[ { "regex": "^[a-f0-9]{4}$", "modes": [ { "name": "CRC-16", "hashcat": null, "john": null, "extended": false, "description": null }, { "name": "CRC-16-CCITT", "hashcat": null, "john": null, "extended": false, "description": null }, { "name": "FCS-16", "hashcat": null, "john": null, "extended": false, "description": null } ] }, { "regex": "^[a-f0-9]{8}$", "modes": [ { "name": "Adler-32", "hashcat": null, "john": null, "extended": false, "description": null }, { "name": "CRC-32B", "hashcat": null, "john": null, "extended": false, "description": null }, { "name": "FCS-32", "hashcat": null, "john": null, "extended": false, "description": null }, { "name": "GHash-32-3", "hashcat": null, "john": null, "extended": false, "description": null }, { "name": "GHash-32-5", "hashcat": null, "john": null, "extended": false, "description": null }, { "name": "FNV-132", "hashcat": null, "john": null, "extended": false, "description": null }, { "name": "Fletcher-32", "hashcat": null, "john": null, "extended": false, "description": null }, { "name": "Joaat", "hashcat": null, "john": null, "extended": false, "description": null }, { "name": "ELF-32", "hashcat": null, "john": null, "extended": false, "description": null }, { "name": "XOR-32", "hashcat": null, "john": null, "extended": false, "description": null } ] }, { "regex": "^[a-f0-9]{6}$", "modes": [ { "name": "CRC-24", "hashcat": null, "john": null, "extended": false, "description": null } ] }, { "regex": "^(\\$crc32\\$[a-f0-9]{8}.)?[a-f0-9]{8}$", "modes": [ { "name": "CRC-32", "hashcat": 11500, "john": "crc32", "extended": false, "description": null } ] }, { "regex": "^\\+[a-z0-9\\/.]{12}$", "modes": [ { "name": "Eggdrop IRC Bot", "hashcat": null, "john": "bfegg", "extended": false, "description": null } ] }, { "regex": "^[a-z0-9\\/.]{13}$", "modes": [ { "name": "DES(Unix)", "hashcat": 1500, "john": "descrypt", "extended": false, "description": null }, { "name": "Traditional DES", "hashcat": 1500, "john": "descrypt", "extended": false, "description": null }, { "name": "DEScrypt", "hashcat": 1500, "john": "descrypt", "extended": false, "description": null } ] }, { "regex": "^[a-f0-9]{16}$", "modes": [ { "name": "MySQL323", "hashcat": 200, "john": "mysql", "extended": false, "description": null }, { "name": "DES(Oracle)", "hashcat": 3100, "john": null, "extended": false, "description": null }, { "name": "Half MD5", "hashcat": 5100, "john": null, "extended": false, "description": null }, { "name": "Oracle 7-10g", "hashcat": 3100, "john": null, "extended": false, "description": null }, { "name": "FNV-164", "hashcat": null, "john": null, "extended": false, "description": null }, { "name": "CRC-64", "hashcat": null, "john": null, "extended": false, "description": null } ] }, { "regex": "^[a-z0-9\\/.]{16}$", "modes": [ { "name": "Cisco-PIX(MD5)", "hashcat": 2400, "john": "pix-md5", "extended": false, "description": null } ] }, { "regex": "^\\([a-z0-9\\/+]{20}\\)$", "modes": [ { "name": "Lotus Notes/Domino 6", "hashcat": 8700, "john": "dominosec", "extended": false, "description": null } ] }, { "regex": "^_[a-z0-9\\/.]{19}$", "modes": [ { "name": "BSDi Crypt", "hashcat": null, "john": "bsdicrypt", "extended": false, "description": null } ] }, { "regex": "^[a-f0-9]{24}$", "modes": [ { "name": "CRC-96(ZIP)", "hashcat": null, "john": null, "extended": false, "description": null } ] }, { "regex": "^[a-z0-9\\/.]{24}$", "modes": [ { "name": "Crypt16", "hashcat": null, "john": null, "extended": false, "description": null } ] }, { "regex": "^[a-f0-9]{32}(:.+)?$", "modes": [ { "name": "MD5", "hashcat": 0, "john": "raw-md5", "extended": false, "description": "Used for Linux Shadow files." }, { "name": "MD4", "hashcat": 900, "john": "raw-md4", "extended": false, "description": null }, { "name": "Double MD5", "hashcat": 2600, "john": null, "extended": false, "description": null }, { "name": "LM", "hashcat": 3000, "john": "lm", "extended": false, "description": null }, { "name": "RIPEMD-128", "hashcat": null, "john": "ripemd-128", "extended": false, "description": null }, { "name": "Haval-128", "hashcat": null, "john": "haval-128-4", "extended": false, "description": null }, { "name": "Tiger-128", "hashcat": null, "john": null, "extended": false, "description": null }, { "name": "Skein-256(128)", "hashcat": null, "john": null, "extended": false, "description": null }, { "name": "Skein-512(128)", "hashcat": null, "john": null, "extended": false, "description": null }, { "name": "Lotus Notes/Domino 5", "hashcat": 8600, "john": "lotus5", "extended": false, "description": null }, { "name": "Skype", "hashcat": 23, "john": null, "extended": false, "description": null }, { "name": "ZipMonster", "hashcat": null, "john": null, "extended": true, "description": null }, { "name": "PrestaShop", "hashcat": 11000, "john": null, "extended": true, "description": null }, { "name": "md5(md5(md5($pass)))", "hashcat": 3500, "john": null, "extended": true, "description": null }, { "name": "md5(uppercase(md5($pass)))", "hashcat": 4300, "john": null, "extended": true, "description": null }, { "name": "md5(sha1($pass))", "hashcat": 4400, "john": null, "extended": true, "description": null }, { "name": "md5($pass.$salt)", "hashcat": 10, "john": null, "extended": true, "description": null }, { "name": "md5($salt.$pass)", "hashcat": 20, "john": null, "extended": true, "description": null }, { "name": "md5(unicode($pass).$salt)", "hashcat": 30, "john": null, "extended": true, "description": null }, { "name": "md5($salt.unicode($pass))", "hashcat": 40, "john": null, "extended": true, "description": null }, { "name": "HMAC-MD5 (key = $pass)", "hashcat": 50, "john": "hmac-md5", "extended": true, "description": null }, { "name": "HMAC-MD5 (key = $salt)", "hashcat": 60, "john": "hmac-md5", "extended": true, "description": null }, { "name": "md5(md5($salt).$pass)", "hashcat": 3610, "john": null, "extended": true, "description": null }, { "name": "md5($salt.md5($pass))", "hashcat": 3710, "john": null, "extended": true, "description": null }, { "name": "md5($pass.md5($salt))", "hashcat": 3720, "john": null, "extended": true, "description": null }, { "name": "md5($salt.$pass.$salt)", "hashcat": 3810, "john": null, "extended": true, "description": null }, { "name": "md5(md5($pass).md5($salt))", "hashcat": 3910, "john": null, "extended": true, "description": null }, { "name": "md5($salt.md5($salt.$pass))", "hashcat": 4010, "john": null, "extended": true, "description": null }, { "name": "md5($salt.md5($pass.$salt))", "hashcat": 4110, "john": null, "extended": true, "description": null }, { "name": "md5($username.0.$pass)", "hashcat": 4210, "john": null, "extended": true, "description": null }, { "name": "md5(utf16($pass))", "hashcat": null, "john": "dynamic_29", "extended": true, "description": null }, { "name": "md4($salt.$pass)", "hashcat": null, "john": "dynamic_31", "extended": true, "description": null }, { "name": "md4($pass.$salt)", "hashcat": null, "john": "dynamic_32", "extended": true, "description": null }, { "name": "md4(utf16($pass))", "hashcat": null, "john": "dynamic_33", "extended": true, "description": null }, { "name": "md5(md4($pass))", "hashcat": null, "john": "dynamic_34", "extended": true, "description": null }, { "name": "net-md5", "hashcat": null, "john": "dynamic_39", "extended": true, "description": null }, { "name": "md5($salt.pad16($pass))", "hashcat": null, "john": "dynamic_39", "extended": true, "description": null } ] }, { "regex": "^(\\$md2\\$)?[a-f0-9]{32}$", "modes": [ { "name": "MD2", "hashcat": null, "john": "md2", "extended": false, "description": null } ] }, { "regex": "^(\\$snefru\\$)?[a-f0-9]{32}$", "modes": [ { "name": "Snefru-128", "hashcat": null, "john": "snefru-128", "extended": false, "description": null } ] }, { "regex": "^(\\$NT\\$)?[a-f0-9]{32}$", "modes": [ { "name": "NTLM", "hashcat": 1000, "john": "nt", "extended": false, "description": "Often used in Windows Active Directory." } ] }, { "regex": "^([^\\\\\\/:*?\"<>|]{1,20}:)?[a-f0-9]{32}(:[^\\\\\\/:*?\"<>|]{1,20})?$", "modes": [ { "name": "Domain Cached Credentials", "hashcat": 1100, "john": "mscach", "extended": false, "description": null } ] }, { "regex": "^([^\\\\\\/:*?\"<>|]{1,20}:)?(\\$DCC2\\$10240#[^\\\\\\/:*?\"<>|]{1,20}#)?[a-f0-9]{32}$", "modes": [ { "name": "Domain Cached Credentials 2", "hashcat": 2100, "john": "mscach2", "extended": false, "description": null } ] }, { "regex": "^{SHA}[a-z0-9\\/+]{27}=$", "modes": [ { "name": "SHA-1(Base64)", "hashcat": 101, "john": "nsldap", "extended": false, "description": null }, { "name": "Netscape LDAP SHA", "hashcat": 101, "john": "nsldap", "extended": false, "description": null } ] }, { "regex": "^\\$1\\$[a-z0-9\\/.]{0,8}\\$[a-z0-9\\/.]{22}(:.*)?$", "modes": [ { "name": "MD5 Crypt", "hashcat": 500, "john": "md5crypt", "extended": false, "description": null }, { "name": "Cisco-IOS(MD5)", "hashcat": 500, "john": "md5crypt", "extended": false, "description": null }, { "name": "FreeBSD MD5", "hashcat": 500, "john": "md5crypt", "extended": false, "description": null } ] }, { "regex": "^0x[a-f0-9]{32}$", "modes": [ { "name": "Lineage II C4", "hashcat": null, "john": null, "extended": false, "description": null } ] }, { "regex": "^\\$H\\$[a-z0-9\\/.]{31}$", "modes": [ { "name": "phpBB v3.x", "hashcat": 400, "john": "phpass", "extended": false, "description": null }, { "name": "Wordpress v2.6.0/2.6.1", "hashcat": 400, "john": "phpass", "extended": false, "description": null }, { "name": "PHPass' Portable Hash", "hashcat": 400, "john": "phpass", "extended": false, "description": null } ] }, { "regex": "^\\$P\\$[a-z0-9\\/.]{31}$", "modes": [ { "name": "Wordpress \u2265 v2.6.2", "hashcat": 400, "john": "phpass", "extended": false, "description": null }, { "name": "Joomla \u2265 v2.5.18", "hashcat": 400, "john": "phpass", "extended": false, "description": null }, { "name": "PHPass' Portable Hash", "hashcat": 400, "john": "phpass", "extended": false, "description": null } ] }, { "regex": "^[a-f0-9]{32}:[a-z0-9]{2}$", "modes": [ { "name": "osCommerce", "hashcat": 21, "john": null, "extended": false, "description": null }, { "name": "xt:Commerce", "hashcat": 21, "john": null, "extended": false, "description": null } ] }, { "regex": "^\\$apr1\\$[a-z0-9\\/.]{0,8}\\$[a-z0-9\\/.]{22}$", "modes": [ { "name": "MD5(APR)", "hashcat": 1600, "john": null, "extended": false, "description": null }, { "name": "Apache MD5", "hashcat": 1600, "john": null, "extended": false, "description": null }, { "name": "md5apr1", "hashcat": 1600, "john": null, "extended": true, "description": null } ] }, { "regex": "^{smd5}[a-z0-9$\\/.]{31}$", "modes": [ { "name": "AIX(smd5)", "hashcat": 6300, "john": "aix-smd5", "extended": false, "description": null } ] }, { "regex": "^[a-f0-9]{32}:[a-f0-9]{32}$", "modes": [ { "name": "WebEdition CMS", "hashcat": 3721, "john": null, "extended": false, "description": null } ] }, { "regex": "^[a-f0-9]{32}:.{5}$", "modes": [ { "name": "IP.Board \u2265 v2+", "hashcat": 2811, "john": null, "extended": false, "description": null } ] }, { "regex": "^[a-f0-9]{32}:.{8}$", "modes": [ { "name": "MyBB \u2265 v1.2+", "hashcat": 2811, "john": null, "extended": false, "description": null } ] }, { "regex": "^[a-z0-9]{34}$", "modes": [ { "name": "CryptoCurrency(Adress)", "hashcat": null, "john": null, "extended": false, "description": null } ] }, { "regex": "^[a-f0-9]{40}(:.+)?$", "modes": [ { "name": "SHA-1", "hashcat": 100, "john": "raw-sha1", "extended": false, "description": "[link=https://en.wikipedia.org/wiki/SHA-1]Used for checksums.[/link]" }, { "name": "Double SHA-1", "hashcat": 4500, "john": null, "extended": false, "description": null }, { "name": "RIPEMD-160", "hashcat": 6000, "john": "ripemd-160", "extended": false, "description": null }, { "name": "Haval-160", "hashcat": null, "john": null, "extended": false, "description": null }, { "name": "Tiger-160", "hashcat": null, "john": null, "extended": false, "description": null }, { "name": "HAS-160", "hashcat": null, "john": null, "extended": false, "description": null }, { "name": "LinkedIn", "hashcat": 190, "john": "raw-sha1-linkedin", "extended": false, "description": null }, { "name": "Skein-256(160)", "hashcat": null, "john": null, "extended": false, "description": null }, { "name": "Skein-512(160)", "hashcat": null, "john": null, "extended": false, "description": null }, { "name": "MangosWeb Enhanced CMS", "hashcat": null, "john": null, "extended": true, "description": null }, { "name": "sha1(sha1(sha1($pass)))", "hashcat": 4600, "john": null, "extended": true, "description": null }, { "name": "sha1(md5($pass))", "hashcat": 4700, "john": null, "extended": true, "description": null }, { "name": "sha1($pass.$salt)", "hashcat": 110, "john": null, "extended": true, "description": null }, { "name": "sha1($salt.$pass)", "hashcat": 120, "john": null, "extended": true, "description": null }, { "name": "sha1(unicode($pass).$salt)", "hashcat": 130, "john": null, "extended": true, "description": null }, { "name": "sha1($salt.unicode($pass))", "hashcat": 140, "john": null, "extended": true, "description": null }, { "name": "HMAC-SHA1 (key = $pass)", "hashcat": 150, "john": "hmac-sha1", "extended": true, "description": null }, { "name": "HMAC-SHA1 (key = $salt)", "hashcat": 160, "john": "hmac-sha1", "extended": true, "description": null }, { "name": "sha1($salt.$pass.$salt)", "hashcat": 4710, "john": null, "extended": true, "description": null } ] }, { "regex": "^\\*[a-f0-9]{40}$", "modes": [ { "name": "MySQL5.x", "hashcat": 300, "john": "mysql-sha1", "extended": false, "description": null }, { "name": "MySQL4.1", "hashcat": 300, "john": "mysql-sha1", "extended": false, "description": null } ] }, { "regex": "^[a-z0-9]{43}$", "modes": [ { "name": "Cisco-IOS(SHA-256)", "hashcat": 5700, "john": null, "extended": false, "description": null } ] }, { "regex": "^{SSHA}[a-z0-9\\/+]{38}==$", "modes": [ { "name": "SSHA-1(Base64)", "hashcat": 111, "john": "nsldaps", "extended": false, "description": null }, { "name": "Netscape LDAP SSHA", "hashcat": 111, "john": "nsldaps", "extended": false, "description": null }, { "name": "nsldaps", "hashcat": 111, "john": "nsldaps", "extended": true, "description": null } ] }, { "regex": "^[a-z0-9=]{47}$", "modes": [ { "name": "Fortigate(FortiOS)", "hashcat": 7000, "john": "fortigate", "extended": false, "description": null } ] }, { "regex": "^[a-f0-9]{48}$", "modes": [ { "name": "Haval-192", "hashcat": null, "john": null, "extended": false, "description": null }, { "name": "Tiger-192", "hashcat": null, "john": "tiger", "extended": false, "description": null }, { "name": "SHA-1(Oracle)", "hashcat": null, "john": null, "extended": false, "description": null }, { "name": "OSX v10.4", "hashcat": 122, "john": "xsha", "extended": false, "description": null }, { "name": "OSX v10.5", "hashcat": 122, "john": "xsha", "extended": false, "description": null }, { "name": "OSX v10.6", "hashcat": 122, "john": "xsha", "extended": false, "description": null } ] }, { "regex": "^[a-f0-9]{51}$", "modes": [ { "name": "Palshop CMS", "hashcat": null, "john": null, "extended": false, "description": null } ] }, { "regex": "^[a-z0-9]{51}$", "modes": [ { "name": "CryptoCurrency(PrivateKey)", "hashcat": null, "john": null, "extended": false, "description": null } ] }, { "regex": "^{ssha1}[0-9]{2}\\$[a-z0-9$\\/.]{44}$", "modes": [ { "name": "AIX(ssha1)", "hashcat": 6700, "john": "aix-ssha1", "extended": false, "description": null } ] }, { "regex": "^0x0100[a-f0-9]{48}$", "modes": [ { "name": "MSSQL(2005)", "hashcat": 132, "john": "mssql05", "extended": false, "description": null }, { "name": "MSSQL(2008)", "hashcat": 132, "john": "mssql05", "extended": false, "description": null } ] }, { "regex": "^(\\$md5,rounds=[0-9]+\\$|\\$md5\\$rounds=[0-9]+\\$|\\$md5\\$)[a-z0-9\\/.]{0,16}(\\$|\\$\\$)[a-z0-9\\/.]{22}$", "modes": [ { "name": "Sun MD5 Crypt", "hashcat": 3300, "john": "sunmd5", "extended": false, "description": null } ] }, { "regex": "^[a-f0-9]{56}$", "modes": [ { "name": "SHA-224", "hashcat": null, "john": "raw-sha224", "extended": false, "description": null }, { "name": "Haval-224", "hashcat": null, "john": null, "extended": false, "description": null }, { "name": "SHA3-224", "hashcat": 17300, "john": null, "extended": false, "description": null }, { "name": "Skein-256(224)", "hashcat": null, "john": null, "extended": false, "description": null }, { "name": "Skein-512(224)", "hashcat": null, "john": null, "extended": false, "description": null } ] }, { "regex": "^(\\$2[axy]|\\$2)\\$[0-9]{2}\\$[a-z0-9\\/.]{53}$", "modes": [ { "name": "Blowfish(OpenBSD)", "hashcat": 3200, "john": "bcrypt", "extended": false, "description": "Can be used in Linux Shadow Files." }, { "name": "Woltlab Burning Board 4.x", "hashcat": null, "john": null, "extended": false, "description": null }, { "name": "bcrypt", "hashcat": 3200, "john": "bcrypt", "extended": false, "description": null } ] }, { "regex": "^[a-f0-9]{40}:[a-f0-9]{16}$", "modes": [ { "name": "Android PIN", "hashcat": 5800, "john": null, "extended": false, "description": null } ] }, { "regex": "^(S:)?[a-f0-9]{40}(:)?[a-f0-9]{20}$", "modes": [ { "name": "Oracle 11g/12c", "hashcat": 112, "john": "oracle11", "extended": false, "description": null } ] }, { "regex": "^\\$bcrypt-sha256\\$(2[axy]|2)\\,[0-9]+\\$[a-z0-9\\/.]{22}\\$[a-z0-9\\/.]{31}$", "modes": [ { "name": "bcrypt(SHA-256)", "hashcat": null, "john": null, "extended": false, "description": null } ] }, { "regex": "^[a-f0-9]{32}:.{3}$", "modes": [ { "name": "vBulletin < v3.8.5", "hashcat": 2611, "john": null, "extended": false, "description": null } ] }, { "regex": "^[a-f0-9]{32}:.{30}$", "modes": [ { "name": "vBulletin \u2265 v3.8.5", "hashcat": 2711, "john": null, "extended": false, "description": null } ] }, { "regex": "^(\\$snefru\\$)?[a-f0-9]{64}$", "modes": [ { "name": "Snefru-256", "hashcat": null, "john": "snefru-256", "extended": false, "description": null } ] }, { "regex": "^[a-f0-9]{64}(:.+)?$", "modes": [ { "name": "SHA-256", "hashcat": 1400, "john": "raw-sha256", "extended": false, "description": "256-bit key and is a good partner-function for AES. Can be used in Shadow files." }, { "name": "RIPEMD-256", "hashcat": null, "john": null, "extended": false, "description": null }, { "name": "Haval-256", "hashcat": null, "john": "haval-256-3", "extended": false, "description": null }, { "name": "GOST R 34.11-94", "hashcat": 6900, "john": "gost", "extended": false, "description": null }, { "name": "GOST CryptoPro S-Box", "hashcat": null, "john": null, "extended": false, "description": null }, { "name": "SHA3-256", "hashcat": 17400, "john": null, "extended": false, "description": null }, { "name": "Skein-256", "hashcat": null, "john": "skein-256", "extended": false, "description": null }, { "name": "Skein-512(256)", "hashcat": null, "john": null, "extended": false, "description": null }, { "name": "Ventrilo", "hashcat": null, "john": null, "extended": true, "description": null }, { "name": "sha256($pass.$salt)", "hashcat": 1410, "john": null, "extended": true, "description": null }, { "name": "sha256($salt.$pass)", "hashcat": 1420, "john": null, "extended": true, "description": null }, { "name": "sha256(unicode($pass).$salt)", "hashcat": 1430, "john": null, "extended": true, "description": null }, { "name": "sha256($salt.unicode($pass))", "hashcat": 1440, "john": null, "extended": true, "description": null }, { "name": "HMAC-SHA256 (key = $pass)", "hashcat": 1450, "john": "hmac-sha256", "extended": true, "description": null }, { "name": "HMAC-SHA256 (key = $salt)", "hashcat": 1460, "john": "hmac-sha256", "extended": true, "description": null } ] }, { "regex": "^[a-f0-9]{32}:[a-z0-9]{32}$", "modes": [ { "name": "Joomla < v2.5.18", "hashcat": 11, "john": null, "extended": false, "description": null } ] }, { "regex": "^[a-f0-9]{32}:[a-f0-9]{32}$", "modes": [ { "name": "SAM(LM_Hash:NT_Hash)", "hashcat": null, "john": null, "extended": false, "description": null } ] }, { "regex": "^(\\$chap\\$0\\*)?[a-f0-9]{32}[\\*:][a-f0-9]{32}(:[0-9]{2})?$", "modes": [ { "name": "MD5(Chap)", "hashcat": 4800, "john": "chap", "extended": false, "description": null }, { "name": "iSCSI CHAP Authentication", "hashcat": 4800, "john": "chap", "extended": false, "description": null } ] }, { "regex": "^\\$episerver\\$\\*0\\*[a-z0-9\\/=+]+\\*[a-z0-9\\/=+]{27,28}$", "modes": [ { "name": "EPiServer 6.x < v4", "hashcat": 141, "john": "episerver", "extended": false, "description": null } ] }, { "regex": "^{ssha256}[0-9]{2}\\$[a-z0-9$\\/.]{60}$", "modes": [ { "name": "AIX(ssha256)", "hashcat": 6400, "john": "aix-ssha256", "extended": false, "description": null } ] }, { "regex": "^[a-f0-9]{80}$", "modes": [ { "name": "RIPEMD-320", "hashcat": null, "john": null, "extended": false, "description": null } ] }, { "regex": "^\\$episerver\\$\\*1\\*[a-z0-9\\/=+]+\\*[a-z0-9\\/=+]{42,43}$", "modes": [ { "name": "EPiServer 6.x \u2265 v4", "hashcat": 1441, "john": "episerver", "extended": false, "description": null } ] }, { "regex": "^0x0100[a-f0-9]{88}$", "modes": [ { "name": "MSSQL(2000)", "hashcat": 131, "john": "mssql", "extended": false, "description": null } ] }, { "regex": "^[a-f0-9]{96}$", "modes": [ { "name": "SHA-384", "hashcat": 10800, "john": "raw-sha384", "extended": false, "description": null }, { "name": "SHA3-384", "hashcat": null, "john": null, "extended": false, "description": null }, { "name": "Skein-512(384)", "hashcat": null, "john": null, "extended": false, "description": null }, { "name": "Skein-1024(384)", "hashcat": null, "john": null, "extended": false, "description": null } ] }, { "regex": "^{SSHA512}[a-z0-9\\/+]{96}$", "modes": [ { "name": "SSHA-512(Base64)", "hashcat": 1711, "john": "ssha512", "extended": false, "description": null }, { "name": "LDAP(SSHA-512)", "hashcat": 1711, "john": "ssha512", "extended": false, "description": null } ] }, { "regex": "^{ssha512}[0-9]{2}\\$[a-z0-9\\/.]{16,48}\\$[a-z0-9\\/.]{86}$", "modes": [ { "name": "AIX(ssha512)", "hashcat": 6500, "john": "aix-ssha512", "extended": false, "description": null } ] }, { "regex": "^[a-f0-9]{128}(:.+)?$", "modes": [ { "name": "SHA-512", "hashcat": 1700, "john": "raw-sha512", "extended": false, "description": "Used in Bitcoin Blockchain and Shadow Files." }, { "name": "Keccak-512", "hashcat": 1800, "john": null, "extended": false, "description": null }, { "name": "Whirlpool", "hashcat": 6100, "john": "whirlpool", "extended": false, "description": null }, { "name": "Salsa10", "hashcat": null, "john": null, "extended": false, "description": "[link = https://bugs.php.net/bug.php?id=60783]Not considered a hash function.[/link]" }, { "name": "Salsa20", "hashcat": null, "john": null, "extended": false, "description": "[link = https://bugs.php.net/bug.php?id=60783]Not considered a hash function.[/link]" }, { "name": "Blake2", "hashcat": 600, "john": "raw-blake2", "extended": false, "description": "[link = https://en.wikipedia.org/wiki/BLAKE_(hash_function)#Users_of_BLAKE2]Used in Wireguard, Zcash, IPFS and more.[/link]" }, { "name": "SHA3-512", "hashcat": 17600, "john": "raw-sha3", "extended": false, "description": null }, { "name": "Skein-512", "hashcat": null, "john": "skein-512", "extended": false, "description": null }, { "name": "Skein-1024(512)", "hashcat": null, "john": null, "extended": false, "description": null }, { "name": "sha512($pass.$salt)", "hashcat": 1710, "john": null, "extended": true, "description": null }, { "name": "sha512($salt.$pass)", "hashcat": 1720, "john": null, "extended": true, "description": null }, { "name": "sha512(unicode($pass).$salt)", "hashcat": 1730, "john": null, "extended": true, "description": null }, { "name": "sha512($salt.unicode($pass))", "hashcat": 1740, "john": null, "extended": true, "description": null }, { "name": "HMAC-SHA512 (key = $pass)", "hashcat": 1750, "john": "hmac-sha512", "extended": true, "description": null }, { "name": "Keccak-384", "hashcat": 17900, "john": null, "extended": false, "description": null }, { "name": "Keccak-256", "hashcat": 17800, "john": null, "extended": false, "description": null }, { "name": "Keccak-224", "hashcat": 17700, "john": null, "extended": false, "description": null }, { "name": "HMAC-SHA512 (key = $salt)", "hashcat": 1760, "john": "hmac-sha512", "extended": true, "description": null } ] }, { "regex": "^[a-f0-9]{136}$", "modes": [ { "name": "OSX v10.7", "hashcat": 1722, "john": "xsha512", "extended": false, "description": null } ] }, { "regex": "^0x0200[a-f0-9]{136}$", "modes": [ { "name": "MSSQL(2012)", "hashcat": 1731, "john": "msql12", "extended": false, "description": null }, { "name": "MSSQL(2014)", "hashcat": 1731, "john": "msql12", "extended": false, "description": null } ] }, { "regex": "^\\$ml\\$[0-9]+\\$[a-f0-9]{64}\\$[a-f0-9]{128}$", "modes": [ { "name": "OSX v10.8", "hashcat": 7100, "john": "pbkdf2-hmac-sha512", "extended": false, "description": null }, { "name": "OSX v10.9", "hashcat": 7100, "john": "pbkdf2-hmac-sha512", "extended": false, "description": null } ] }, { "regex": "^[a-f0-9]{256}$", "modes": [ { "name": "Skein-1024", "hashcat": null, "john": null, "extended": false, "description": null } ] }, { "regex": "^grub\\.pbkdf2\\.sha512\\.[0-9]+\\.([a-f0-9]{128,2048}\\.|[0-9]+\\.)?[a-f0-9]{128}$", "modes": [ { "name": "GRUB 2", "hashcat": 7200, "john": null, "extended": false, "description": null } ] }, { "regex": "^sha1\\$[a-z0-9]+\\$[a-f0-9]{40}$", "modes": [ { "name": "Django(SHA-1)", "hashcat": 124, "john": null, "extended": false, "description": null } ] }, { "regex": "^[a-f0-9]{49}$", "modes": [ { "name": "Citrix Netscaler", "hashcat": 8100, "john": "citrix_ns10", "extended": false, "description": null } ] }, { "regex": "^\\$S\\$[a-z0-9\\/.]{52}$", "modes": [ { "name": "Drupal > v7.x", "hashcat": 7900, "john": "drupal7", "extended": false, "description": null } ] }, { "regex": "^\\$5\\$(rounds=[0-9]+\\$)?[a-z0-9\\/.]{0,16}\\$[a-z0-9\\/.]{43}$", "modes": [ { "name": "SHA-256 Crypt", "hashcat": 7400, "john": "sha256crypt", "extended": false, "description": null } ] }, { "regex": "^0x[a-f0-9]{4}[a-f0-9]{16}[a-f0-9]{64}$", "modes": [ { "name": "Sybase ASE", "hashcat": 8000, "john": "sybasease", "extended": false, "description": null } ] }, { "regex": "^\\$6\\$(rounds=[0-9]+\\$)?[a-z0-9\\/.]{0,16}\\$[a-z0-9\\/.]{86}$", "modes": [ { "name": "SHA-512 Crypt", "hashcat": 1800, "john": "sha512crypt", "extended": false, "description": null } ] }, { "regex": "^\\$sha\\$[a-z0-9]{1,16}\\$([a-f0-9]{32}|[a-f0-9]{40}|[a-f0-9]{64}|[a-f0-9]{128}|[a-f0-9]{140})$", "modes": [ { "name": "Minecraft(AuthMe Reloaded)", "hashcat": null, "john": null, "extended": false, "description": null } ] }, { "regex": "^sha256\\$[a-z0-9]+\\$[a-f0-9]{64}$", "modes": [ { "name": "Django(SHA-256)", "hashcat": null, "john": null, "extended": false, "description": null } ] }, { "regex": "^sha384\\$[a-z0-9]+\\$[a-f0-9]{96}$", "modes": [ { "name": "Django(SHA-384)", "hashcat": null, "john": null, "extended": false, "description": null } ] }, { "regex": "^crypt1:[a-z0-9+=]{12}:[a-z0-9+=]{12}$", "modes": [ { "name": "Clavister Secure Gateway", "hashcat": null, "john": null, "extended": false, "description": null } ] }, { "regex": "^[a-f0-9]{112}$", "modes": [ { "name": "Cisco VPN Client(PCF-File)", "hashcat": null, "john": null, "extended": false, "description": null } ] }, { "regex": "^[a-f0-9]{1329}$", "modes": [ { "name": "Microsoft MSTSC(RDP-File)", "hashcat": null, "john": null, "extended": false, "description": null } ] }, { "regex": "^[^\\\\\\/:*?\"<>|]{1,20}[:]{2,3}([^\\\\\\/:*?\"<>|]{1,20})?:[a-f0-9]{48}:[a-f0-9]{48}:[a-f0-9]{16}$", "modes": [ { "name": "NetNTLMv1-VANILLA / NetNTLMv1+ESS", "hashcat": 5500, "john": "netntlm", "extended": false, "description": null } ] }, { "regex": "^([^\\\\\\/:*?\"<>|]{1,20}\\\\)?[^\\\\\\/:*?\"<>|]{1,20}[:]{2,3}([^\\\\\\/:*?\"<>|]{1,20}:)?[^\\\\\\/:*?\"<>|]{1,20}:[a-f0-9]{32}:[a-f0-9]+$", "modes": [ { "name": "NetNTLMv2", "hashcat": 5600, "john": "netntlmv2", "extended": false, "description": null } ] }, { "regex": "^\\$(krb5pa|mskrb5)\\$(23)?\\$.+\\$[a-f0-9]{1,}$", "modes": [ { "name": "Kerberos 5 AS-REQ Pre-Auth", "hashcat": 7500, "john": "krb5pa-md5", "extended": false, "description": null } ] }, { "regex": "^\\$scram\\$[0-9]+\\$[a-z0-9\\/.]{16}\\$sha-1=[a-z0-9\\/.]{27},sha-256=[a-z0-9\\/.]{43},sha-512=[a-z0-9\\/.]{86}$", "modes": [ { "name": "SCRAM Hash", "hashcat": null, "john": null, "extended": false, "description": null } ] }, { "regex": "^[a-f0-9]{40}:[a-f0-9]{0,32}$", "modes": [ { "name": "Redmine Project Management Web App", "hashcat": 7600, "john": null, "extended": false, "description": null } ] }, { "regex": "^(.+)?\\$[a-f0-9]{16}$", "modes": [ { "name": "SAP CODVN B (BCODE)", "hashcat": 7700, "john": "sapb", "extended": false, "description": null } ] }, { "regex": "^(.+)?\\$[a-f0-9]{40}$", "modes": [ { "name": "SAP CODVN F/G (PASSCODE)", "hashcat": 7800, "john": "sapg", "extended": false, "description": null } ] }, { "regex": "^(.+\\$)?[a-z0-9\\/.+]{30}(:.+)?$", "modes": [ { "name": "Juniper Netscreen/SSG(ScreenOS)", "hashcat": 22, "john": "md5ns", "extended": false, "description": null } ] }, { "regex": "^0x[a-f0-9]{60}\\s0x[a-f0-9]{40}$", "modes": [ { "name": "EPi", "hashcat": 123, "john": null, "extended": false, "description": null } ] }, { "regex": "^[a-f0-9]{40}:[^*]{1,25}$", "modes": [ { "name": "SMF \u2265 v1.1", "hashcat": 121, "john": null, "extended": false, "description": null } ] }, { "regex": "^(\\$wbb3\\$\\*1\\*)?[a-f0-9]{40}[:*][a-f0-9]{40}$", "modes": [ { "name": "Woltlab Burning Board 3.x", "hashcat": 8400, "john": "wbb3", "extended": false, "description": null } ] }, { "regex": "^[a-f0-9]{130}(:[a-f0-9]{40})?$", "modes": [ { "name": "IPMI2 RAKP HMAC-SHA1", "hashcat": 7300, "john": null, "extended": false, "description": null } ] }, { "regex": "^[a-f0-9]{32}:[0-9]+:[a-z0-9_.+-]+@[a-z0-9-]+\\.[a-z0-9-.]+$", "modes": [ { "name": "Lastpass", "hashcat": 6800, "john": null, "extended": false, "description": null } ] }, { "regex": "^[a-z0-9\\/.]{16}([:$].{1,})?$", "modes": [ { "name": "Cisco-ASA(MD5)", "hashcat": 2410, "john": "asa-md5", "extended": false, "description": null } ] }, { "regex": "^\\$vnc\\$\\*[a-f0-9]{32}\\*[a-f0-9]{32}$", "modes": [ { "name": "VNC", "hashcat": null, "john": "vnc", "extended": false, "description": null } ] }, { "regex": "^[a-z0-9]{32}(:([a-z0-9-]+\\.)?[a-z0-9-.]+\\.[a-z]{2,7}:.+:[0-9]+)?$", "modes": [ { "name": "DNSSEC(NSEC3)", "hashcat": 8300, "john": null, "extended": false, "description": null } ] }, { "regex": "^(user-.+:)?\\$racf\\$\\*.+\\*[a-f0-9]{16}$", "modes": [ { "name": "RACF", "hashcat": 8500, "john": "racf", "extended": false, "description": null } ] }, { "regex": "^\\$3\\$\\$[a-f0-9]{32}$", "modes": [ { "name": "NTHash(FreeBSD Variant)", "hashcat": null, "john": null, "extended": false, "description": null } ] }, { "regex": "^\\$sha1\\$[0-9]+\\$[a-z0-9\\/.]{0,64}\\$[a-z0-9\\/.]{28}$", "modes": [ { "name": "SHA-1 Crypt", "hashcat": null, "john": "sha1crypt", "extended": false, "description": null } ] }, { "regex": "^[a-f0-9]{70}$", "modes": [ { "name": "hMailServer", "hashcat": 1421, "john": "hmailserver", "extended": false, "description": null } ] }, { "regex": "^[:\\$][AB][:\\$]([a-f0-9]{1,8}[:\\$])?[a-f0-9]{32}$", "modes": [ { "name": "MediaWiki", "hashcat": 3711, "john": "mediawiki", "extended": false, "description": null } ] }, { "regex": "^[a-f0-9]{140}$", "modes": [ { "name": "Minecraft(xAuth)", "hashcat": null, "john": null, "extended": false, "description": null } ] }, { "regex": "^\\$pbkdf2(-sha1)?\\$[0-9]+\\$[a-z0-9\\/.]+\\$[a-z0-9\\/.]{27}$", "modes": [ { "name": "PBKDF2-SHA1(Generic)", "hashcat": null, "john": null, "extended": false, "description": null } ] }, { "regex": "^\\$pbkdf2-sha256\\$[0-9]+\\$[a-z0-9\\/.]+\\$[a-z0-9\\/.]{43}$", "modes": [ { "name": "PBKDF2-SHA256(Generic)", "hashcat": null, "john": "pbkdf2-hmac-sha256", "extended": false, "description": null } ] }, { "regex": "^\\$pbkdf2-sha512\\$[0-9]+\\$[a-z0-9\\/.]+\\$[a-z0-9\\/.]{86}$", "modes": [ { "name": "PBKDF2-SHA512(Generic)", "hashcat": null, "john": null, "extended": false, "description": null } ] }, { "regex": "^\\$p5k2\\$[0-9]+\\$[a-z0-9\\/+=-]+\\$[a-z0-9\\/+-]{27}=$", "modes": [ { "name": "PBKDF2(Cryptacular)", "hashcat": null, "john": null, "extended": false, "description": null } ] }, { "regex": "^\\$p5k2\\$[0-9]+\\$[a-z0-9\\/.]+\\$[a-z0-9\\/.]{32}$", "modes": [ { "name": "PBKDF2(Dwayne Litzenberger)", "hashcat": null, "john": null, "extended": false, "description": null } ] }, { "regex": "^{FSHP[0123]\\|[0-9]+\\|[0-9]+}[a-z0-9\\/+=]+$", "modes": [ { "name": "Fairly Secure Hashed Password", "hashcat": null, "john": null, "extended": false, "description": null } ] }, { "regex": "^\\$PHPS\\$.+\\$[a-f0-9]{32}$", "modes": [ { "name": "PHPS", "hashcat": 2612, "john": "phps", "extended": false, "description": null } ] }, { "regex": "^[0-9]{4}:[a-f0-9]{16}:[a-f0-9]{2080}$", "modes": [ { "name": "1Password(Agile Keychain)", "hashcat": 6600, "john": null, "extended": false, "description": null } ] }, { "regex": "^[a-f0-9]{64}:[a-f0-9]{32}:[0-9]{5}:[a-f0-9]{608}$", "modes": [ { "name": "1Password(Cloud Keychain)", "hashcat": 8200, "john": null, "extended": false, "description": null } ] }, { "regex": "^[a-f0-9]{256}:[a-f0-9]{256}:[a-f0-9]{16}:[a-f0-9]{16}:[a-f0-9]{320}:[a-f0-9]{16}:[a-f0-9]{40}:[a-f0-9]{40}:[a-f0-9]{32}$", "modes": [ { "name": "IKE-PSK MD5", "hashcat": 5300, "john": null, "extended": false, "description": null } ] }, { "regex": "^[a-f0-9]{256}:[a-f0-9]{256}:[a-f0-9]{16}:[a-f0-9]{16}:[a-f0-9]{320}:[a-f0-9]{16}:[a-f0-9]{40}:[a-f0-9]{40}:[a-f0-9]{40}$", "modes": [ { "name": "IKE-PSK SHA1", "hashcat": 5400, "john": null, "extended": false, "description": null } ] }, { "regex": "^[a-z0-9\\/+]{27}=$", "modes": [ { "name": "PeopleSoft", "hashcat": 133, "john": null, "extended": false, "description": null } ] }, { "regex": "^crypt\\$[a-f0-9]{5}\\$[a-z0-9\\/.]{13}$", "modes": [ { "name": "Django(DES Crypt Wrapper)", "hashcat": null, "john": null, "extended": false, "description": null } ] }, { "regex": "^(\\$django\\$\\*1\\*)?pbkdf2_sha256\\$[0-9]+\\$[a-z0-9]+\\$[a-z0-9\\/+=]{44}$", "modes": [ { "name": "Django(PBKDF2-HMAC-SHA256)", "hashcat": 10000, "john": "django", "extended": false, "description": null } ] }, { "regex": "^pbkdf2_sha1\\$[0-9]+\\$[a-z0-9]+\\$[a-z0-9\\/+=]{28}$", "modes": [ { "name": "Django(PBKDF2-HMAC-SHA1)", "hashcat": null, "john": null, "extended": false, "description": null } ] }, { "regex": "^bcrypt(\\$2[axy]|\\$2)\\$[0-9]{2}\\$[a-z0-9\\/.]{53}$", "modes": [ { "name": "Django(bcrypt)", "hashcat": null, "john": null, "extended": false, "description": null } ] }, { "regex": "^md5\\$[a-f0-9]+\\$[a-f0-9]{32}$", "modes": [ { "name": "Django(MD5)", "hashcat": null, "john": null, "extended": false, "description": null } ] }, { "regex": "^\\{PKCS5S2\\}[a-z0-9\\/+]{64}$", "modes": [ { "name": "PBKDF2(Atlassian)", "hashcat": null, "john": null, "extended": false, "description": null } ] }, { "regex": "^md5[a-f0-9]{32}$", "modes": [ { "name": "PostgreSQL MD5", "hashcat": null, "john": null, "extended": false, "description": null } ] }, { "regex": "^\\([a-z0-9\\/+]{49}\\)$", "modes": [ { "name": "Lotus Notes/Domino 8", "hashcat": 9100, "john": null, "extended": false, "description": null } ] }, { "regex": "^SCRYPT:[0-9]{1,}:[0-9]{1}:[0-9]{1}:[a-z0-9:\\/+=]{1,}$", "modes": [ { "name": "scrypt", "hashcat": 8900, "john": null, "extended": false, "description": "Used in Dogecoin and Litecoin." } ] }, { "regex": "^\\$8\\$[a-z0-9\\/.]{14}\\$[a-z0-9\\/.]{43}$", "modes": [ { "name": "Cisco Type 8", "hashcat": 9200, "john": "cisco8", "extended": false, "description": null } ] }, { "regex": "^\\$9\\$[a-z0-9\\/.]{14}\\$[a-z0-9\\/.]{43}$", "modes": [ { "name": "Cisco Type 9", "hashcat": 9300, "john": "cisco9", "extended": false, "description": null } ] }, { "regex": "^\\$office\\$\\*2007\\*[0-9]{2}\\*[0-9]{3}\\*[0-9]{2}\\*[a-z0-9]{32}\\*[a-z0-9]{32}\\*[a-z0-9]{40}$", "modes": [ { "name": "Microsoft Office 2007", "hashcat": 9400, "john": "office", "extended": false, "description": null } ] }, { "regex": "^\\$office\\$\\*2010\\*[0-9]{6}\\*[0-9]{3}\\*[0-9]{2}\\*[a-z0-9]{32}\\*[a-z0-9]{32}\\*[a-z0-9]{64}$", "modes": [ { "name": "Microsoft Office 2010", "hashcat": 9500, "john": null, "extended": false, "description": null } ] }, { "regex": "^\\$office\\$\\*2013\\*[0-9]{6}\\*[0-9]{3}\\*[0-9]{2}\\*[a-z0-9]{32}\\*[a-z0-9]{32}\\*[a-z0-9]{64}$", "modes": [ { "name": "Microsoft Office 2013", "hashcat": 9600, "john": null, "extended": false, "description": null } ] }, { "regex": "^\\$fde\\$[0-9]{2}\\$[a-f0-9]{32}\\$[0-9]{2}\\$[a-f0-9]{32}\\$[a-f0-9]{3072}$", "modes": [ { "name": "Android FDE \u2264 4.3", "hashcat": 8800, "john": "fde", "extended": false, "description": null } ] }, { "regex": "\\$krb5tgs\\$23\\$\\*[^*]*\\*\\$[a-f0-9]{32}\\$[a-f0-9]{64,40960}", "modes": [ { "name": "Kerberos 5 TGS-REP etype 23", "hashcat": 13100, "john": "krb5tgs", "extended": false, "description": "Used in Windows Active Directory." } ] }, { "regex": "^\\$oldoffice\\$[01]\\*[a-f0-9]{32}\\*[a-f0-9]{32}\\*[a-f0-9]{32}$", "modes": [ { "name": "Microsoft Office \u2264 2003 (MD5+RC4)", "hashcat": 9700, "john": "oldoffice", "extended": false, "description": null }, { "name": "Microsoft Office \u2264 2003 (MD5+RC4) collider-mode #1", "hashcat": 9710, "john": "oldoffice", "extended": false, "description": null }, { "name": "Microsoft Office \u2264 2003 (MD5+RC4) collider-mode #2", "hashcat": 9720, "john": "oldoffice", "extended": false, "description": null } ] }, { "regex": "^\\$oldoffice\\$[34]\\*[a-f0-9]{32}\\*[a-f0-9]{32}\\*[a-f0-9]{40}$", "modes": [ { "name": "Microsoft Office \u2264 2003 (SHA1+RC4)", "hashcat": 9800, "john": null, "extended": false, "description": null }, { "name": "Microsoft Office \u2264 2003 (SHA1+RC4) collider-mode #1", "hashcat": 9810, "john": null, "extended": false, "description": null }, { "name": "Microsoft Office \u2264 2003 (SHA1+RC4) collider-mode #2", "hashcat": 9820, "john": null, "extended": false, "description": null } ] }, { "regex": "^(\\$radmin2\\$)?[a-f0-9]{32}$", "modes": [ { "name": "RAdmin v2.x", "hashcat": 9900, "john": "radmin", "extended": false, "description": null } ] }, { "regex": "^{x-issha,\\s[0-9]{4}}[a-z0-9\\/+=]+$", "modes": [ { "name": "SAP CODVN H (PWDSALTEDHASH) iSSHA-1", "hashcat": 10300, "john": "saph", "extended": false, "description": null } ] }, { "regex": "^\\$cram_md5\\$[a-z0-9\\/+=-]+\\$[a-z0-9\\/+=-]{52}$", "modes": [ { "name": "CRAM-MD5", "hashcat": 10200, "john": null, "extended": false, "description": null } ] }, { "regex": "^[a-f0-9]{16}:2:4:[a-f0-9]{32}$", "modes": [ { "name": "SipHash", "hashcat": 10100, "john": null, "extended": false, "description": null } ] }, { "regex": "^[a-f0-9]{4,}$", "modes": [ { "name": "Cisco Type 7", "hashcat": null, "john": null, "extended": true, "description": null } ] }, { "regex": "^[a-z0-9\\/.]{13,}$", "modes": [ { "name": "BigCrypt", "hashcat": null, "john": "bigcrypt", "extended": true, "description": null } ] }, { "regex": "^(\\$cisco4\\$)?[a-z0-9\\/.]{43}$", "modes": [ { "name": "Cisco Type 4", "hashcat": null, "john": "cisco4", "extended": false, "description": null } ] }, { "regex": "^bcrypt_sha256\\$\\$(2[axy]|2)\\$[0-9]+\\$[a-z0-9\\/.]{53}$", "modes": [ { "name": "Django(bcrypt-SHA256)", "hashcat": null, "john": null, "extended": false, "description": null } ] }, { "regex": "^\\$postgres\\$.[^\\*]+[*:][a-f0-9]{1,32}[*:][a-f0-9]{32}$", "modes": [ { "name": "PostgreSQL Challenge-Response Authentication (MD5)", "hashcat": 11100, "john": "postgres", "extended": false, "description": null } ] }, { "regex": "^\\$siemens-s7\\$[0-9]{1}\\$[a-f0-9]{40}\\$[a-f0-9]{40}$", "modes": [ { "name": "Siemens-S7", "hashcat": null, "john": "siemens-s7", "extended": false, "description": null } ] }, { "regex": "^(\\$pst\\$)?[a-f0-9]{8}$", "modes": [ { "name": "Microsoft Outlook PST", "hashcat": null, "john": null, "extended": false, "description": null } ] }, { "regex": "^sha256[:$][0-9]+[:$][a-z0-9\\/+]+[:$][a-z0-9\\/+]{32,128}$", "modes": [ { "name": "PBKDF2-HMAC-SHA256(PHP)", "hashcat": 10900, "john": null, "extended": false, "description": null } ] }, { "regex": "^(\\$dahua\\$)?[a-z0-9]{8}$", "modes": [ { "name": "Dahua", "hashcat": null, "john": "dahua", "extended": false, "description": null } ] }, { "regex": "^\\$mysqlna\\$[a-f0-9]{40}[:*][a-f0-9]{40}$", "modes": [ { "name": "MySQL Challenge-Response Authentication (SHA1)", "hashcat": 11200, "john": null, "extended": false, "description": null } ] }, { "regex": "^\\$pdf\\$[24]\\*[34]\\*128\\*[0-9-]{1,5}\\*1\\*(16|32)\\*[a-f0-9]{32,64}\\*32\\*[a-f0-9]{64}\\*(8|16|32)\\*[a-f0-9]{16,64}$", "modes": [ { "name": "PDF 1.4 - 1.6 (Acrobat 5 - 8)", "hashcat": 10500, "john": "pdf", "extended": false, "description": null } ] }, { "regex": "^\\$krb5asrep\\$23\\$[^:]+:[a-f0-9]{32,32}\\$[a-f0-9]{64,40960}$", "modes": [ { "name": "Kerberos 5 AS-REP etype 23", "hashcat": 18200, "john": "krb5pa-sha1", "extended": false, "description": "Used for Windows Active Directory" } ] }, { "regex": "^\\$krb5tgs\\$17\\$[^$]{1,512}\\$[^$]{1,512}\\$[^$]{1,4}?\\$?[a-f0-9]{1,32}\\$[a-f0-9]{64,40960}$", "modes": [ { "name": "Kerberos 5 TGS-REP etype 17 (AES128-CTS-HMAC-SHA1-96)", "hashcat": 19600, "john": null, "extended": false, "description": "Used for Windows Active Directory" } ] }, { "regex": "^\\$krb5tgs\\$18\\$[^$]{1,512}\\$[^$]{1,512}\\$[^$]{1,4}?\\$?[a-f0-9]{1,32}\\$[a-f0-9]{64,40960}", "modes": [ { "name": "Kerberos 5 TGS-REP etype 18 (AES256-CTS-HMAC-SHA1-96)", "hashcat": 19700, "john": null, "extended": false, "description": "Used for Windows Active Directory" } ] }, { "regex": "^\\$krb5pa\\$17\\$[^$]{1,512}\\$[^$]{1,512}\\$[a-f0-9]{104,112}$", "modes": [ { "name": "Kerberos 5, etype 17, Pre-Auth", "hashcat": 19800, "john": null, "extended": false, "description": "Used for Windows Active Directory" } ] }, { "regex": "^\\$krb5pa\\$17\\$[^$]{1,512}\\$[^$]{1,512}\\$[^$]{0,512}\\$[a-f0-9]{104,112}$", "modes": [ { "name": "Kerberos 5, etype 17, Pre-Auth (with salt)", "hashcat": null, "john": "krb5pa-sha1", "extended": false, "description": "Used for Windows Active Directory" } ] }, { "regex": "^\\$krb5pa\\$18\\$[^$]{1,512}\\$[^$]{1,512}\\$[^$]{0,512}\\$[a-f0-9]{104,112}$", "modes": [ { "name": "Kerberos 5, etype 18, Pre-Auth (with salt)", "hashcat": null, "john": "krb5pa-sha1", "extended": false, "description": "Used for Windows Active Directory" } ] }, { "regex": "^\\$krb5pa\\$18\\$[^$]{1,512}\\$[^$]{1,512}\\$[a-f0-9]{104,112}$", "modes": [ { "name": "Kerberos 5, etype 18, Pre-Auth", "hashcat": 19900, "john": null, "extended": false, "description": "Used for Windows Active Directory" } ] }, { "regex": "\\$bitcoin\\$[0-9]{2,4}\\$[a-fA-F0-9$]{250,350}", "modes": [ { "name": "Bitcoin / Litecoin", "hashcat": 11300, "john": "bitcoin", "extended": false, "description": "Use Bitcoin2John.py to extract the hash for cracking." } ] }, { "regex": "\\$ethereum\\$[a-z0-9*]{150,250}", "modes": [ { "name": "Ethereum Wallet, PBKDF2-HMAC-SHA256", "hashcat": 15600, "john": "ethereum-opencl", "extended": false, "description": "Use ethereum2john.py to crack." }, { "name": "Ethereum Pre-Sale Wallet, PBKDF2-HMAC-SHA256", "hashcat": 16300, "john": "ethereum-presale-opencl", "extended": false, "description": "Use ethereum2john.py to crack." } ] }, { "regex": "\\$monero\\$(0)\\*[a-f0-9]{32,3196}", "modes": [ { "name": "Monero", "hashcat": null, "john": "monero", "extended": false, "description": "Use monero2john.py to crack." } ] } ]