7 ms·

Can someone please just provide the exact shell commands to generate a compatible sha-1 of a password to grep against the database? The article seems to ramble

• benbristow 9y ago
  http://onlinemd5.com/ http://onlinemd5.com/ Just uses JavaScript in the browser
  • mnutt 9y ago
    I wouldn't recommend using this. Even if you were to read the page source and see that it is in fact not sending data back to a third party, either a) the site owner could change this in the future, or b) you could be man-in-the-middle'd since they're using http, or c) one of the third party scripts they run on that page could either accidentally or intentionally take your password. Don't put your password in there.
• ianlevesque 9y ago
  echo -n "password" | openssl sha1 | tr '[:lower:]' '[:upper:]'
  • georgyo 9y ago
    echo -n "password" echo adds a new line that is likely not in your password.
    • noja 9y ago
      No it doesn't: -n do not output the trailing newline
      • zyxzkz 9y ago
        He's saying echo without an argument emits a newline, so use -n to suppress it.
        • noja 9y ago
          Oops. Thanks.
  • mnutt 9y ago
    You may also want to consider running `unset HISTFILE` before that to ensure that the line containing your password doesn't end up sitting around in your bash history.
    • r1ch 9y ago
      Another way is to prefix the command with whitespace.
      • baliex 9y ago
        Only if.. export HISTCONTROL=ignorespace ..is set (either by default or explicitly)
        • deathanatos 9y ago
          python3 -c 'import getpass, hashlib; print(hashlib.sha1(getpass.getpass().encode("utf-8")).hexdigest())' Avoids history, doesn't echo to the terminal. In fact, you should be able to just make a rudimentary CLI into Troy's API simply with: #!/bin/bash HASH="$(python3 -c 'import getpass, hashlib; print(hashlib.sha1(getpass.getpass().encode("utf-8")).hexdigest().upper())')" curl -sS "https://api.pwnedpasswords.com/range/${HASH:0:5}" | grep "${HASH:5}" (It'll emit the line from the API response matching your pass; if it does, then that password was compromised. Bash isn't real good at error handling though, so my biggest concern would be what this might do if an HTTP/TCP error happened. I've attempted to throw -S there to catch that, but use with your head screwed on.)
  • pieguy 9y ago
    On my machine this produces (STDIN)= 5BAA61E4C9B93F3F0682250B6CF8331B7EE68FD8 Which is obviously not what you want. So I changed it to: echo -n "$password" | openssl sha1 -binary | xxd -p -u
  • squegles 9y ago
    This worked. Wow an old, old password that is fairly unique was seen 36 times.
  • adrianmonk 9y ago
    You could skip the "tr" part, as the API to query by hash prefixes not case sensitive, and once you have its results, you can use "grep -i" with the hash.
• Felk 9y ago
  echo -n "password" | sha1sum then to remove the sha1sum's trailing spaces and dash: | sed 's/\s.*$//' and then to uppercase it, as ianlevesque showed: | tr '[:lower:]' '[:upper:]'
• jffry 9y ago
  echo -n 'P@ssw0rd' | shasum -t 1 - gives me the same value (21bd12dc183f740ee76f27b78eb39c8ad972a757) as appears in the article.