A0836F9000000000200120057004F0052004B00470052004F00550050000000000000000000" ] }, { "john": "netntlmv2", "hashcat": 27100, "extended": false, "name": "NetNTLMv2 (NT)", "samples": [ "0UL5G37JOI0SX::6VB1IS0KA74:ebe1afa18b7fbfa6:aab8bf8675658dd2a939458a1077ba08:010100000000000031c8aa092510945398b9f7b7dde1a9fb00000000f7876f2b04b700" ] } ] }, { "regex": "^\\$(krb5pa|mskrb5)\\$([0-9]{2})?\\$.+\\$[a-f0-9]{1,}$", "modes": [ { "john": "krb5pa-md5", "hashcat": 7500, "extended": false, "name": "Kerberos 5 AS-REQ Pre-Auth etype 23" } ] }, { "regex": "^\\$krb5tgs\\$23\\$\\*[^*]*\\*\\$[a-f0-9]{32}\\$[a-f0-9]{64,40960}$", "modes": [ { "john": "krb5tgs", "hashcat": 13100, "extended": false, "name": "Kerberos 5 TGS-REP etype 23" } ] }, { "regex": "^\\$krb5asrep\\$23\\$[^:]+:[a-f0-9]{32,32}\\$[a-f0-9]{64,40960}$", "modes": [ { "john": "krb5asrep", "hashcat": 18200, "extended": false, "name": "Kerberos 5 AS-REP etype 23" } ] }, { "regex": "^\\$krb5asrep\\$18\\$[^:]+:[a-f0-9]{32,32}\\$[a-f0-9]{64,40960}$", "modes": [ { "john": "krb5asrep", "hashcat": null, "extended": false, "name": "Kerberos 5 AS-REP etype 18" } ] }, { "regex": "^\\$krb5asrep\\$17\\$[^:]+:[a-f0-9]{32,32}\\$[a-f0-9]{64,40960}$", "modes": [ { "john": "krb5asrep", "hashcat": null, "extended": false, "name": "Kerberos 5 AS-REP etype 17" } ] }, { "regex": "^\\$krb5tgs\\$17\\$[^$]{1,512}\\$[^$]{1,512}\\$[^$]{1,4}?\\$?[a-f0-9]{1,32}\\$[a-f0-9]{64,40960}$", "modes": [ { "john": null, "hashcat": 19600, "extended": false, "name": "Kerberos 5 TGS-REP etype 17 (AES128-CTS-HMAC-SHA1-96)" } ] }, { "regex": "^\\$krb5tgs\\$18\\$[^$]{1,512}\\$[^$]{1,512}\\$[^$]{1,4}?\\$?[a-f0-9]{1,32}\\$[a-f0-9]{64,40960}$", "modes": [ { "john": null, "hashcat": 19700, "extended": false, "name": "Kerberos 5 TGS-REP etype 18 (AES256-CTS-HMAC-SHA1-96)" } ] }, { "regex": "^\\$krb5pa\\$17\\$[^$]{1,512}\\$[^$]{1,512}\\$[a-f0-9]{104,112}$", "modes": [ { "john": "krb5pa-sha1", "hashcat": 19800, "extended": false, "name": "Kerberos 5 AS-REQ Pre-Auth etype 17" } ] }, { "regex": "^\\$krb5pa\\$18\\$[^$]{1,512}\\$[^$]{1,512}\\$[a-f0-9]{104,112}$", "modes": [ { "john": "krb5pa-sha1", "hashcat": 19900, "extended": false, "name": "Kerberos 5 AS-REQ Pre-Auth etype 18" } ] }, { "regex": "^\\$scram\\$[0-9]+\\$[a-z0-9\\/.]{16}\\$sha-1=[a-z0-9\\/.]{27},sha-256=[a-z0-9\\/.]{43},sha-512=[a-z0-9\\/.]{86}$", "modes": [ { "john": null, "hashcat": null, "extended": false, "name": "SCRAM Hash" } ] }, { "regex": "^[a-f0-9]{40}:[a-f0-9]{0,32}$", "modes": [ { "john": null, "hashcat": 4521, "extended": false, "name": "Redmine", "samples": [ "c18e826af2a78c7b9b7261452613233417e65817:28246535720688452723483475753333" ] } ] }, { "regex": "^(.+)?\\$[a-f0-9]{16}$", "modes": [ { "john": "sapb", "hashcat": 7700, "extended": false, "name": "SAP CODVN B (BCODE)" } ] }, { "regex": "^(.+)?\\$[a-f0-9]{40}$", "modes": [ { "john": "sapg", "hashcat": 7800, "extended": false, "name": "SAP CODVN F/G (PASSCODE)" } ] }, { "regex": "^(.+\\$)?[a-z0-9\\/.+]{30}(:.+)?$", "modes": [ { "john": "md5ns", "hashcat": 22, "extended": false, "name": "Juniper Netscreen/SSG(ScreenOS)" } ] }, { "regex": "^0x[a-f0-9]{60}\\s0x[a-f0-9]{40}$", "modes": [ { "john": null, "hashcat": 123, "extended": false, "name": "EPi", "samples": [ "0x326C6D7B4E4F794B79474E36704F35723958397163735263516265456E31 0xAFC55E260B8F45C0C6512BCE776C1AD8312B56E6" ] } ] }, { "regex": "^[a-f0-9]{40}:[^*]{1,25}$", "modes": [ { "john": null, "hashcat": 121, "extended": false, "name": "SMF \u2265 v1.1" } ] }, { "regex": "^(\\$wbb3\\$\\*1\\*)?[a-f0-9]{40}[:*][a-f0-9]{40}$", "modes": [ { "john": "wbb3", "hashcat": 8400, "extended": false, "name": "Woltlab Burning Board 3.x" } ] }, { "regex": "^[a-f0-9]{130}(:[a-f0-9]{40})?$", "modes": [ { "john": null, "hashcat": 7300, "extended": false, "name": "IPMI2 RAKP HMAC-SHA1" } ] }, { "regex": "^[a-f0-9]{32}:[0-9]+:[a-z0-9_.+\\-]+@[a-z0-9\\-]+\\.[a-z0-9\\-.]+$", "modes": [ { "john": null, "hashcat": 6800, "extended": false, "name": "Lastpass" } ] }, { "regex": "^[a-z0-9\\/.]{16}([:$].{1,})?$", "modes": [ { "john": "asa-md5", "hashcat": 2410, "extended": false, "name": "Cisco-ASA(MD5)" }, { "john": "dynamic_20", "hashcat": 2410, "extended": true, "name": "md5($pass.$salt)" } ] }, { "regex": "^\\$vnc\\$\\*[a-f0-9]{32}\\*[a-f0-9]{32}$", "modes": [ { "john": "vnc", "hashcat": null, "extended": false, "name": "VNC" } ] }, { "regex": "^[a-z0-9]{32}(:([a-z0-9\\-]+\\.)?[a-z0-9\\-.]+\\.[a-z]{2,7}:.+:[0-9]+)?$", "modes": [ { "john": null, "hashcat": 8300, "extended": false, "name": "DNSSEC(NSEC3)" } ] }, { "regex": "^(user-.+:)?\\$racf\\$\\*.+\\*[a-f0-9]{16}$", "modes": [ { "john": "racf", "hashcat": 8500, "extended": false, "name": "RACF" } ] }, { "regex": "^\\$3\\$\\$[a-f0-9]{32}$", "modes": [ { "john": null, "hashcat": null, "extended": false, "name": "NTHash(FreeBSD Variant)" } ] }, { "regex": "^\\$sha1\\$[0-9]+\\$[a-z0-9\\/.]{0,64}\\$[a-z0-9\\/.]{28}$", "modes": [ { "john": "sha1crypt", "hashcat": 15100, "extended": false, "name": "SHA-1 Crypt (Juniper/NetBSD)", "samples": [ "$sha1$20000$75552156$HhYMDdaEHiK3eMIzTldOFPnw.s2Q", "$sha1$64000$wnUR8T1U$azjCegpOIk0FjE61qzGWhdkpuMRL" ] } ] }, { "regex": "^[a-f0-9]{70}$", "modes": [ { "john": "hmailserver", "hashcat": 1421, "extended": false, "name": "hMailServer" } ] }, { "regex": "^[:\\$][AB][:\\$]([a-f0-9]{1,8}[:\\$])?[a-f0-9]{32}$", "modes": [ { "john": "mediawiki", "hashcat": 3711, "extended": false, "name": "MediaWiki" } ] }, { "regex": "^[a-f0-9]{140}$", "modes": [ { "john": null, "hashcat": null, "extended": false, "name": "Minecraft(xAuth)" } ] }, { "regex": "^\\$pbkdf2(-hmac)?(-sha1)?\\$([0-9]{1,6}\\$[a-z0-9\\/.]+\\$[a-z0-9\\/.]+|[0-9]{1,6}\\.[a-f0-9]+\\.[a-f0-9]{40})$", "modes": [ { "john": "pbkdf2-hmac-sha1", "hashcat": 20400, "extended": false, "name": "PBKDF2-SHA1 (Generic)", "samples": [ "$pbkdf2$131000$r5WythYixPgfQ2jt3buXcg$8Kdr.QQEOaZIXNOrrru36I/.6Po", "$pbkdf2-hmac-sha1$1000.fd11cde0.27de197171e6d49fc5f55c9ef06c0d8751cd7250", "$pbkdf2-hmac-sha1$1000$6926d45e$231c561018a4cee662df7cd4a8206701c5806af9", "$pbkdf2-hmac-sha1$1000.6834476f733353333654315a5a31494f.1932a843a69dc1e38a29d2691a7abf27ecaa6d55", "$pbkdf2-hmac-sha1$1000.3031323334353637383930313233343536373839303132333435363738393031323334353637383930313233343536373839303132333435363738393031323334353637383930313233343536373839303132333435363738393031323334353637383930313233343536373839303132333435363738393031323334353637383930313233343536373839303132333435363738393031323334353637383930313233343536373839303132333435363738.8f7c89f74233f78f6c8ace00696cf6ed09ae43f4" ] } ] }, { "regex": "^\\$pbkdf2-sha256\\$[0-9]{1,6}\\$[a-z0-9\\/.]+\\$[a-z0-9\\/.]+$", "modes": [ { "john": "pbkdf2-hmac-sha256", "hashcat": 20300, "extended": false, "name": "PBKDF2-SHA256 (Generic)", "samples": [ "$pbkdf2-sha256$29000$x9h7j/Ge8x6DMEao1VqrdQ$kra3R1wEnY8mPdDWOpTqOTINaAmZvRMcYd8u5OBQP9A", "$pbkdf2-sha256$1000$b1dWS2dab3dKQWhPSUg3cg$UY9j5wlyxtsJqhDKTqua8Q3fMp0ojc2pOnErzr8ntLE", "$pbkdf2-sha256$12000$fK8VAoDQuvees5ayVkpp7Q$xfzKAoBR/Iaa68tjn.O8KfGxV.zdidcqEeDoTFvDz2A", "$pbkdf2-sha256$12000$MDEyMzQ1Njc4OTAxMjM0NTY3ODkwMTIzNDU2Nzg5MDEyMzQ1Njc4OTAxMjM0NTY3ODkwMTIzNDU2Nzg5MDEyMzQ1Njc4OTAxMjM0NTY3ODkwMTIzNDU2Nzg5MDEyMzQ1Njc4OTAxMjM0NTY3ODkwMTIzNDU2Nzg5MDEyMzQ1Njc4OTAxMjM0NTY3ODkwMTIzNDU2Nzg5MDEyMzQ1Njc4OTAxMjM0NTY3ODkwMTIzNDU2Nzg$94Z71JhWYUP2E0IrQrexc8AMhHzVB4bwkxh7n0FCnns" ] } ] }, { "regex": "^\\$pbkdf2-sha512\\$[0-9]+\\$[a-z0-9\\/.]+\\$[a-z0-9\\/.]{86}$", "modes": [ { "john": null, "hashcat": null, "extended": false, "name": "PBKDF2-SHA512(Generic)" } ] }, { "regex": "^\\$p5k2\\$[0-9]+\\$[a-z0-9\\/+=\\-]+\\$[a-z0-9\\/+\\-]{27}=$", "modes": [ { "john": null, "hashcat": null, "extended": false, "name": "PBKDF2(Cryptacular)" } ] }, { "regex": "^\\$p5k2\\$[0-9]+\\$[a-z0-9\\/.]+\\$[a-z0-9\\/.]{32}$", "modes": [ { "john": null, "hashcat": null, "extended": false, "name": "PBKDF2(Dwayne Litzenberger)" } ] }, { "regex": "^{FSHP[0123]\\|[0-9]+\\|[0-9]+}[a-z0-9\\/+=]+$", "modes": [ { "john": null, "hashcat": null, "extended": false, "name": "Fairly Secure Hashed Password" } ] }, { "regex": "^\\$PHPS\\$.+\\$[a-f0-9]{32}$", "modes": [ { "john": "phps", "hashcat": 2612, "extended": false, "name": "PHPS" } ] }, { "regex": "^[0-9]{4}:[a-f0-9]{16}:[a-f0-9]{2080}$", "modes": [ { "john": null, "hashcat": 6600, "extended": false, "name": "1Password(Agile Keychain)" } ] }, { "regex": "^[a-f0-9]{64}:[a-f0-9]{32}:[0-9]{5}:[a-f0-9]{608}$", "modes": [ { "john": null, "hashcat": 8200, "extended": false, "name": "1Password(Cloud Keychain)" } ] }, { "regex": "^[a-f0-9]{256}:[a-f0-9]{256}:[a-f0-9]{16}:[a-f0-9]{16}:[a-f0-9]{320}:[a-f0-9]{16}:[a-f0-9]{40}:[a-f0-9]{40}:[a-f0-9]{32}$", "modes": [ { "john": null, "hashcat": 5300, "extended": false, "name": "IKE-PSK MD5" } ] }, { "regex": "^[a-f0-9]{256}:[a-f0-9]{256}:[a-f0-9]{16}:[a-f0-9]{16}:[a-f0-9]{320}:[a-f0-9]{16}:[a-f0-9]{40}:[a-f0-9]{40}:[a-f0-9]{40}$", "modes": [ { "john": null, "hashcat": 5400, "extended": false, "name": "IKE-PSK SHA1" } ] }, { "regex": "^[a-z0-9\\/+]{27}=$", "modes": [ { "john": null, "hashcat": 133, "extended": false, "name": "PeopleSoft" } ] }, { "regex": "^crypt\\$[a-f0-9]{5}\\$[a-z0-9\\/.]{13}$", "modes": [ { "john": null, "hashcat": null, "extended": false, "name": "Django(DES Crypt Wrapper)" } ] }, { "regex": "^(\\$django\\$\\*1\\*)?pbkdf2_sha256\\$[0-9]+\\$[a-z0-9]+\\$[a-z0-9\\/+=]{44}$", "modes": [ { "john": "django", "hashcat": 10000, "extended": false, "name": "Django (PBKDF2-HMAC-SHA256)" } ] }, { "regex": "^pbkdf2_sha1\\$[0-9]+\\$[a-z0-9]+\\$[a-z0-9\\/+=]{28}$", "modes": [ { "john": null, "hashcat": null, "extended": false, "name": "Django(PBKDF2-HMAC-SHA1)" } ] }, { "regex": "^bcrypt(\\$2[axy]|\\$2)\\$[0-9]{2}\\$[a-z0-9\\/.]{53}$", "modes": [ { "john": null, "hashcat": null, "extended": false, "name": "Django(bcrypt)" } ] }, { "regex": "^md5\\$[a-f0-9]+\\$[a-f0-9]{32}$", "modes": [ { "john": null, "hashcat": null, "extended": false, "name": "Django(MD5)" } ] }, { "regex": "^\\{PKCS5S2\\}[a-z0-9\\/+]{64}$", "modes": [ { "john": null, "hashcat": null, "extended": false, "name": "PBKDF2(Atlassian)" } ] }, { "regex": "^md5[a-f0-9]{32}$", "modes": [ { "john": null, "hashcat": null, "extended": false, "name": "PostgreSQL MD5" } ] }, { "regex": "^\\([a-z0-9\\/+]{49}\\)$", "modes": [ { "john": null, "hashcat": 9100, "extended": false, "name": "Lotus Notes/Domino 8" } ] }, { "regex": "^SCRYPT:[0-9]{1,}:[0-9]{1}:[0-9]{1}:[a-z0-9:\\/+=]{1,}$", "modes": [ { "john": null, "hashcat": 8900, "extended": false, "name": "scrypt" } ] }, { "regex": "^\\$8\\$[a-z0-9\\/.]{14}\\$[a-z0-9\\/.]{43}$", "modes": [ { "john": "cisco8", "hashcat": 9200, "extended": false, "name": "Cisco Type 8" } ] }, { "regex": "^\\$9\\$[a-z0-9\\/.]{14}\\$[a-z0-9\\/.]{43}$", "modes": [ { "john": "cisco9", "hashcat": 9300, "extended": false, "name": "Cisco Type 9" } ] }, { "regex": "^\\$office\\$\\*2007\\*[0-9]{2}\\*[0-9]{3}\\*[0-9]{2}\\*[a-z0-9]{32}\\*[a-z0-9]{32}\\*[a-z0-9]{40}$", "modes": [ { "john": "office", "hashcat": 9400, "extended": false, "name": "Microsoft Office 2007" } ] }, { "regex": "^\\$office\\$\\*2010\\*[0-9]{6}\\*[0-9]{3}\\*[0-9]{2}\\*[a-z0-9]{32}\\*[a-z0-9]{32}\\*[a-z0-9]{64}$", "modes": [ { "john": "office", "hashcat": 9500, "extended": false, "name": "Microsoft Office 2010" } ] }, { "regex": "^\\$office\\$\\*2013\\*[0-9]{6}\\*[0-9]{3}\\*[0-9]{2}\\*[a-z0-9]{32}\\*[a-z0-9]{32}\\*[a-z0-9]{64}$", "modes": [ { "john": "office", "hashcat": 9600, "extended": false, "name": "Microsoft Office 2013 - 2019" } ] }, { "regex": "^\\$office\\$2016\\$[0-9]\\$[0-9]{6}\\$[^$]{24}\\$[^$]{88}$", "modes": [ { "john": null, "hashcat": 25300, "extended": false, "name": "Microsoft Office 2016 - SheetProtection", "samples": [ "$office$2016$0$100000$876MLoKTq42+/DLp415iZQ==$TNDvpvYyvlSUy97UOLKNhXynhUDDA7H8kLql0ISH5SxcP6hbthdjaTo4Z3/MU0dcR2SAd+AduYb3TB5CLZ8+ow==" ] } ] }, { "regex": "^\\$fde\\$[0-9]{2}\\$[a-f0-9]{32}\\$[0-9]{2}\\$[a-f0-9]{32}\\$[a-f0-9]{3072}$", "modes": [ { "john": "fde", "hashcat": 8800, "extended": false, "name": "Android FDE \u2264 4.3" } ] }, { "regex": "^\\$oldoffice\\$[01]\\*[a-f0-9]{32}\\*[a-f0-9]{32}\\*[a-f0-9]{32}$", "modes": [ { "john": "oldoffice", "hashcat": 9700, "extended": false, "name": "Microsoft Office \u2264 2003 (MD5+RC4)" }, { "john": "oldoffice", "hashcat": 9710, "extended": false, "name": "Microsoft Office \u2264 2003 (MD5+RC4) collider-mode #1" }, { "john": "oldoffice", "hashcat": 9720, "extended": false, "name": "Microsoft Office \u2264 2003 (MD5+RC4) collider-mode #2" } ] }, { "regex": "^\\$oldoffice\\$[34]\\*[a-f0-9]{32}\\*[a-f0-9]{32}\\*[a-f0-9]{40}$", "modes": [ { "john": "oldoffice", "hashcat": 9800, "extended": false, "name": "Microsoft Office \u2264 2003 (SHA1+RC4)" }, { "john": "oldoffice", "hashcat": 9810, "extended": false, "name": "Microsoft Office \u2264 2003 (SHA1+RC4) collider-mode #1" }, { "john": "oldoffice", "hashcat": 9820, "extended": false, "name": "Microsoft Office \u2264 2003 (SHA1+RC4) collider-mode #2" } ] }, { "regex": "^(\\$radmin2\\$)?[a-f0-9]{32}$", "modes": [ { "john": "radmin", "hashcat": 9900, "extended": false, "name": "RAdmin v2.x" } ] }, { "regex": "^{x-issha,\\s[0-9]{4}}[a-z0-9\\/+=]+$", "modes": [ { "john": "saph", "hashcat": 10300, "extended": false, "name": "SAP CODVN H (PWDSALTEDHASH) iSSHA-1" } ] }, { "regex": "^\\$cram_md5\\$[a-z0-9\\/+=\\-]+\\$[a-z0-9\\/+=\\-]{52}$", "modes": [ { "john": null, "hashcat": 10200, "extended": false, "name": "CRAM-MD5" } ] }, { "regex": "^[a-f0-9]{16}:2:4:[a-f0-9]{32}$", "modes": [ { "john": null, "hashcat": 10100, "extended": false, "name": "SipHash" } ] }, { "regex": "^[a-f0-9]{4,}$", "modes": [ { "john": null, "hashcat": null, "extended": true, "name": "Cisco Type 7" } ] }, { "regex": "^[a-z0-9\\/.]{13,}$", "modes": [ { "john": "bigcrypt", "hashcat": null, "extended": true, "name": "BigCrypt" } ] }, { "regex": "^(\\$cisco4\\$)?[a-z0-9\\/.]{43}$", "modes": [ { "john": "cisco4", "hashcat": null, "extended": false, "name": "Cisco Type 4" } ] }, { "regex": "^bcrypt_sha256\\$\\$(2[axy]|2)\\$[0-9]+\\$[a-z0-9\\/.]{53}$", "modes": [ { "john": null, "hashcat": null, "extended": false, "name": "Django(bcrypt-SHA256)" } ] }, { "regex": "^\\$postgres\\$.[^\\*]+[*:][a-f0-9]{1,32}[*:][a-f0-9]{32}$", "modes": [ { "john": "postgres", "hashcat": 11100, "extended": false, "name": "PostgreSQL Challenge-Response Authentication (MD5)" } ] }, { "regex": "^\\$siemens-s7\\$[0-9]{1}\\$[a-f0-9]{40}\\$[a-f0-9]{40}$", "modes": [ { "john": "siemens-s7", "hashcat": null, "extended": false, "name": "Siemens-S7" } ] }, { "regex": "^(\\$pst\\$)?[a-f0-9]{8}$", "modes": [ { "john": null, "hashcat": null, "extended": false, "name": "Microsoft Outlook PST" } ] }, { "regex": "^sha256[:$][0-9]+[:$][a-z0-9\\/+]+[:$][a-z0-9\\/+]{32,128}$", "modes": [ { "john": null, "hashcat": 10900, "extended": false, "name": "PBKDF2-HMAC-SHA256 (PHP)", "samples": [ "sha256:1000:NjI3MDM3:vVfavLQL9ZWjg8BUMq6/FB8FtpkIGWYk" ] } ] }, { "regex": "^(\\$dahua\\$)?[a-z0-9]{8}$", "modes": [ { "john": "dahua", "hashcat": 24900, "extended": false, "name": "Dahua (MD5 Authentication)", "samples": [ "GRuHbyVp", "$dahua$4WzwxXxM" ] } ] }, { "regex": "^[a-z0-9]{8}(?::[a-z0-9]{8})?$", "modes": [ { "john": null, "hashcat": 25700, "extended": false, "name": "MurmurHash", "samples": [ "b69e7687:05094309" ] }, { "john": null, "hashcat": 27800, "extended": false, "name": "MurmurHash3", "samples": [ "23e93f65:00000000" ] } ] }, { "regex": "^\\$mysqlna\\$[a-f0-9]{40}[:*][a-f0-9]{40}$", "modes": [ { "john": null, "hashcat": 11200, "extended": false, "name": "MySQL Challenge-Response Authentication (SHA1)" } ] }, { "regex": "^\\$pdf\\$1\\*2\\*[0-9]{2}\\*[-0-9]{1,6}\\*[0-9]\\*[0-9]{2}\\*[a-f0-9]{32}\\*[0-9]{2}\\*[a-f0-9]{64}\\*[0-9]{2}\\*[a-f0-9]{64}$", "modes": [ { "john": "pdf", "hashcat": 10400, "extended": false, "name": "PDF 1.1 - 1.3 (Acrobat 2 - 4)" }, { "john": "pdf", "hashcat": 10410, "extended": false, "name": "PDF 1.1 - 1.3 (Acrobat 2 - 4), collider #1" } ] }, { "regex": "^\\$pdf\\$1\\*2\\*[0-9]{2}\\*[-0-9]{1,6}\\*[0-9]\\*[0-9]{2}\\*[a-f0-9]{32}\\*[0-9]{2}\\*[a-f0-9]{64}\\*[0-9]{2}\\*[a-f0-9]{64}:[a-f0-9]{10}$", "modes": [ { "john": "pdf", "hashcat": 10420, "extended": false, "name": "PDF 1.1 - 1.3 (Acrobat 2 - 4), collider #2" } ] }, { "regex": "^\\$pdf\\$[24]\\*[34]\\*128\\*[0-9\\-]{1,6}\\*1\\*(16|32)\\*[a-f0-9]{32,64}\\*32\\*[a-f0-9]{64}\\*(8|16|32)\\*[a-f0-9]{16,64}$", "modes": [ { "john": "pdf", "hashcat": 10500, "extended": false, "name": "PDF 1.4 - 1.6 (Acrobat 5 - 8)", "samples": [ "$pdf$2*3*128*-4*1*16*62888255846156252261477183186121*32*6879919b1afd520bd3b7dbcc0868a0a500000000000000000000000000000000*32*0000000000000000000000000000000000000000000000000000000000000000" ] }, { "john": "pdf", "hashcat": 25400, "extended": false, "name": "PDF 1.4 - 1.6 (Acrobat 5 - 8) - edit password", "samples": [ "$pdf$2*3*128*-3904*1*16*631ed33746e50fba5caf56bcc39e09c6*32*5f9d0e4f0b39835dace0d306c40cd6b700000000000000000000000000000000*32*842103b0a0dc886db9223b94afe2d7cd63389079b61986a4fcf70095ad630c24" ] } ] }, { "regex": "^\\$pdf\\$5\\*[5|6]\\*[0-9]{3}\\*[-0-9]{1,6}\\*[0-9]\\*[0-9]{1,4}\\*[a-f0-9]{0,1024}\\*[0-9]{1,4}\\*[a-f0-9]{0,1024}\\*[0-9]{1,4}\\*[a-f0-9]{0,1024}\\*[0-9]{1,4}\\*[a-f0-9]{0,1024}\\*[0-9]{1,4}\\*[a-f0-9]{0,1024}$", "modes": [ { "john": "pdf", "hashcat": 10600, "extended": false, "name": "PDF 1.7 Level 3 (Acrobat 9)" }, { "john": "pdf", "hashcat": 10700, "extended": false, "name": "PDF 1.7 Level 8 (Acrobat 10 - 11)" } ] }, { "regex": "^\\$bitcoin\\$[0-9]{2,4}\\$[a-f0-9$]{250,360}$", "modes": [ { "john": "bitcoin", "hashcat": 11300, "extended": false, "name": "Bitcoin/Litecoin Wallet", "samples": [ "$bitcoin$96$c265931309b4a59307921cf054b4ec6b6e4554369be79802e94e16477645777d948ae1d375191831efc78e5acd1f0443$16$8017214013543185$200460$96$480008005625057442352316337722323437108374245623701184230273883222762730232857701607167815448714$66$014754433300175043011633205413774877455616682000536368706315333388", "$bitcoin$96$c265931309b4a59307921cf054b4ec6b6e4554369be79802e94e16477645777d948ae1d375191831efc78e5acd1f0443$16$8017214013543185$200460$96$480008005625057442352316337722323437108374245623701184230273883222762730232857701607167815448714$66$014754433300175043011633205413774877455616682000536368706315333388", "$bitcoin$96$a8d2a30b9a5419934cbb7cb0727ddc16c4bebdbf30d7e099ca35f2b1b7ba04cc42eb5b865bff8f65fc6ba9e15428d84f$16$872581181d72f577$128205$96$0a8d43558ed2b55f4a53491df66e6a71003db4588d11dc0a88b976122c2849a74c2bfaace36424cf029795db6fd2c78f$130$04ff53a6f68eab1c52e5b561b4616edb5bed4d7510cdb4931c8da68732a86d86f3a3f7de266f17c8d03e02ebe8e2c86e2f5de0007217fd4aaf5742ca7373113060" ] } ] }, { "regex": "^\\$ethereum\\$[a-z0-9*]{150,1400}$", "modes": [ { "john": "ethereum-presale-opencl", "hashcat": 16300, "extended": false, "name": "Ethereum Presale Wallet" } ] }, { "regex": "^\\$ethereum\\$[a-z0-9*]{150,250}$", "modes": [ { "john": "Ethereum Wallet", "hashcat": 15600, "extended": false, "name": "ethereum-opencl" } ] }, { "regex": "^\\$monero\\$(0)\\*[a-f0-9]{32,4096}$", "modes": [ { "john": "monero", "hashcat": null, "extended": false, "name": "monero Wallet" } ] }, { "regex": "^\\$ab\\$[0-9]{1}\\*[0-9]{1}\\*[0-9]{1,6}\\*[a-f0-9]{128}\\*[a-f0-9]{128}\\*[a-f0-9]{32}\\*[a-f0-9]{192}$", "modes": [ { "john": "AndroidBackup", "hashcat": 18900, "extended": false, "name": "Android Backup" } ] }, { "regex": "^\\$zip2\\$\\*[0-9]{1}\\*[0-9]{1}\\*[0-9]{1}\\*[a-f0-9]{16,32}\\*[a-f0-9]{1,6}\\*[a-f0-9]{1,6}\\*[a-f0-9]{0,16384}\\*[a-f0-9]{20}\\*\\$\/zip2\\$$", "modes": [ { "john": "zip", "hashcat": 13600, "extended": false, "name": "WinZip" } ] }, { "regex": "^\\$itunes_backup\\$\\*[0-9]{1,2}\\*[a-f0-9]{80}\\*[0-9]{1,6}\\*[a-f0-9]{40}\\*[0-9]{0,10}\\*[a-f0-9]{0,40}$", "modes": [ { "john": "itunes-backup", "hashcat": 14700, "extended": false, "name": "iTunes backup < 10.0" }, { "john": "itunes-backup", "hashcat": 14800, "extended": false, "name": "iTunes backup >= 10.0" } ] }, { "regex": "^\\$telegram\\$0\\*[a-f0-9]{64}\\*[0-9]{32}$", "modes": [ { "john": null, "hashcat": 22301, "extended": false, "name": "Telegram Mobile App Passcode (SHA256)" } ] }, { "regex": "^\\$telegram\\$1\\*4000\\*[a-f0-9]{64}\\*[a-f0-9]{576}$", "modes": [ { "john": "telegram", "hashcat": null, "extended": false, "name": "Telegram Desktop 1.3.9" } ] }, { "regex": "^\\$telegram\\$2\\*100000\\*[a-f0-9]{64}\\*[a-f0-9]{576}$", "modes": [ { "john": "telegram", "hashcat": 24500, "extended": false, "name": "Telegram Desktop \u2265 2.1.14-beta / 2.2.0", "samples": [ "$telegram$2*100000*77461dcb457ce9539f8e4235d33bd12455b4a38446e63b52ecdf2e7b65af4476*f705dda3247df6d690dfc7f44d8c666979737cae9505d961130071bcc18eeadaef0320ac6985e4a116834c0761e55314464aae56dadb8f80ab8886c16f72f8b95adca08b56a60c4303d84210f75cfd78a3e1a197c84a747988ce2e1b247397b61041823bdb33932714ba16ca7279e6c36b75d3f994479a469b50a7b2c7299a4d7aadb775fb030d3bb55ca77b7ce8ac2f5cf5eb7bdbcc10821b8953a4734b448060246e5bb93f130d6d3f2e28b9e04f2a064820be562274c040cd849f1473d45141559fc45da4c54abeaf5ca40d2d57f8f8e33bdb232c7279872f758b3fb452713b5d91c855383f7cec8376649a53b83951cf8edd519a99e91b8a6cb90153088e35d9fed332c7253771740f49f9dc40c7da50352656395bbfeae63e10f754d24a", "$telegram$2*100000*0970f6c043d855aa895703b8a1cc086109cf081f72a77b6504f7f4bf3db06420*129294a5eac3196a4c9a88e556f7507b0957f6dd45d704db8abe607ec6d807270c02635289056256a6044a6408e7ef5d33f98c561f16f8aedd2b3ae33ddffddc63c8584dcb232c9f610953f461adb8d29da83f2b01e32db98101febffae4072703bfbfd492e1dd6abeb0926d3df2ed3b47dee4eb6c9f42ab657f89f19d7314c07e2ffc843e448c6d324e9f8d2c3e877a25b0b153736fddb35f5205737620ba2f96aa47f799366150b4de89a0c6e12caa4f03553d164ce9e2e975aadc83538e6ae3df93acb6026f97ac9f6f017a6bbc6607767e591b2c732e3c0ac844584c69dae89ca3272c996eb83b4e66976e3851cfc89be11dc602bb8c0cdf578d9a0a9dbc2296888fa5ee7e58d985a9bf9a1dbc75d2ddfd6ce222c5ee9f3bb40f6e25c2cd" ] } ] }, { "regex": "^\\$7z\\$[0-9]{1,3}\\$[0-9]{1,2}\\$[0-9]{1}\\$[^$]{0,64}\\$[0-9]{1,2}\\$[a-f0-9]{32}\\$[0-9]{1,10}\\$[0-9]{1,6}\\$[0-9]{1,6}\\$[a-f0-9]{2,}$", "modes": [ { "john": "7z", "hashcat": 11600, "extended": false, "name": "7-zip" } ] }, { "regex": "^\\$zip3\\$\\*[0-9]\\*[0-9]\\*128\\*[0-9]\\*[a-f0-9]{0,32}\\*[a-f0-9]{288}\\*[0-9]\\*[0-9]\\*[0-9]\\*[^\\s]{0,64}$", "modes": [ { "john": "securezip", "hashcat": 23001, "extended": false, "name": "SecureZIP AES-128" } ] }, { "regex": "^\\$zip3\\$\\*[0-9]\\*[0-9]\\*192\\*[0-9]\\*[a-f0-9]{0,32}\\*[a-f0-9]{288}\\*[0-9]\\*[0-9]\\*[0-9]\\*[^\\s]{0,64}$", "modes": [ { "john": "securezip", "hashcat": 23002, "extended": false, "name": "SecureZIP AES-192" } ] }, { "regex": "^\\$zip3\\$\\*[0-9]\\*[0-9]\\*256\\*[0-9]\\*[a-f0-9]{0,32}\\*[a-f0-9]{288}\\*[0-9]\\*[0-9]\\*[0-9]\\*[^\\s]{0,64}$", "modes": [ { "john": "securezip", "hashcat": 23003, "extended": false, "name": "SecureZIP AES-256" } ] }, { "regex": "^\\$pkzip2?\\$[a-f0-9\\*]+\\$\/pkzip2?\\$$", "modes": [ { "john": "pkzip", "hashcat": null, "extended": false, "name": "PKZIP" } ] }, { "regex": "^\\$argon2d\\$v=19\\$m=[0-9]{1,6},t=[0-9]{1,2},p=[0-9]{1,2}\\$[^$]+\\$[^\\s]{6,}$", "modes": [ { "john": "argon2", "hashcat": null, "extended": false, "name": "argon2d", "samples": [ "$argon2d$v=19$m=4096,t=3,p=1$ZGFtYWdlX2RvbmU$w9w3s5/zV8+PcAZlJhnTCOE+vBkZssmZf6jOq3dKv50", "$argon2d$v=19$m=4096,t=3,p=1$c2hvcnRfc2FsdA$zMrTcOAOUje6UqObRVh84Pe1K6gumcDqqGzRM0ILzYmj", "$argon2d$v=19$m=16384,t=3,p=1$c2hvcnRfc2FsdA$TLSTPihIo+5F67Y1vJdfWdB9", "$argon2d$v=19$m=16384,t=4,p=3$YW5vdGhlcl9zYWx0$yw93eMxC8REPAwbQ0e/q43jR9+RI9HI/DHP75uzm7tQfjU734oaI3dzcMWjYjHzVQD+J4+MG+7oyD8dN/PtnmPCZs+UZ67E+rkXJ/wTvY4WgXgAdGtJRrAGxhy4rD7d5G+dCpqhrog" ] } ] }, { "regex": "^\\$argon2i\\$v=19\\$m=[0-9]{1,6},t=[0-9]{1,2},p=[0-9]{1,2}\\$[^$]+\\$[^\\s]{6,}$", "modes": [ { "john": "argon2", "hashcat": null, "extended": false, "name": "argon2i", "samples": [ "$argon2i$v=19$m=4096,t=3,p=1$ZGFtYWdlX2RvbmU$N59QwnpxDQZRj1/cO6bqm408dD6Z2Z9LKYpwFJSPVKA", "$argon2i$v=19$m=4096,t=3,p=1$c2hvcnRfc2FsdA$1l4kAwUdAApoCbFH7ghBEf7bsdrOQzE4axIJ3PV0Ncrd", "$argon2i$v=19$m=16384,t=3,p=1$c2hvcnRfc2FsdA$vvjDVog22A5x9eljmB+2yC8y", "$argon2i$v=19$m=16384,t=4,p=3$YW5vdGhlcl9zYWx0$K7unxwO5aeuZCpnIJ06FMCRKod3eRg8oIRzQrK3E6mGbyqlTvvl47jeDWq/5drF1COJkEF9Ty7FWXJZHa+vqlf2YZGp/4qSlAvKmdtJ/6JZU32iQItzMRwcfujHE+PBjbL5uz4966A" ] } ] }, { "regex": "^\\$argon2id\\$v=19\\$m=[0-9]{1,6},t=[0-9]{1,2},p=[0-9]{1,2}\\$[^$]+\\$[^\\s]{6,}$", "modes": [ { "john": null, "hashcat": null, "extended": false, "name": "argon2id" } ] }, { "regex": "^\\$axcrypt\\$\\*2\\*[0-9]{1,7}\\*[a-f0-9]{128}\\*[a-f0-9]{288}\\*[0-9]{1,7}\\*[a-f0-9]{64}$", "modes": [ { "john": "axcrypt", "hashcat": 23500, "extended": false, "name": "AxCrypt 2", "samples": [ "$axcrypt$*2*10000*6d44c6d19076bce9920c5fb76b246c161926ce65abb93ec2003919d78898aadd5bc6e5754201ff25d681ad89fa2861d20ef7c3fd7bde051909dfef8adcb50491*68f78a1b80291a42b2a117d6209d3eb3541a8d47ed6b970b2b8294b2bc78347fc2b494a0599f8cba6d45e88fd8fbc5b4dd7e888f6c9543e679489de132167222e130d5925278693ad8599284705fdf99360b2199ed0005be05867b9b7aa6bb4be76f5f979819eb27cf590a47d81830575b2af09dda756360c844b89c7dcec099cfdd27d2d0c95d24f143405f303e4843*1000*debdeb8ea7b9800b01855de09b105fdb8840efc1f67dc742283d13a5570165f8", "$axcrypt$*2*28200*96fca6b5aff19cb540125e6452f1ab6e1cbf7097ad75326e7aa1726f687ed18e66a63295d735f458a138901be41d95d29ff760c7c4b4178320251f2ab0ecabd8*d1d90c425fd8e2d20b2aa7ef6f3ab9dcefad84917f9e07f65f8da61e7e84f490ba8007179718ce0033cbc887177c2b51ed00e88155741960ab667a5328f305969518bc436ee1ba28126a5be79b0b90f8a9c8a438cba9d0e59c0b6573cde124a8300a6fb01ff857485d302285f1eacd7f08d9cc70ec9fdf412b60bc5a728b5108ef8bda24caee5ab7cc4376951c080c6d*1000*fead8792ea352979ab19e7b287bf709f39df0706a7e460b5271d1ebc71014b3b", "$axcrypt$*2*23652*8817291e0611409390c50a8bdc99a98bf56d393174d7c177082391f7919ed392a701783790ad2eed49139ede2b1546dc4a9aaa142e2b2530b4c82cff03df18b1*2561a0c3f5e166c7273ea6fb59592a58b8d8235a379c82de39fc6d674291b6a25a268732c34eab1b092166ca4f9ef9e383325b90633896890f7dca4d29876ec5bb232ff89c8130aad917f93d9228a091a9996e1f14d4b130b5aad7516c11aa9143730d7b0ec8168b4d83bdd0ca1a9a36784572b9db992bd13289ecd577a421ded0576801e88c7275b2d5fa8eb7e540cb*1000*3dc38e68204a7060c3cd616ffcf6df17dbbb3c199e67ea85c7e29751b9ea2fc2" ] } ] }, { "regex": "^\\$axcrypt\\$\\*1\\*[0-9]{1,7}\\*[a-f0-9]{32}\\*[a-f0-9]{48}(?:\\*[a-z0-9]+)?$", "modes": [ { "john": "axcrypt", "hashcat": null, "extended": false, "name": "AxCrypt 1", "samples": [ "$axcrypt$*1*1337*0fd9e7e2f907f480f8af162564f8f94b*af10c88878ba4e2c89b12586f93b7802453121ee702bc362", "$axcrypt$*1*31014*3408ae91dddc0b1750ed4223fd843364*1cc0f8fa8d89f44d284d0562ac7e93848c86ce9605907129", "$axcrypt$*1*20000*efd759ae68ae7edd709b9e1c2166d0f7*dcf4c1279b8e4d39475925b17f698c3ce39e9e7d82917272*68656c6c6f0a", "$axcrypt$*1*38574*ce4f58c1e85df1ea921df6d6c05439b4*3278c3c730f7887b1008e852e59997e2196710a5c6bc1813*66664a6b2074434a4520374d73592055626979204a6b755520736d6b4b20394e694a205548444320524578562065674b33202f42593d" ] } ] }, { "regex": "^\\$rar5\\$[0-9]{2}\\$[a-f0-9]{32}\\$[0-9]{2}\\$[a-f0-9]{32}\\$[0-9]{1}\\$[a-f0-9]{16}$", "modes": [ { "john": "rar5", "hashcat": 13000, "extended": false, "name": "RAR5", "samples": [ "$rar5$16$38466361001011015181344360681307$15$00000000000000000000000000000000$8$cc7a30583e62676a", "$rar5$16$37526a0922b4adcc32f8fed5d51bb6c8$15$8955617d9b801def51d734095bb8ecdb$8$9f0b23c98ebb3653", "$rar5$16$ed9bd88cc649bd06bfd7dc418fcf5fbd$15$21771e718815d6f23073ea294540ce94$8$5c4361e549c999e1" ] } ] }, { "regex": "^\\$RAR3\\$\\*[0-9]{1}\\*[a-f0-9]{16}\\*[a-f0-9]{8}\\*[0-9]{1,7}\\*[0-9]{1,6}\\*[0-9]{1}\\*[a-f0-9]{2,}\\*[0-9]{2}$", "modes": [ { "john": "rar", "hashcat": 23700, "extended": false, "name": "RAR3 -p (Uncompressed)", "samples": [ "$RAR3$*1*e54a73729887cb53*49b0a846*16*14*1*34620bcca8176642a210b1051901921e*30", "$RAR3$*1*c47c5bef0bbd1e98*965f1453*48*47*1*c5e987f81d316d9dcfdb6a1b27105ce63fca2c594da5aa2f6fdf2f65f50f0d66314f8a09da875ae19d6c15636b65c815*30" ] }, { "john": "rar", "hashcat": 23800, "extended": false, "name": "RAR3 -p (Compressed)", "samples": [ "$RAR3$*1*ad56eb40219c9da2*834064ce*32*13*1*eb47b1abe17a1a75bce6c92ab1cef3f4126035ea95deaf08b3f32a0c7b8078e1*33", "$RAR3$*1*b4eee1a48dc95d12*965f1453*64*47*1*0fe529478798c0960dd88a38a05451f9559e15f0cf20b4cac58260b0e5b56699d5871bdcc35bee099cc131eb35b9a116adaedf5ecc26b1c09cadf5185b3092e6*33" ] } ] }, { "regex": "^\\$RAR3\\$\\*[0-9]{1}\\*[a-f0-9]{16}\\*[a-f0-9]{32}$", "modes": [ { "john": "rar", "hashcat": 12500, "extended": false, "name": "RAR3 -hp", "samples": [ "$RAR3$*0*45109af8ab5f297a*adbf6c5385d7a40373e8f77d7b89d317", "$RAR3$*0*7ce241baa2bd521b*3eb0017fa8843017952c53a3ac8332b6", "$RAR3$*0*c203c4d80a8a09dc*1f406154556d4c895a8be207fd2b5d0c" ] } ] }, { "regex": "^\\$uido\\$[a-f0-9]{32}\\$[a-f0-9]{40}\\$\\d{1,7}\\$[a-f0-9]{80}$", "modes": [ { "john": null, "hashcat": 26500, "extended": false, "name": "iPhone passcode (UID key + System Keybag)", "samples": [ "$uido$77889b1bca161ce876d976a102c7bf82$3090545724551425617156367874312887832777$50000$2d4c86b71c0c04129a47c6468e2437d1fecd88e232a7b15112d5364682dc391dbbbb921cf6e02664" ] } ] }, { "regex": "^\\$metamask\\$(?=.{44}\\$)(?:[a-z0-9+\\/]{4})*(?:|(?:[a-z0-9+\\/]{3}=)|(?:[a-z0-9+\\/]{2}==)|(?:[a-z0-9+\\/]{1}===))\\$(?=.{24}\\$)(?:[a-z0-9+\\/]{4})*(?:|(?:[a-z0-9+\\/]{3}=)|(?:[a-z0-9+\\/]{2}==)|(?:[a-z0-9+\\/]{1}===))\\$(?=.{64,})(?:[a-z0-9+\\/]{4})*(?:|(?:[a-z0-9+\\/]{3}=)|(?:[a-z0-9+\\/]{2}==)|(?:[a-z0-9+\\/]{1}===))$", "modes": [ { "john": null, "hashcat": 26600, "extended": false, "name": "MetaMask Wallet", "samples": [ "$metamask$AARgM5AgABE2eWgJcWAwQIAFmSYoASZVZBlAR4B0h2M=$8HrVMqsjfFTusMbegh+KWg==$7FPq7LjWe3t/TjDBtUwrJBpiG/Rdt+uf71dLCyUZd0pdtymBK6mSMZDyRfp/CzpjEPA1dU1BLDshcwM/1k6KdO//+mPWrgY4j49XTXIMnHNhJPfPv8s9rXiq8jLqetsStqtWmTZaD7fTtbzOYWR4gwQc98MxCnn/IrSnfCHungw1rLV5Xm0/hF7WfzFeEgcHknhJJP1xSeJCL9qI5DJ+lz7ksc0UVvHoiNJx8uvPBNkHpGQRNujwlnk=" ] } ] }, { "regex": "^SH2(?=.{60})(?:[a-z0-9+\/]{4})*(?:|(?:[a-z0-9+\/]{3}=)|(?:[a-z0-9+\/]{2}==)|(?:[a-z0-9+\/]{1}===))$", "modes": [ { "john": "fortigate256", "hashcat": 26300, "extended": false, "name": "FortiGate256 (FortiOS256)", "samples": [ "SH2lpcpFXM5QRlWYwY5vL9+5svfYyb+c79qENpxEoB3NtZpVxKwHjuq/9TH88U=", "SH2+n+OiTlautpJQF1NBcMU2H1otOvlAz9g5wzxwHw+4il3Aiixv9oPtKnRgCc=", "SH2B0YZCrPjDldskSin50dSxbw22VVy+Mb6Ldvb4eq1FV5q4KE3SYPotvX2KWI=" ] } ] }, { "regex": "^(?=.{28})(?:[a-z0-9+\\/]{4})*(?:|(?:[a-z0-9+\\/]{3}=)|(?:[a-z0-9+\\/]{2}==)|(?:[a-z0-9+\\/]{1}===))$", "modes": [ { "john": null, "hashcat": 24800, "extended": false, "name": "Umbraco HMAC-SHA1", "samples": [ "8uigXlGMNI7BzwLCJlDbcKR2FP4=" ] } ] }, { "regex": "^\\$bcve\\$\\d\\$[a-f0-9]{2}\\$[a-f0-9]{16}\\$[a-f0-9]{192}$", "modes": [ { "john": null, "hashcat": 23900, "extended": false, "name": "Jetico BestCrypt v3 Volume Encryption", "samples": [ "$bcve$3$08$234b8182cee7098b$35c12ef76a1e88175c4c222da3558310a0075bc7a06ecf46746d149c02a81fb8a97637d1103d2e13ddd5deaf982889594b18c12d7ca18a54875c5da4a47f90ae615ab94b8e3ed9e3c793d872a1b5ac35cfdb66c221d6d0853e9ff2e0f4435b43" ] } ] }, { "regex": "^\\$BestCrypt\\$\\d\\$\\d\\$\\d\\$\\d{1,5}\\$\\d{1,3}\\$\\d+\\$\\d{1,3}\\$\\d{1,2}\\$[a-f0-9]{64,128}\\$\\d\\$[a-f0-9]{512}$", "modes": [ { "john": "bestcrypt", "hashcat": null, "extended": false, "name": "Jetico BestCrypt Container Encryption (.jbc)", "samples": [ "$BestCrypt$1$5$3$16384$240$3154116612$128$32$51f7450dccbb1c947dd46138bf0d80d588b6938b02505642dde9e1ea61481485$1$a186f281fbbc68f3b27c7b4cc16b7916a2e19c2695b34ee4133a6ac6373db67b88fb54e3def1c0d288d3170dcb5860c2f190ab199fde7f1072a2a109441e608ae46890c5f18ab80803012a43d9cc595a45c5b9ed8b3ed3330cab1a29e5a96512e2f2e0e5927d6836c3a67c1cd13a61a8201a0a99be84c3e19e6d8a12330ae72c22179d37bb7d55034bb96b5cf9f73c11fa82be31d06bfe33305b616cc72079777a5f1f4a720b56470a83da08c17cbc86e34961c4f0bdb8556e2afa0b2b890780e03304725ce7cf8c592f037beb04b393f4f02e3bc9f6582082a39d31f2e643c5f7811f30eeee2ccc6c11496b7d70dc0d300e145408d28448ff5d929c42007dbe", "$BestCrypt$1$5$3$16384$240$3154116612$10$64$7f36390c85bc5695d49d5d135cb09e00cbf738bb203d0f0a0181805acc15d1cc6f856af0f738c44eead724a854700700a1595b5b30d47242a277b60df6491dde$1$a5b6a69b5cb04be789b42e1f50d3426048ea0df06c3b9a9932d85bd54b99aae202c1ca2e283786a4154f09fa01014ecab7f95c3b9a9b6adab1a695153ca8bffec2408566a7da986c0f107c57404c96823bbdc18a4b11337d211b49d7a133cf951b03c54aaccf3ed9b6445e472ba508add524fb67343e954efe313f544d8ecd6f99e9731fa147c62e17a07954f4a265b43cad4247d61529a3e8760d91c5a4314238eb78e10c2521309b7b827be302a32ee37e03854a8c4f872a07fac709b6170f2e7bd9d723f65ba3fd3766c42ed4a4f8dcc55e4c3b9d4e1dcf2bc54a23a87763f4379afdd9d8e934f254f713f3ba80369f26de2c5195c5e04405acdb2893990a" ] } ] }, { "regex": "^\\$mongodb-scram\\$\\*\\d\\*(?=.{0,76}\\*)(?:[a-z0-9+\\/]{4})*(?:|(?:[a-z0-9+\\/]{3}=)|(?:[a-z0-9+\\/]{2}==)|(?:[a-z0-9+\\/]{1}===))\\*\\d{1,7}\\*(?=.{24}\\*)(?:[a-z0-9+\\/]{4})*(?:|(?:[a-z0-9+\\/]{3}=)|(?:[a-z0-9+\\/]{2}==)|(?:[a-z0-9+\\/]{1}===))\\*(?=.{28})(?:[a-z0-9+\\/]{4})*(?:|(?:[a-z0-9+\\/]{3}=)|(?:[a-z0-9+\\/]{2}==)|(?:[a-z0-9+\\/]{1}===))$", "modes": [ { "john": null, "hashcat": 24100, "extended": false, "name": "MongoDB ServerKey SCRAM-SHA-1", "samples": [ "$mongodb-scram$*0*dXNlcg==*10000*4p+f1tKpK18hQqrVr0UGOw==*Jv9lrpUQ2bVg2ZkXvRm2rppsqNw=" ] } ] }, { "regex": "^\\$mongodb-scram\\$\\*\\d\\*(?=.{0,88}\\*)(?:[a-z0-9+\\/]{4})*(?:|(?:[a-z0-9+\\/]{3}=)|(?:[a-z0-9+\\/]{2}==)|(?:[a-z0-9+\\/]{1}===))\\*\\d{1,7}\\*(?=.{40}\\*)(?:[a-z0-9+\\/]{4})*(?:|(?:[a-z0-9+\\/]{3}=)|(?:[a-z0-9+\\/]{2}==)|(?:[a-z0-9+\\/]{1}===))\\*(?=.{44})(?:[a-z0-9+\\/]{4})*(?:|(?:[a-z0-9+\\/]{3}=)|(?:[a-z0-9+\\/]{2}==)|(?:[a-z0-9+\\/]{1}===))$", "modes": [ { "john": null, "hashcat": 24200, "extended": false, "name": "MongoDB ServerKey SCRAM-SHA-256", "samples": [ "$mongodb-scram$*1*dXNlcg==*15000*qYaA1K1ZZSSpWfY+yqShlcTn0XVcrNipxiYCLQ==*QWVry9aTS/JW+y5CWCBr8lcEH9Kr/D4je60ncooPer8=" ] } ] }, { "regex": "^\\$scram\\$.+\\$\\d{1,5}\\$(?:[a-z0-9+\\/]{4})*(?:|(?:[a-z0-9+\\/]{3}=)|(?:[a-z0-9+\\/]{2}==)|(?:[a-z0-9+\\/]{1}===))\\$(?:[a-z0-9+\\/]{4})*(?:|(?:[a-z0-9+\\/]{3}=)|(?:[a-z0-9+\\/]{2}==)|(?:[a-z0-9+\\/]{1}===))$", "modes": [ { "john": "scram", "hashcat": null, "extended": false, "name": "MongoDB SCRAM PBKDF2-SHA1", "samples": [ "$scram$someadmin$10000$wf42AF7JaU1NSeBaSmkKzw==$H6A5RF0qz6DrcWNNX4xe+wIeVEw=", "$scram$admin$10000$ouQdw5om9Uc5gxulO9F/8w==$DSnATYsgoE8InL5Petfjp8MWGh4=" ] } ] }, { "regex": "^\\$mongodb\\$(?:(?:0\\$.+\\$[a-f0-9]{32})|(?:1\\$.+\\$[a-f0-9]{16}\\$[a-f0-9]{32}))$", "modes": [ { "john": "mongodb", "hashcat": null, "extended": false, "name": "MongoDB (system / network)", "samples": [ "$mongodb$0$sa$75692b1d11c072c6c79332e248c4f699", "$mongodb$1$sa$58d3229c83e3f87e$0c85e3f74adce5d037426791940c820a", "$mongodb$1$eight18_characters$8c82aec197929775$5c414259f7f7a42f8c4d1b6ffb37913a" ] } ] }, { "regex": "^\\$iwork\\$\\d\\$\\d\\$\\d\\$\\d{4,6}\\$[a-f0-9]{16,32}\\$[a-f0-9]{32}\\$[a-f0-9]{128}$", "modes": [ { "john": "iwork", "hashcat": 23300, "extended": false, "name": "Apple iWork", "samples": [ "$iwork$2$1$1$4000$b31b7320d1e7a5ee$01f54d6f9e5090eb16fef2b05f8242bc$69561c985268326b7353fb22c3685a378341127557bd2bbea1bd10afb31f2127344707b662a2c29480c32b8b93dea0538327f604e5aa8733be83af25f370f7ac", "$iwork$1$2$1$100000$d77ce46a68697e08b76ac91de9117541$e7b72b2848dc27efed883963b00b1ac7$e794144cd2f04bd50e23957b30affb2898554a99a3accb7506c17132654e09c04bbeff45dc4f8a8a1db5fd1592f699eeff2f9a8c31b503e9631a25a344b517f7", "$iwork$1$2$1$100000$9d406f6bbb6d3798273a1352c33ed387$7dfef75b06f8cb0092802ad833d6e88c$fc4dd694e0b5fbb123d1a6f1abec30e51176e6f0d574e4988e9c82d354baa3540e2f2268d096d9e46c1080eda32ca8eb8abfeeaa01466d86706b03eb8bd5f0e5", "$iwork$2$1$1$4000$736f6d6553616c74$a9d975f8b3e1bf0c388944b457127df4$09eb5d093584376001d4c94e9d0a41eb8a2993132849c5aed8e56e7bd0e8ed50ba38aced793e3480675990c828c01d25fe245cc6aa603c6cb1a0425988f1d3dc" ] } ] }, { "regex": "^SQLCIPHER\\*\\d\\*\\d{1,6}\\*[a-f0-9]{32}\\*[a-f0-9]{32}\\*[a-f0-9]{32}$", "modes": [ { "john": null, "hashcat": 24610, "extended": false, "name": "SQLCipher", "samples": [ "SQLCIPHER*1*64000*25548249195677404156261816261456*85b5e156e1cf1e0be5e9f4217186817b*33435c230bbc7989bbd027630e3f47cd" ] } ] }, { "regex": "^[a-f0-9]{10}$", "modes": [ { "john": null, "hashcat": 24700, "extended": false, "name": "Stuffit5", "samples": [ "66a75cb059" ] } ] }, { "regex": "^\\$stellar\\$(?=.{24}\\$)(?:[a-z0-9+\\/]{4})*(?:|(?:[a-z0-9+\\/]{3}=)|(?:[a-z0-9+\\/]{2}==)|(?:[a-z0-9+\\/]{1}===))\\$(?=.{16}\\$)(?:[a-z0-9+\\/]{4})*(?:|(?:[a-z0-9+\\/]{3}=)|(?:[a-z0-9+\\/]{2}==)|(?:[a-z0-9+\\/]{1}===))\\$(?=.{96}$)(?:[a-z0-9+\\/]{4})*(?:|(?:[a-z0-9+\\/]{3}=)|(?:[a-z0-9+\\/]{2}==)|(?:[a-z0-9+\\/]{1}===))$", "modes": [ { "john": null, "hashcat": 25500, "extended": false, "name": "Stargazer Stellar Wallet XLM", "samples": [ "$stellar$YAlIJziURRcBEWUwRSRDWA==$EutMmmcV5Hbf3p1I$rfSAF349RvGKG4R4Z2VCrH9WjNEKjbJa9hpOja9Yn8MwXruuFEMtw47HPn9CYj+JJ5Rb4Z87Wejj1c4fqpbMZHFOnqtQsVAr" ] } ] }, { "regex": "^\\$knx-ip-secure-device-authentication-code\\$\\*[a-f0-9]{4}\\*[a-f0-9]{64}\\*[a-f0-9]{32}$", "modes": [ { "john": null, "hashcat": 25900, "extended": false, "name": "KNX IP Secure - Device Authentication Code", "samples": [ "$knx-ip-secure-device-authentication-code$*3033*fa7c0d787a9467c209f0a6e7cf16069ed704f3959dce19e45d7935c0a91bce41*f927640d9bbe9a4b0b74dd3289ad41ec" ] } ] }, { "regex": "^\\$mozilla\\$\\*AES\\*[a-f0-9]{40}\\*[a-f0-9]{64}\\*\\d{1,6}\\*[a-f0-9]{32}\\*[a-f0-9]{32}$", "modes": [ { "john": null, "hashcat": 26100, "extended": false, "name": "Mozilla key4.db", "samples": [ "$mozilla$*AES*5add91733b9b13310ea79a4b38de5c3f797c3bf1*54c17e2a8a066cbdc55f2080c5e9f02ea3954d712cb34b4547f5186548f46512*10000*040e4b5a00f993e63f67a34f6cfc5704*eae9c6c003e6d1b2aa8aa21630838808" ] } ] }, { "regex": "^\\$mozilla\\$\\*(?:(?:3DES\\*[a-f0-9]{40}\\*[a-f0-9]{40}\\*[a-f0-9]{32})|(?:\\d\\*\\d{2}\\*\\d\\*[a-f0-9]{40}\\*\\d{2}\\*[a-f0-9]{22}\\*\\d{2}\\*[a-f0-9]{32}\\*\\d{2}\\*[a-f0-9]{40}))$", "modes": [ { "john": "mozilla", "hashcat": 26000, "extended": false, "name": "Mozilla key3.db", "samples": [ "$mozilla$*3DES*b735d19e6cadb5136376a98c2369f22819d08c79*2b36961682200a877f7d5550975b614acc9fefe3*f03f3575fd5bdbc9e32232316eab7623", "$mozilla$*3*20*1*5199adfab24e85e3f308bacf692115f23dcd4f8f*11*2a864886f70d010c050103*16*9debdebd4596b278de029b2b2285ce2e*20*2c4d938ccb3f7f1551262185ccee947deae3b8ae" ] } ] }, { "regex": "^[a-z]{16}$", "modes": [ { "john": null, "hashcat": 26200, "extended": false, "name": "OpenEdge Progress 4GL Encode", "samples": [ "lebVZteiEsdpkncc", "pjqtudckibycRKbj", "bkibllkLdqlpeIol", "OpalkkljtlheSihj" ] } ] }, { "regex": "^\\$bitwarden\\$\\d\\*\\d{1,7}\\*(?:(?:.+\\*[a-f0-9]{32}\\*[a-f0-9]{160})|(?:(?:[a-z0-9+\\/]{4})*(?:|(?:[a-z0-9+\\/]{3}=)|(?:[a-z0-9+\\/]{2}==)|(?:[a-z0-9+\\/]{1}===))\\*(?:[a-z0-9+\\/]{4})*(?:|(?:[a-z0-9+\\/]{3}=)|(?:[a-z0-9+\\/]{2}==)|(?:[a-z0-9+\\/]{1}===))))$", "modes": [ { "john": "bitwarden", "hashcat": 23400, "extended": false, "name": "Bitwarden", "samples": [ "$bitwarden$1*100000*bm9yZXBseUBoYXNoY2F0Lm5ldA==*zAXL7noQxkIJG82vWuqyDsnoqnKAVU7gE/8IRI6BlMs=", "$bitwarden$0*5000*lulu@mailinator.com*20d9c3c9daaed076026b6cb5887d3273*3bbcb4c7cec45d71c7238291573eb8a8a0f71e6191fb708b07f2cb43b26a56b533ba35a5906abdc08600baedb18fbc042a3b50f4549890210a254129b0ae749394c3c39b33ca183c605ee97b167329d3", "$bitwarden$0*5000*user@example.com*ce49243f6593589f7fa825411fbeb8d7*d90deb720836c5ea5c91eccc896035e510fc8951606266e840b6d7748a623ef68cf98fb69ec8ab5b0fe6a0ddd48edcda9aa6eef07125d89ea417477b96bfd2db462f2b2363f73b5553d78e8b3f372e3a" ] } ] }, { "regex": "^\\$xmpp-scram\\$\\d\\$\\d{1,8}\\$\\d{1,8}\\$[a-f0-9]{0,512}\\$[a-f0-9]{40}$", "modes": [ { "john": "xmpp-scram", "hashcat": 23200, "extended": false, "name": "XMPP SCRAM PBKDF2-SHA1", "samples": [ "$xmpp-scram$0$4096$45$353835323736323530353932363531393630313632353634313335323434323038393931323138373138343134$6d5b543b985dc6c0645da3c83d114fce121aa51d", "$xmpp-scram$0$4096$36$37333536663261622d613666622d346333642d396232622d626432646237633338343064$38f79a6e3e64c07f731570d531ec05365aa05306", "$xmpp-scram$0$4096$16$4f67aec1bd53f5f2f74652e69a3b8f32$4aec3caa8ace5180efa7a671092646c041ab1496", "$xmpp-scram$0$4096$16$1f7fcb384d5bcc61dfb1231ae1b32a2f$a2d076d56b0152ed557ad7d38fce93159bc63c9b", "$xmpp-scram$0$4096$24$bc1bd6638a1231ffd54f608983425eacf729d8455a469197$aee9254762b23a3950fd7c803caab5f6654587c8" ] } ] }, { "regex": "^\\$keychain\\$\\*[a-f0-9]{40}\\*[a-f0-9]{16}\\*[a-f0-9]{96}$", "modes": [ { "john": "keychain", "hashcat": 23100, "extended": false, "name": "Apple macOS Keychain", "samples": [ "$keychain$*74cd1efd49e54a8fdc8750288801e09fa26a33b1*66001ad4e0498dc7*5a084b7314971b728cb551ac40b2e50b7b5bd8b8496b902efe7af07538863a45394ead8399ec581681f7416003c49cc7", "$keychain$*10f7445c8510fa40d9ef6b4e0f8c772a9d37e449*f3d19b2a45cdcccb*8c3c3b1c7d48a24dad4ccbd4fd794ca9b0b3f1386a0a4527f3548bfe6e2f1001804b082076641bbedbc9f3a7c33c084b", "$keychain$*a88cd6fbaaf40bc5437eee015a0f95ab8ab70545*b12372b1b7cb5c1f*1f5c596bcdd015afc126bc86f42dd092cb9d531d14a0aafaa89283f1bebace60562d497332afbd952fd329cc864144ec", "$keychain$*3a473dd308b1713ddc76fc976758eb543779a228*570b762ec2b177d0*a1f491231412ff74344244db4d98b1dab6e40a8fc63a11f0d5cdabf97fce5c4fa8ae0a1f95d0398d37e3d45e9fa07aa7" ] } ] }, { "regex": "^\\$PEM\\$1\\$\\d\\$[a-f0-9]{16}\\$\\d{1,8}\\$[a-f0-9]{16,32}\\$\\d{1,8}\\$[a-f0-9]{64,}$", "modes": [ { "john": "pem", "hashcat": 24410, "extended": false, "name": "PKCS#8 Private Keys (PBKDF2-HMAC-SHA1 + 3DES/AES)", "samples": [ "$PEM$1$4$f5662bd8383b4b40$2048$2993b585d3fb2e7b235ed13d90f637e2$1232$73984f2cba4d5e1d327a3f5a538a946099976ab865349091a452a838dc6855b6e539f920a078b14d949d8c739ea7ce26769dc0ba1619a9c0ee1864d1cfca9e61ddf6d9582439f2b65d00a3ff57c78d3176e9e88fc12da7acd421b624ba76f3d5f12926a3a9acd82f502d7638cfe2063fb2c773a56299ae1ec2c85641d33f5f8b3edfc6687fa9898325d384b3db7a7686704facb880c3898f69dd353a5d5d136b58a1e00e4711d3a01e0c632a5f3d5eff64c9e88166296b9b26f072a52bdc4893377e247b5cdb052f34e0b5d4de10a5dffe443a03b1a23f1edbcb00361334dbd6a6d31e16887b5290da2f865fbe1fef7b43c8f8f3432815ca860946560cb601ab83d417e6a4734aaf75692195566bde61e04610a9eff752c08f9ff85a48959daa7c65d03a0eca62e92bf10a55fb4834a49745a6c53d9c79d0591cb13cfa54f0d437d001b7924fd9dd69c98aa25e5d3f19649f79913bca827e7636ede04bf7c41ef54c42936b4eb93c75d941853dc7dda42b51ac5e4f5602fe2c3e62f252d28e02398943780598cf2bd41d183425daf34e86099c748eda2d5372029ebd089f619dab327ea728eb90342f2b48cd364e914a6078599afdb22a6fac6b55e1bf28b3284a0edc748b59c2eaa97e35d457d4c049f86fd3fc618c4c52f08776c0efb33011b96ef6f0b0e6ecf6d37dc20da8ab7d9b8154371c8e396d9b89ee02e6e6b013a0985b1f47c91f3b5a9e6c33736840e6044f46be1dbea4ec7730eccc6e993cb522bb220de4ed55156129f821d7df19439ab86990991cfd1992681716b5ff012ffa5519ad0baa01885f77f6a522469979f449232d408379558fcdfe5253371da835e0c77706dfa67ff28b1cd8d7fdf9e386899838532d8e57ec1ed3d31a96ae03f37b976fb6c503cc247113deaa070697728e3b36ce43de051ce13a4df91d22157c6281e8f9a16de007c6dddf03ffc79a9f4cfc3eaddd637a9a902fdba1c9e857a9ccd7c318db17cd40d8b588b5d97c7d03c0404473dd201aa5c6637e952c6299e35374127276b3eb4aeba754f3176fecea1731a0f917dd049fcdab34264a8c635ba90eec941aeb449a7eca263aaec9e46758bdf21caa896adb4652e9564d75c20e296fcdf28cbdeb702a1e7acf2374d24b51e6492b0bcc72a58748666a7278e2cb54fbdb68c6736ceb85dd92cd0465b19a65f7ad47e25658a34c3531db48c37ef279574e1892d80d80f3e9dee385ab65e6a4537f6e318817a785228160939d01632b8269858ce9092359048b09ae8b9c17ceb575216988bbeb91c1b5861c931f21e07d888ceb9b89d89d17608e2d5f0ae66b6e756f1eac9f80e13749f866ea6b741158296d3ced761999ad901a2121e233bf173865b6c0b32d68e6ef1d39bb411a1ee9d4d1cde870645b9922051b31cc0df640fb01d23c613091ba538999254b873fbb5996efdfbde5c933e1b6ef6d1c7d5e1a9bff6800c8625b07aba2c14143c1a33a0661c357e5db59a2f49aab35c13531774fb5b3795ed853d7f4e38910c7eeb3435353e2cfd0c94e61c16c8126928343f86222c5ef320b9e043d3cd357af4e065500f50e6bf9c260ca298bd5507c9498dbcea4ceec834449b7fb7249fdf199f66aa98d0a820b1057df1d67c43f49c6d18c3c902466b2b2b528075489261ef73bf711c7988fed65693798568bed43e4d70a800cd25b1773c455aaa153cea8f7013eae1e8f24c6793f590c8f6a112b46", "$PEM$1$1$cbb6cdcfc1b27cc8$2048$9b9e633ba83d48c2$144$54f2ab743656618ae51062fd6f2ff07a5078dcf3a1fa52075f50f4508e0c342b1f3e29703f4932c689e29f385f7ad73bf96ec7bb536ea8dafd40b9e5aee6f3e27dc21ee538d9e146a9361fc34ae5dd818b23c106688a451a5e180362954698a35111cef9315ffcd6cb4d440a6899177ff0384a9533923c05f97a5bbd3f94415688ca5c3af97f9edab771dc84807a6bcc" ] } ] }, { "regex": "^\\$PEM\\$2\\$\\d\\$[a-f0-9]{16}\\$\\d{1,8}\\$[a-f0-9]{16,32}\\$\\d{1,8}\\$[a-f0-9]{64,}$", "modes": [ { "john": null, "hashcat": 24420, "extended": false, "name": "PKCS#8 Private Keys (PBKDF2-HMAC-SHA256 + 3DES/AES)", "samples": [ "$PEM$2$4$ed02960b8a10b1f1$2048$a634c482a95f23bd8fada558e1bac2cf$1232$50b21db4aededb96417a9b88131e6bc3727739b4aa1413417338efaa6a756f27c32db5c339d9c3ba61c746bbe3d6c5e0a023f965e70fb617e78a00890b8c7fc7c9f5e0ab39f35bf58ab40f6ed15441338134d041ca59783437ef681a51132c085abb3830df95e9f94d11da54d61679ca6e40136da96ffe205ce191002458143f03cba3aeca6b22a3f0689d5582b3e6c01baee7a04d875ed44bb84fa0ed0a3aae1ed392645cced385498eef4ec25bf6d1399f1487f3625fad9fee25aabf18edb1ce5e640e834d31251b882601f23c2b2d77a45c84e0fc8a3a42e3ff9f75e7ac815c57a7e943ad803ab3672f85a37c6b92d0813590d47a31788643449dce67f135363a0c14f089629a1274b124539535df5f50df5d4402f7a109738f56467725a8aa3884562c8b4c42c068c3502be86e20ac9c52c0daec22e47dcbefebe902b1dc791ed3cd069c7f9211e43f5a3274450f4b0f0b7c6f59adeca8b39ed130b6cbda7cf98e15bbba21fa1758a28dc2edf2e2f17fc353853dc881458e59184f5a8f6e09456e4d71d90135a8ce67350f7bcb3d900e75585e3a87c0c8482f3917347fcfad4fdb8915991cffd20dae1502d0f69d385244e489e50cc9f24b15a5f9d0b00d62805026db5378b5408d7d719786eb043659a452096736e4a7501548655df83045dc4e86bd3319f2982e6db2bbb239019202cebf2ca68c05b578ba95cef82397b145c80208cd7ffd9b0cd5fc3d0d7ea26401c8e11c28ab8d1a524b884962e7fee597943a5e38137abb8b26a7772f0ad6dad074dcfd0b5794822aa7e43d10cab2c95e63b6459706dc21a1cbbd7ae4c96b40ee4d7039cf84c416cb879b2d30b7ac5e1860dcd2ab5479c39b748f5fd9336934c9c1e8064ffb0906c0c2898479209d1a9c97c3cd1782d7514e94d01b242a371a2df5592d620ebd6e18e63ff24ee8ba182f17e6c578431d738e955a957469e8069a919fd3a15532d460201d4e38ac04ac494b9cde1731d4511bf8faf8420a9de4f8c7d3d721fc30d8c3664683fd91ad3515e97092fb652205fb087890cb594947f5372c9b0b27f08b4b57bf610f777fcf040e6e7b8cedf85113dfd909cbac4b774c7580686f2e1f261898da4c6804d573fb22248005f5e0d3b256a0f3dcb71c47b3d674352bda82c22a513e381f990b6100328185511de9b3352126c5aedb9b0bde15743b42e231ef7227c0fe478044ce69474a740366058f07e56dde7d6089cb76e606482e7ba206355fc0fa180c4a41ae781e4723120e3d5a1dd40224db2c959ecbc9bce88bfeed64082d07b111e88a2d8a6a6fe097c9a298a6c3f76beb5b3b5aecedbbbcd404aac8fd25c069c747338ca0c81e6b63d87fc4f0bc18a86b721e3a16e9875741e0313057de8476ee84e36efe557dc33a7d23a9426f2e359781147607ad79235c9d7846320fe2d963fac79a5c92ff3067595273931174d2173f63cfceb9f62a873e7c240d3c260bcfb02b2697911321a72455cacc6929133d0af2cdf6d59a63293ac508786a4850267f90993fff3b6c07bbf3af0e3c08638148101ae1495da3360614866e238c4f60ca00f615877be80cc708da5ea1c30032acffd0e55429ba29dca409349d901a49831db44c1e58b7530b383d3f7e1cac79200cad9bdf87451783f2ffdab09b230aab52b41fa42fdd9f1f05a3dda0fa16b011c51e330d044adf394bbbb7fa25efc860f3082e42824be3b96943afbe641fe6bb" ] } ] }, { "regex": "^\\$multibit\\$\\d\\*\\d{5}\\*\\d\\*\\d\\*[a-f0-9]{16}\\*[a-f0-9]{64}$", "modes": [ { "john": "multibit", "hashcat": 27700, "extended": false, "name": "MultiBit Classic >= 0.5.19 .wallet", "samples": [ "$multibit$3*16384*8*1*7523cb5482e81b81*91780fd49b81a782ab840157a69ba7996d81270eaf456c850f314fc1787d9b0b", "$multibit$3*16384*8*1*1bf663752dade439*d2a4810673c311f6cdd4cebceadbd564c05d408ba9c74912a187953eabc20bee", "$multibit$3*16384*8*1*1bf663752dade439*956a6f229c25154832bab8f4ddfe83e985631678fb8df33aad1b5128a55ea0e2" ] } ] }, { "regex": "^\\$multibit\\$\\d\\*[a-f0-9]{16}\\*[a-f0-9]{64}$", "modes": [ { "john": "multibit", "hashcat": null, "extended": false, "name": "MultiBit Classic =< 0.5.18 .wallet", "samples": [ "$multibit$1*0908a1bd44147709*c82b6d0409c1e46a4660ea6d4fa9ae12e4e234c98a71a51ced105c7e66a57ca3", "$multibit$1*2043ebb14b6d9670*24284a38a62b6a63fb0912ebc05aa9d26d6fd828134d20b9778d8d841f65f584" ] } ] }, { "regex": "^\\$multibit\\$\\d\\*[a-f0-9]{32}\\*[a-f0-9]{32}\\*[a-f0-9]{32}$", "modes": [ { "john": "multibit", "hashcat": null, "extended": false, "name": "MultiBit HD wallet >= 0.5.0", "samples": [ "$multibit$2*081e3a1252c26731120d0d63783ae46f*8354d5b454e78fb15f81c9e6289ba9b8*081e3a1252c26731120d0d63783ae46f" ] } ] }, { "regex": "^\\$WINHELLO\\$\\*SHA512\\*10000\\*[a-f0-9]{8}\\*[a-f0-9]{128}\\*[a-f0-9]{128}\\*[a-f0-9]{64}\\*[a-f0-9]{1384}\\*[a-f0-9]{34}$", "modes": [ { "john": null, "hashcat": 28100, "extended": false, "name": "Windows Hello PIN/Password", "samples": [ "$WINHELLO$*SHA512*10000*00761655*3b3d3197efb2839a6072e922cc03be910be55d1e60389689c05b520d2d57c06258dc5a48798ba65424004cbe2e003d0509036f3394bcae108eb6b77c7eb306d7*c0772a3aca949db60f274f315b3a5f63fea552fc0d1f2032db5293ca9690735217d918d4cf697aa45b2fe598168804040e18fe00758be94aac971985ea7a5521*bff47e398df761733b5aeda7035cdf289547db3afb94b70cbad2aaea21a5cd58*8a4d5b88832e10bad57303324e6c9021733733df4acbf91366f51cebdc755e00fe1d01b3202469ee6ad5e667975b4f50e3110b00ef60414cd2cf96cc47df532e36b997727ffec2924d979d3fb6e677cb5827f4313131a46be8712926c42158339b55183e2fd7f2f0761980b1413897825c3759c566ff8a438189a6c8fb2d630dc33c6330de45c784d11957c686b40b6fe31fd8f2b1b664f542392326af5d334fdf92155343335e1b964955ac0b0e6f7254a599f0f0dc99becc2216515ba9e9472a54e60a14507fc353ebc47b9f0a8249a2a1bfa5d2cf526bd15ee68bd52e944ece9de6bbda913bc5083e26229673340fcc5285df0d38cbc7bb14584ced2fe9e9b3c283fa3c5ad4dd2034b7a67c8e7a1632fae8979a0abdd19be91c6bc371966121e04d433923e44df0b60c156bd90bc61c9fed01a7a76353f79dd4da3e07e12810ec3765128ec44b44b0789d6aa9e9702211a22ab8055ea32e9513fb1bd9d24ca04b33282632f63ab1b213e9644f97bc31dc4d2e7050c1fa23c0000facbf7c76fd7be4b112586f73f0c27abcf7cbe8c9d9fb83af70f60c490936fef84ed5301f73917b4e4170674a5d5e4bfbebdfeda9584221a0f190545efea7245dd2517ade393bedc255c4e016d9919e6e3f3711bca677fc099bf4e1730a752ea2a90a20ff3d09c909771849d3b009ba8d95d2b84fff889e38b079f1325aa42daa067a52abb5c064de3a5040e4a64e76b397b5c9ee6d045f3b5150cf428a92c141735908bb278077d52beefdc87efa156b8ebda071cb425fad0372a8a7cb6eb29926e8f6411ff1b818750c5b6888302fee9b1591b1c23db131538db2aa3de61dcd76fb7067be7ab71ee372bac18be0f446c974e92e79e27e7e3b2aa5ffc3f5f923f2df8ac2edcbb9392d1ac35e4cd52037d9dceedec6391e713e78770307bfde6a31b4e115904d285ac35db055ae8253b9968b7ed7b948da5f*785435725a573571565662727670754100" ] } ] }, { "regex": "^\\$vbox\\$0\\$\\d{1,9}\\$[a-f0-9]{64}\\$\\d{1,2}\\$[a-f0-9]{64}\\$\\d{1,9}\\$[a-f0-9]{64}\\$[a-f0-9]{64}$", "modes": [ { "john": null, "hashcat": 27500, "extended": false, "name": "VirtualBox (PBKDF2-HMAC-SHA256 & AES-128-XTS)", "samples": [ "$vbox$0$260000$fcc37189521686699a43e49514b91f159306be108b98895666583cd15c3e206b$8$288c3957db47e7c3dff2f7932121eb3395d21ab76b9cf3de2dc660310a25e7ad$20000$8847cd90f8acef74bae41155392908780eebb1d16452aa09b2f7b6cd7d8a4096$9f4d615b484f95c73944a98f392a3ce04f93403e8bb6257e6b6c854273d3a08a" ] } ] }, { "regex": "^\\$vbox\\$0\\$\\d{1,9}\\$[a-f0-9]{64}\\$\\d{1,2}\\$[a-f0-9]{128}\\$\\d{1,9}\\$[a-f0-9]{64}\\$[a-f0-9]{64}$", "modes": [ { "john": null, "hashcat": 27600, "extended": false, "name": "VirtualBox (PBKDF2-HMAC-SHA256 & AES-256-XTS)", "samples": [ "$vbox$0$160000$54aff69fca91c20b3b15618c6732c4a2f953dd88690cd4cc731569b6b80b5572$16$cfb003087e0c618afa9ad7e44adcd97517f039e0424dedb46db8affbb73cd064019abae19ee5e4f5b05b626e6bc5d7da65c61a5f94d7bcac521c388276e5358b$20000$2e5729055136168eea79cb3f1765450a35ab7540125f2ca2a46924a99fd0524d$b28d1db1cabe99ca989a405c33a27beeb9c0683b8b4b54b0e0d85f712f64d89c" ] } ] }, { "regex": "^\\$SNMPv3\\$0\\$\\d{1,8}\\$[a-f0-9]{2,}\\$[a-f0-9]{26,}\\$[a-f0-9]{2,}$", "modes": [ { "john": null, "hashcat": 25000, "extended": false, "name": "SNMPv3 HMAC-MD5-96/HMAC-SHA1-96", "samples": [ "$SNMPv3$0$45889431$30818f0201033011020409242fc0020300ffe304010102010304383036041180001f88808106d566db57fd600000000002011002020118040a6d61747269785f4d4435040c0000000000000000000000000400303d041180001f88808106d566db57fd60000000000400a226020411f319300201000201003018301606082b06010201010200060a2b06010401bf0803020a$80001f88808106d566db57fd6000000000$1b37c3ea872731f922959e90" ] } ] }, { "regex": "^\\$SNMPv3\\$1\\$\\d{1,8}\\$[a-f0-9]{2,}\\$[a-f0-9]{26,}\\$[a-f0-9]{2,}$", "modes": [ { "john": null, "hashcat": 25100, "extended": false, "name": "SNMPv3 HMAC-MD5-96", "samples": [ "$SNMPv3$1$45889431$30818f0201033011020409242fc0020300ffe304010102010304383036041180001f88808106d566db57fd600000000002011002020118040a6d61747269785f4d4435040c0000000000000000000000000400303d041180001f88808106d566db57fd60000000000400a226020411f319300201000201003018301606082b06010201010200060a2b06010401bf0803020a$80001f88808106d566db57fd6000000000$1b37c3ea872731f922959e90" ] } ] }, { "regex": "^\\$SNMPv3\\$2\\$\\d{1,8}\\$[a-f0-9]{2,}\\$[a-f0-9]{26,}\\$[a-f0-9]{2,}$", "modes": [ { "john": null, "hashcat": 25200, "extended": false, "name": "SNMPv3 HMAC-SHA1-96", "samples": [ "$SNMPv3$2$45889431$30818f02010330110204371780f3020300ffe304010102010304383036041180001f88808106d566db57fd600000000002011002020118040a6d61747269785f534841040c0000000000000000000000000400303d041180001f88808106d566db57fd60000000000400a2260204073557d50201000201003018301606082b06010201010200060a2b06010401bf0803020a$80001f88808106d566db57fd6000000000$81f14f1930589f26f6755f6b" ] } ] }, { "regex": "^\\$SNMPv3\\$3\\$\\d{1,8}\\$[a-f0-9]{2,}\\$[a-f0-9]{26,}\\$[a-f0-9]{2,}$", "modes": [ { "john": null, "hashcat": 26700, "extended": false, "name": "SNMPv3 HMAC-SHA224-128", "samples": [ "$SNMPv3$3$45889431$308197020103301102047aa1a79e020300ffe30401010201030440303e041180001f88808106d566db57fd600000000002011002020118040e6d61747269785f5348412d3232340410000000000000000000000000000000000400303d041180001f88808106d566db57fd60000000000400a2260204272f76620201000201003018301606082b06010201010200060a2b06010401bf0803020a$80001f88808106d566db57fd6000000000$2f7a3891dd2e27d3f567e4d6d0257962" ] } ] }, { "regex": "^\\$SNMPv3\\$4\\$\\d{1,8}\\$[a-f0-9]{2,}\\$[a-f0-9]{26,}\\$[a-f0-9]{2,}$", "modes": [ { "john": null, "hashcat": 26800, "extended": false, "name": "SNMPv3 HMAC-SHA256-192", "samples": [ "$SNMPv3$4$45889431$30819f020103301102047fc51818020300ffe304010102010304483046041180001f88808106d566db57fd600000000002011002020118040e6d61747269785f5348412d32353604180000000000000000000000000000000000000000000000000400303d041180001f88808106d566db57fd60000000000400a22602040efec2600201000201003018301606082b06010201010200060a2b06010401bf0803020a$80001f88808106d566db57fd6000000000$36d655bfeb59e933845db47d719b68ac7bc59ec087eb89a0" ] } ] }, { "regex": "^\\$SNMPv3\\$5\\$\\d{1,8}\\$[a-f0-9]{2,}\\$[a-f0-9]{26,}\\$[a-f0-9]{2,}$", "modes": [ { "john": null, "hashcat": 26900, "extended": false, "name": "SNMPv3 HMAC-SHA384-256", "samples": [ "$SNMPv3$5$45889431$3081a70201033011020455c0c85c020300ffe30401010201030450304e041180001f88808106d566db57fd600000000002011002020118040e6d61747269785f5348412d333834042000000000000000000000000000000000000000000000000000000000000000000400303d041180001f88808106d566db57fd60000000000400a226020411b3c3590201000201003018301606082b06010201010200060a2b06010401bf0803020a$80001f88808106d566db57fd60$89424907553231aaa27055f4b3b0a97c626ed4cdc4b660d903765b607af792a5" ] } ] }, { "regex": "^\\$SNMPv3\\$6\\$\\d{1,8}\\$[a-f0-9]{2,}\\$[a-f0-9]{26,}\\$[a-f0-9]{2,}$", "modes": [ { "john": null, "hashcat": 27300, "extended": false, "name": "SNMPv3 HMAC-SHA512-384", "samples": [ "$SNMPv3$6$45889431$3081b702010330110204367c80d4020300ffe30401010201030460305e041180001f88808106d566db57fd600000000002011002020118040e6d61747269785f5348412d35313204300000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000400303d041180001f88808106d566db57fd60000000000400a22602046ea3546f0201000201003018301606082b06010201010200060a2b06010401bf0803020a$80001f88808106d566db57fd6000000000$9e4681768d5dee9e2d0ca7380dfa19f0a0f805c550142b889af548f5506c2c3587df980707600b58d97ed1beaa9feaf9" ] } ] } ]