6 ms·
For the security novices amongst us: I had no idea how to do this so I figured out a quick python script to test it: >>> from hashlib import sha1 >>> d
by dpritchett 14y ago
For the security novices amongst us: I had no idea how to do this so I figured out a quick python script to test it:
>>> from hashlib import sha1
>>> def check_pass(plaintext, offset=5):
hashed = sha1(plaintext).hexdigest()
return (hashed, '0' * offset + hashed[offset:])
>>> check_pass("linkedin")
('7728240c80b6bfd450849405e8500d6d207783b6',
'0000040c80b6bfd450849405e8500d6d207783b6')
Edit: I'm pretty sure JtR refers to this: http://en.wikipedia.org/wiki/John_the_Ripper http://en.wikipedia.org/wiki/John_the_Ripper
- peterwwillis 14y agoObligatory perl one-liner: perl -MDigest::SHA -le '$h = substr( Digest::SHA::sha1_hex($ARGV[0]) , 5 ); open F, "<combo_not.txt"; do { print "found $_" if grep(/$h/, $_) } while (<F>)' password (for people without shells)
- jgrahamc 14y agoObligatory shell one-liner: grep `echo -n password | shasum | cut -c6-40` hacked.txt
- dpritchett 14y agoHere's node.js: $ echo linkedin | xargs node -e "var x = require('crypto').createHash('sha1').update(process.argv[1]).digest('hex'); console.log([x, '00000' + x.substring(5)]);" 7728240c80b6bfd450849405e8500d6d207783b6 0000040c80b6bfd450849405e8500d6d207783b6
- zxcvb 14y agoThe perl one liner was funny, the shell one liner was light hearted, but your node solution is just pure fanboyism and quite frankly not in line with the spirit of the two previous posts.
- jgrahamc 14y agoAnd.. the node.js solution doesn't do what either the Perl or shell one liners do. It doesn't tell you whether the password was found in the file. All it does is print out a SHA1 hash of a string.
- dpritchett 14y agoThat's a trivial modification: $ echo linkedin | xargs node -e "var x = require('crypto').createHash('sha1').update(process.argv[1]).digest('hex'); console.log(x.substring(5));" | xargs -I {} grep {} hashes.txt I'm surprised at the backlash to what I thought was fun code golfing. No one called me names after I posted a simple Python solution that didn't check the file. For what it's worth I've changed my LI password and I haven't bothered downloading the actual hash file.
- zxcvb 14y agoMy point still stands. There's funny and then theres blatent fanboyism. You're like a prepubescent teenager who doesn't understand the context of social situations so always says something stupid.
- sintaks 14y ago"Which brings us to the most important principle on HN: civility. Since long before the web, the anonymity of online conversation has lured people into being much ruder than they'd dare to be in person. So the principle here is not to say anything you wouldn't say face to face. This doesn't mean you can't disagree. But disagree without calling the other person names. If you're right, your argument will be more convincing without them."
- icebraining 14y agoSome people actually do call names to others when face to face. Personally, while I don't, I do tend to get a little aggressive and then I'm often surprised with the backlash, because I get that way when I'm genuinely enjoying the conversation, not when I'm irritated.
- vivekian2 14y agoOr you could just feed "sha1 <password>" to the duckduckgo.com search box and it will give the result.
- furicle 14y agoChallenge accepted (although this is pretty crude) curl -s -d q="sha1 password" http://duckduckgo.com http://duckduckgo.com | w3m -T text/html | grep '\w\+\{32\}'
- slavak 14y agoSome people have this thing against sending their private passwords in plaintext to third-party websites...
- dredmorbius 14y agoYou're sending the hash, not the password. DDG supports SSL: https://www.duckduckgo.com/ https://www.duckduckgo.com/ If you want coverage, generate a few hundred thousand SHA1 hashes along with your password. Actually, running a trickle query of random SHA1 hashes from your box might be a fun exercise, along with a trickle query of random word tuples (bonus points for using Markov chains to generate statistically probable tuples).
- daeken 14y agoIf you search for 'sha1 foo', that's being sent across the network to DDG's servers. And sure, if you're using SSL then it's not going across in plain text, but it's decrypted and handled on their servers in plain text; it'll probably even end up in logs and/or tracking databases somewhere. You're giving DDG your password.
- dredmorbius 14y agoA hash is not a password. At worst you're giving the attacker a hash target to try brunting. He still has to brute it, and that takes time. Select your plaintext from a large enough keyspace and it's astronomical time. I'll need to review their policy more closely, but DDG claim fairly minimal tracking. At best someone might be able to correlate hash lookup with some IP space. That's a long way from handing over passwords. And as I already indicated, you could cradled the queries to make the search space much larger.
- ionwake 14y agoHi - what does " xargs node -e " do? Thank you
- dpritchett 14y ago[node -e] evaluates a line of node.js source from a command line argument: $ node -e "console.log('Hello, world.')" Hello, world. [xargs] allows you to pipe the output of one command as an argument to another command. By default it will show up at the tail end of the second command's arg list, but if you want to interleave it you can use -I flag: $ echo /usr/share/dict/words | xargs head -5 A A's AOL AOL's $ echo petard | xargs -I {} grep {} /usr/share/dict/words petard petard's petards [xargs node -e] therefore allows text from STDIN to inserted into a script to be evaluated by the node interpreter, accessible via process.argv: $ echo is dog this yes | xargs node -e "console.log(process.argv.slice(1).sort().reverse().join(' ').toUpperCase())" YES THIS IS DOG
- uselessuseof 14y agohead -5 /usr/share/dict/words same result as with xargs grep petard /usr/share/dict/words same result as with xargs not sure what you are trying to demonstrate here useless use of xargs?
- spal 14y agoNo, he is trying to demonstrate how to use 'xargs node -e'. Are you even reading this discussion properly or are you just searching for some shell snippets and ridicule them as soon as you get a chance? This is what it looks like from your history: http://news.ycombinator.com/threads?id=uselessuseof http://news.ycombinator.com/threads?id=uselessuseof ionwake doesn't want to learn how to search a word. He wants to know how 'xargs node -e' works. Please read this again: http://news.ycombinator.com/item?id=4075293 http://news.ycombinator.com/item?id=4075293
- olifante 14y agoPrefix the whole command with a space to avoid dumping your password into your bash history: " grep `echo -n yourpassword | shasum | cut -c6-40` SHA1.txt"
- prakashk 14y agoOnly if HISTCONTROL is assigned 'ignoreboth' or 'ignorespace'.
- rasengan 14y agoI couldn't really find a good reason to use a .bash_history. I linked mine to /dev/null and never looked back. (heh)
- pbhjpbhj 14y agoCtrl+r history search? I'd tend to maintaining a complete history log so that when I've forgotten the one liner I used to rotate my videos 2 years ago I can easily recall it.
- verself 14y ago2 years? Just how big is your history file? I thought 16k entries might be reasonable but that doesn't even last 3 weeks for me. I think there might have been some issue with slow disk seeks so at some point I restricted it to that many. I guess it probably it would be better to regularly backup the history file to deal with possible some accidental truncations and issues when running multiple shells concurrently, but probably the overall effort to set up such a system would outweight the benefits.
- uselessuse 14y agoexport HISTSIZE=0
- uselessuseof 14y agoexport HISTSIZE=0
- 14y ago
- uselessuse 14y agoecho -n isn't portable shasum might not be either - you could use openssl and there's no need to use backticks and parse the line twice printf yourpassword|sha1sum |cut -c6-40 |grep -f - SHA1.txt
- deleted 14y ago[deleted]
- uselessuseof 14y agoobligatory comments - not portable - useless use of backticks printf password|openssl sha1|cut -c6-40|grep -f - hacked.txt
- spal 14y agoWhy are you extracting 35 characters with 'cut -c6-40'? SHA1 produces a 160-bit message digest. That's 20 bytes or 40 hex-digits.
- uselessuseof 14y agotypo.
- prakashk 14y agoShorter and, IMHO, a bit simpler Perl one-liner: perl -MDigest::SHA=sha1_hex -le '$h = substr( sha1_hex(shift), 5 ); open F, "<combo_not.txt"; print "found $_" for grep /$h/, <F>' password Or: perl -MDigest::SHA=sha1_hex -lne 'BEGIN {$pw = shift} $h = substr( sha1_hex($pw), 5 ); print "found $_" if /$h/' password combo_not.txt
- peterwwillis 14y agoThe first one ramps up memory use like crazy (which I was trying to avoid) and the second one is much better with memory, but you need to move the sha1_hex into the BEGIN block or you're recomputing the hash for every line parsed, thrashing your CPU. Interesting use of 'shift' though, I didn't know you could modify the file argument to -n like that.
- 16s 14y agoYou might compare many words at once (say from a popular password list such as rockyou) like this: while read line; do echo -n $line | sha1sum | cut -c6-40 | awk '{print "00000" $0}'; done < rockyou.txt I haven't tested that, but I think it'll work.
- slavak 14y agoBy sheer coincidence I had a chance to use Perl again today for a job interview. I now have a good appreciation of why it's considered a "Write once, read never" language. :)
- zura 14y agoAmsterdam? ;)
- QWDEQWEQWE 14y ago<a href="http://www.bestwatchsale.net>replica http://www.bestwatchsale.net>replica watches</a> Watches Inc is known as the professional replica watches supplier, offer the high quality imitation watches from Rolex, Omega, Breitling,
- QWDEQWEQWE 14y agobut stressed that “fundamentally, there are no differences <a href="http://www.bestwatchsale.net>replica http://www.bestwatchsale.net>replica watches</a>,” and ... Rich, profiled in a cover article for Harvard Magazine Replica Watches,
- d503 14y agoIf you're paranoid about shoulder-surfing you can use getpass to hide your password as you type it in. >>> import getpass >>> password = getpass.getpass('Password: ') http://docs.python.org/library/getpass.html http://docs.python.org/library/getpass.html
- grantismo 14y agoCommand line utility I wrote which uses getpass: http://dpaste.com/hold/756011/ http://dpaste.com/hold/756011/
- mas1n 14y agoA complete python script assuming you have hashes.txt in the same directory. http://dpaste.com/756007/ http://dpaste.com/756007/
- deleted 14y ago[deleted]
- deleted 14y ago[deleted]
- SteveMoody73 14y agoJust tried your code and it seems that my password has been cracked. Glad i changed it this morning now
- eidorianu 14y agoAny password that I try works...
- QWDEQWEQWE 14y ago<a href="http://www.bestwatchsale.net>replica http://www.bestwatchsale.net>replica watches</a> Watches Inc is known as the professional replica watches supplier, offer the high quality imitation watches from Rolex, Omega, Breitling,