Salt Alone Won't Save You
Salting password hashes is important, but not enough on it's own
Here are some entries from a recovered password database.
$(y3]<+9zmi4|$6Rup8P8oJnxK98aXa8HhGROLdvws9xmgawl7rsh2E5E= $b*.m,%~&<"^6$l93FR8Rq8a+YIUdcC2Kdake7/rlSU1zAr/9yAiRZVI0= $9bOv^Gu)oB&P$EdEfD9X20gQi+sUYRvHyuoCMGq7DCeD/UJSSDmCvjZA= $kPD)T)=~1K{r$BgOuh0tBaGKtcFscQvdwFBscgC+pYKW1qpFDDwTJRAA= $4.9.mHSbiQ]^$by2hg2rG18QKk9pMqa/Fb9vnJ5/NEvR5qpg9SVdy3nM= ${4[1m"WqdR0s$Vz+gAWYf/8PIKu7ILxaVFnDcNCzAcerci8caiCYgm2Y= $3ui!yKfT0[Si$QZJcfHWh+OsdkgkrrZNp8ZkYlc3sWlT57PgC/YhmaRY=
The hashes use a strong salt but lucky for us the hashes were computed with just one iteration of a cryptographic hash function. Some of the passwords are present in the rock you password list. Recover the passwords that are in the rockyou list and submit them concatenated alphabetically.
The hash function used:
function hash(salt, password): hash_val = sha256(password | salt) # | denotes concatenation return '$' | salt | '$' | base64(hash_val)
Test Vector
Given these hashes$F&XUtH6krgmy$jZ83Epqxk7QUo7D6Rev2AEfQuvMHokwm/QBQDfR+r6Q= $UA~R<9E'\n9\$6XP2CXRjVfmCcuz2OWCtLPIVI/1J9ZQojr+MxRCUY/E= $_)lOt8&:j5%f$Gu99fWD+K8lsHE+0lizszH8Kkb5QPrjz3osT4/LFexo=We can see that the first was created from
jo353ph
, the second was created from a password not contained in the rockyou list, and the third was created from asiomas
. So the solution would be asiomasjo353ph
.