Thread: Password Hash - Brute Force Test - SHA-1

Hi.

So i have some password hashes for example:

c2543fff3bfa6f144c2f06a7de6cd10c0b650cae

The input of the program is one of these hashed codes. What i need to do is use SHA-1 to get the original password and print it out to the user. I am really stuck, so far i have just declared all my password hashes as Strings. Is this right or should they be HexStrings ? Byte Arrays ? Char Arrays ? I am really not sure.

I have been on to the Wiki page for SHA-1 but i can't really see any formula's to calculate the password.

Am i also right in saying the format of these hashed passwords is hexadecimal ?

Lol no, its a school task.

I should add:

This should be done using Brute Force Test. I think i might be reading the wrong stuff and going down the wrong routes. I am seeing a lot of MessageDigest.getInstance("SHA-1") . Do you think this is used ?

The input of the program is one of these hashed codes. What i need to do is use SHA-1 to get the original password

The solution is:

public class BruteForceDecryptSinglePasswordFromSingleBitString
{
  /**
   * @param args don't bother supplying parameters - it won't effect the chance of success
   * @returns correct answer with non-zero probability, probably
   */
  public static void main(String[] args)
  {
    System.out.println("The password is 'MyDogsNameIsShep'");
  }
}

Oh wait, maybe that's not right. Are you sure the exercise wasn't to *guess* the password? That would be a nice undergrad exercise. For that you'd need to write some kind of loop (you could alternatively make random guesses) which generated candidate password strings, transform them with SHA-1 (you will need the fragment of code you posted earlier) and then compare the output to your given hash. If that is the exercise, then I would go with a loop counting up from zero, a character set and a mapping of count to candidate password (Integer.toString(int, int) might be your friend here). Don't run that code on a shared server. If you've got a multi-core PC (who hasn't these days? I bought a FX-8120 recently, coretastic), you could consider chunking the job and multi-threading it. Do it for personal satisfaction, not because it'll increase your chances from hopeless to hopeless-but-with-more-fan-noise.