hashcat
快捷使用
1hashcat -a 0 -m 0 --force [hash] /usr/share/wordlist/rockyou.txt -o ./result [字典]2hashcat -a 0 -m 0 --force [hashfile] /usr/share/wordlist/rockyou.txt -o ./result [批量hash]3hashcat -a 3 -m 0 --force f2aec315704b5f007915bdbbae5a9f5c te?d?d?dst [掩码爆破]4hashcat -a 6 -m 0 --force 9dc9d5ed5031367d42543763423c24ee password.txt ?l?l?l?l?l [字典掩码]5hashcat [hash] --show简介
Hashcat是自称世界上最快的密码恢复工具。它在2015年之前拥有专有代码库，但现在作为免费软件发布。适用于Linux，OS X和Windows的版本可以使用基于CPU或基于GPU的变体。支持hashcat的散列算法有Microsoft LM哈希，MD4，MD5，SHA系列，Unix加密格式，MySQL和Cisco PIX等。
常用参数
1-a 指定要使用的破解模式，其值参考后面对参数。“-a 0”字典攻击，“-a 1” 组合攻击；“-a 3”掩码攻击。2-m 指定要破解的hash类型，如果不指定类型，则默认是MD53-o 指定破解成功后的hash及所对应的明文密码的存放位置,可以用它把破解成功的hash写到指定的文件中4--force 忽略破解过程中的警告信息,跑单条hash可能需要加上此选项5--show 显示已经破解的hash及该hash所对应的明文6--increment 启用增量破解模式,你可以利用此模式让hashcat在指定的密码长度范围内执行破解过程7--increment-min 密码最小长度,后面直接等于一个整数即可,配置increment模式一起使用8--increment-max 密码最大长度,同上9--outfile-format 指定破解结果的输出格式id,默认是310--username 忽略hash文件中的指定的用户名,在破解linux系统用户密码hash可能会用到11--remove 删除已被破解成功的hash12-r 使用自定义破解规则a参数破解模式
1# | Mode2===+======30 | Straight（字段破解）41 | Combination（多字典组合破解）53 | Brute-force（掩码暴力破解）66 | Hybrid Wordlist + Mask（字典+掩码破解）77 | Hybrid Mask + Wordlist（掩码+字典破解）m参数hash类型（详见文末）
1- [ Hash modes ] -23# | Name | Category4======+==================================================+======================================5900 | MD4 | Raw Hash60 | MD5 | Raw Hash75100 | Half MD5 | Raw Hash8100 | SHA1 | Raw Hash91300 | SHA2-224 | Raw Hash101400 | SHA2-256 | Raw Hash1110800 | SHA2-384 | Raw Hash121700 | SHA2-512 | Raw Hash1317300 | SHA3-224 | Raw Hash1417400 | SHA3-256 | Raw Hash1517500 | SHA3-384 | Raw Hash1617600 | SHA3-512 | Raw Hash1710 | md5($pass.$salt) | Raw Hash, Salted and/or Iterated1820 | md5($salt.$pass) | Raw Hash, Salted and/or Iterated掩码设置
- 常见字符集
1l | abcdefghijklmnopqrstuvwxyz 纯小写字母(lower)2u | ABCDEFGHIJKLMNOPQRSTUVWXYZ 纯大写字母(upper)3d | 0123456789 纯数字(decimal)4h | 0123456789abcdef 常见小写子目录和数字(hex)5H | 0123456789ABCDEF 常见大写字母和数字(HEX)6s | !"#$%&'()*+,-./:;<=>?@[\]^_`{|}~ 特殊字符(special)7a | ?l?u?d?s 键盘上所有可见的字符(all_printable)8b | 0x00 - 0xff 可能是用来匹配像空格这种密码的(bin)- eg：
1八位数字密码：?d?d?d?d?d?d?d?d2八位未知密码：?a?a?a?a?a?a?a?a3前四位为大写字母，后面四位为数字：?u?u?u?u?d?d?d?d4前四位为数字或者是小写字母，后四位为大写字母或者数字：?h?h?h?h?H?H?H?H5前三个字符未知，中间为admin，后三位未知：?a?a?aadmin?a?a?a66-8位数字密码：--increment --increment-min 6 --increment-max 8 ?l?l?l?l?l?l?l?l76-8位数字+小写字母密码：--increment --increment-min 6 --increment-max 8 ?h?h?h?h?h?h?h?h
` hashcat -a 3 -m 0 --force 25c3e88f81b4853f2a8faacad4c871b6 ?d?d?d?d?d?d?d`
- #### 7位小写字母破解
`hashcat -a 3 -m 0 --force 4488cec2aea535179e085367d8a17d75 ?l?l?l?l?l?l?l`
- #### 1-8位小写字母+数字破解
`hashcat -a 3 -m 0 --force 4488cec2aea535179e085367d8a17d75 --incement --increment-min 1 --inrement-max 8 h?h?h?h?h??h?h?h`
- #### 1-8位为特定字符集：123456abcdf!@+-
`hashcat -a 3 -m 0 --force -1 123456abcdf!@+- 8b78ba5089b11326290bc15cf0b9a07d --increment --increment-min 1 --increment-max 8 ?1?1?1?1?1?1?1?1?1?1`
- #### 1-8位数字+大小写字母+可见特殊符号
`hashcat -a 3 -m 0 --force -1 ?d?l?u?s d37fc9ee39dd45a7717e3e3e9415f65d --increment --increment-min 1 --increment-max 8 ?1?1?1?1?1?1?1?1`
or
`hashcat -a 3 -m 0 --force d37fc9ee39dd45a7717e3e3e9415f65d --increment --increment-min 1 --increment-max 8 ?a?a?a?a?a?a?a?a`
- #### 字典破解
`hashcat -a 0 -m 0 --force [hash] password.txt -o ./result`
#### 批量爆破
`hashcat -a 0 -m 0 --force [hashfile] password.txt -o ./result`
- #### 字典组合破解
`hashcat -a 1 -m 0 --force [hash] pwd1.txt pwd2.txt`
- #### 字典加掩码破解
`hashcat -a 6 9dc9d5ed5031367d42543763423c24ee pwd.txt ?l?l?l?l?l`密码类型实例
mysql4.1/5 passwod
1hashcat -a 3 -m 300 --force 6BB4837EB74329105EE4568DDA7DC67ED2CA2AD9 ?d?d?d?d?d?dsha512crypt $6$, SHA512 (Unix)破解
1hashcate -a 3 -m 1800 --force $6$mxuA5cdy$XZRk0CvnPFqOgVopqiPEFAFK72SogKVwwwp7gWaUOb7b6tVwfCpcSUsCEk64ktLLYmzyew/xd0O0hPG/yrm2X. ?l?l?l?l不用整理用户名，使用–username
1hashcat -a 3 -m 1800 --force qiyou:$6$QDq75ki3$jsKm7qTDHz/xBob0kF1Lp170Cgg0i5Tslf3JW/sm9k9Q916mBTyilU3PoOsbRdxV8TAmzvdgNjrCuhfg3jKMY1 ?l?l?l?l?l --usernameWindows NT-hash，LM-hash破解
1NT-hash:2hashcat -a 3 -m 1000 209C6174DA490CAEB422F3FA5A7AE634 ?l?l?l?l?l3LM-hash:4hashcat -a 3 -m 3000 F0D412BD764FFE81AAD3B435B51404EE ?l?l?l?l?lMSSQL
1hashcat -a 3 -m 132 --force 0x01008c8006c224f71f6bf0036f78d863c3c4ff53f8c3c48edafb ?l?l?l?l?l?d?d?dwordpress密码hash破解
具体加密脚本在
./wp-includes/class-phpass.php的HashPassword函数1hashcat -a 3 -m 400 --force $P$BYEYcHEj3vDhV1lwGBv6rpxurKOEWY/ ?d?d?d?d?d?ddiscuz用户密码hash破解
其密码加密方式md5(md5($pass).$salt)
1hashcat -a 3 -m 2611 --force 14e1b600b1fd579f47433b88e8d85291: ?d?d?d?d?d?d破解RAR压缩密码
首先rar2john获取rar文件hash值
1rar2john.exe 1.rar1hashcate -a 3 -m 13000 --force $rar5$16$639e9ce8344c680da12e8bdd4346a6a3$15$a2b056a21a9836d8d48c2844d171b73d$8$04a52d2224ad082e ?d?d?d?d?d?d注意：
1hashcat 支持 RAR3-hp 和 RAR5，官方示例如下：23-m参数 类型 示例 hash412500 RAR3-hp $RAR3$*0*45109af8ab5f297a*adbf6c5385d7a40373e8f77d7b89d317513000 RAR5 $rar5$16$74575567518807622265582327032280$15$f8b4064de34ac02ecabfezip密码破解
1zip2john.exe 1.zip2结果：1.zip:$zip2$*0*3*0*554bb43ff71cb0cac76326f292119dfd*ff23*5*24b28885ee*d4fe362bb1e91319ab53*$/zip2$:::::1.zip-1.txt1hashcat -a 3 -m 13600 $zip2$*0*3*0*554bb43ff71cb0cac76326f292119dfd*ff23*5*24b28885ee*d4fe362bb1e91319ab53*$/zip2$ --force ?d?d?d?d?d?d破解office密码
1获取office的hash值：python office2john.py 11.docx1hashcat -a 3 -m 9600 $office$*2013*100000*256*16*e4a3eb62e8d3576f861f9eded75e0525*9eeb35f0849a7800d48113440b4bbb9c*577f8d8b2e1c5f60fed76e62327b38d28f25230f6c7dfd66588d9ca8097aabb9 --force ?d?d?d?d?d?d破解WIFI密码
首先先把我们的握手包转化为hccapx格式，现在最新版的hashcat只支持hccapx格式了，以前的hccap格式已经不支持了
1官方在线转化https://hashcat.net/cap2hccapx/2hashcat -a 3 -m 2500 1.hccapx 1391040?d?d?d?d
其他
对于破解过的hash值，用
hashcat64.exe hash --show查看结果所有的hash破解结果都在hashcat.potfile文件中
如果破解的时间太长，可以按s键可以查看破解的状态，p键暂停，r键继续破解，q键退出破解。
在使用GPU模式进行破解时，可以使用-O参数自动进行优化
在实际破解中的建议，如果我们盲目的去破解，会占用我们大量的时间和资源
11.首先走一遍常用的弱口令字典22.组合密码，如：zhang1999，用姓氏和出生年组合，当然也可以用其它的组合，这里举个例子而已33.把常用的掩码组合整理起来放在masks中的.hcmask文件中，然后让它自动加载破解44.如果实在不行，你可以尝试低位数的所有组合去跑，不过不建议太高位数的组合去破解，因为如果对方设置的密码很复杂的话，到头来你密码没有破解到，却浪费了大量的时间和资源，得不偿失6.HashCat参数优化
考虑到hashcat的破解速度以及资源的分配，我们可以对一些参数进行配置- Workload tuning 负载调优。
该参数支持的值有1,8,40,80,1601--gpu-accel 160 可以让GPU发挥最大性能。 - Gpu loops 负载微调
1--gpu-loops 1024 可以让GPU发挥最大性能。 - Segment size 字典缓存大小
1--segment-size 512 可以提高大字典破解的速度。
- Workload tuning 负载调优。
m 参数加密类型
[ Hash modes ] - 12# | Name | Category3=========+==================================================+=========================4900 | MD4 | Raw Hash50 | MD5 | Raw Hash65100 | Half MD5 | Raw Hash7100 | SHA1 | Raw Hash81300 | SHA2-224 | Raw Hash91400 | SHA2-256 | Raw Hash1010800 | SHA2-384 | Raw Hash111700 | SHA2-512 | Raw Hash1217300 | SHA3-224 | Raw Hash1317400 | SHA3-256 | Raw Hash1417500 | SHA3-384 | Raw Hash1517600 | SHA3-512 | Raw Hash1617700 | Keccak-224 | Raw Hash1717800 | Keccak-256 | Raw Hash1817900 | Keccak-384 | Raw Hash1918000 | Keccak-512 | Raw Hash20600 | BLAKE2b-512 | Raw Hash2110100 | SipHash | Raw Hash226000 | RIPEMD-160 | Raw Hash236100 | Whirlpool | Raw Hash246900 | GOST R 34.11-94 | Raw Hash2511700 | GOST R 34.11-2012 (Streebog) 256-bit, big-endian | Raw Hash2611800 | GOST R 34.11-2012 (Streebog) 512-bit, big-endian | Raw Hash2710 | md5($pass.$salt) | Raw Hash, Salted and/or Iterated2820 | md5($salt.$pass) | Raw Hash, Salted and/or Iterated2930 | md5(utf16le($pass).$salt) | Raw Hash, Salted and/or Iterated3040 | md5($salt.utf16le($pass)) | Raw Hash, Salted and/or Iterated313800 | md5($salt.$pass.$salt) | Raw Hash, Salted and/or Iterated323710 | md5($salt.md5($pass)) | Raw Hash, Salted and/or Iterated334010 | md5($salt.md5($salt.$pass)) | Raw Hash, Salted and/or Iterated344110 | md5($salt.md5($pass.$salt)) | Raw Hash, Salted and/or Iterated352600 | md5(md5($pass)) | Raw Hash, Salted and/or Iterated363910 | md5(md5($pass).md5($salt)) | Raw Hash, Salted and/or Iterated374300 | md5(strtoupper(md5($pass))) | Raw Hash, Salted and/or Iterated384400 | md5(sha1($pass)) | Raw Hash, Salted and/or Iterated39110 | sha1($pass.$salt) | Raw Hash, Salted and/or Iterated40120 | sha1($salt.$pass) | Raw Hash, Salted and/or Iterated41130 | sha1(utf16le($pass).$salt) | Raw Hash, Salted and/or Iterated42140 | sha1($salt.utf16le($pass)) | Raw Hash, Salted and/or Iterated434500 | sha1(sha1($pass)) | Raw Hash, Salted and/or Iterated444520 | sha1($salt.sha1($pass)) | Raw Hash, Salted and/or Iterated454700 | sha1(md5($pass)) | Raw Hash, Salted and/or Iterated464900 | sha1($salt.$pass.$salt) | Raw Hash, Salted and/or Iterated4714400 | sha1(CX) | Raw Hash, Salted and/or Iterated481410 | sha256($pass.$salt) | Raw Hash, Salted and/or Iterated491420 | sha256($salt.$pass) | Raw Hash, Salted and/or Iterated501430 | sha256(utf16le($pass).$salt) | Raw Hash, Salted and/or Iterated511440 | sha256($salt.utf16le($pass)) | Raw Hash, Salted and/or Iterated521710 | sha512($pass.$salt) | Raw Hash, Salted and/or Iterated531720 | sha512($salt.$pass) | Raw Hash, Salted and/or Iterated541730 | sha512(utf16le($pass).$salt) | Raw Hash, Salted and/or Iterated551740 | sha512($salt.utf16le($pass)) | Raw Hash, Salted and/or Iterated5650 | HMAC-MD5 (key = $pass) | Raw Hash, Authenticated5760 | HMAC-MD5 (key = $salt) | Raw Hash, Authenticated58150 | HMAC-SHA1 (key = $pass) | Raw Hash, Authenticated59160 | HMAC-SHA1 (key = $salt) | Raw Hash, Authenticated601450 | HMAC-SHA256 (key = $pass) | Raw Hash, Authenticated611460 | HMAC-SHA256 (key = $salt) | Raw Hash, Authenticated621750 | HMAC-SHA512 (key = $pass) | Raw Hash, Authenticated631760 | HMAC-SHA512 (key = $salt) | Raw Hash, Authenticated6411750 | HMAC-Streebog-256 (key = $pass), big-endian | Raw Hash, Authenticated6511760 | HMAC-Streebog-256 (key = $salt), big-endian | Raw Hash, Authenticated6611850 | HMAC-Streebog-512 (key = $pass), big-endian | Raw Hash, Authenticated6711860 | HMAC-Streebog-512 (key = $salt), big-endian | Raw Hash, Authenticated6814000 | DES (PT = $salt, key = $pass) | Raw Cipher, Known-Plaintext attack6914100 | 3DES (PT = $salt, key = $pass) | Raw Cipher, Known-Plaintext attack7014900 | Skip32 (PT = $salt, key = $pass) | Raw Cipher, Known-Plaintext attack7115400 | ChaCha20 | Raw Cipher, Known-Plaintext attack72400 | phpass | Generic KDF738900 | scrypt | Generic KDF7411900 | PBKDF2-HMAC-MD5 | Generic KDF7512000 | PBKDF2-HMAC-SHA1 | Generic KDF7610900 | PBKDF2-HMAC-SHA256 | Generic KDF7712100 | PBKDF2-HMAC-SHA512 | Generic KDF7823 | Skype | Network Protocols792500 | WPA-EAPOL-PBKDF2 | Network Protocols802501 | WPA-EAPOL-PMK | Network Protocols8116800 | WPA-PMKID-PBKDF2 | Network Protocols8216801 | WPA-PMKID-PMK | Network Protocols834800 | iSCSI CHAP authentication, MD5(CHAP) | Network Protocols845300 | IKE-PSK MD5 | Network Protocols855400 | IKE-PSK SHA1 | Network Protocols865500 | NetNTLMv1 | Network Protocols875500 | NetNTLMv1+ESS | Network Protocols885600 | NetNTLMv2 | Network Protocols897300 | IPMI2 RAKP HMAC-SHA1 | Network Protocols907500 | Kerberos 5 AS-REQ Pre-Auth etype 23 | Network Protocols918300 | DNSSEC (NSEC3) | Network Protocols9210200 | CRAM-MD5 | Network Protocols9311100 | PostgreSQL CRAM (MD5) | Network Protocols9411200 | MySQL CRAM (SHA1) | Network Protocols9511400 | SIP digest authentication (MD5) | Network Protocols9613100 | Kerberos 5 TGS-REP etype 23 | Network Protocols9716100 | TACACS+ | Network Protocols9816500 | JWT (JSON Web Token) | Network Protocols9918200 | Kerberos 5 AS-REP etype 23 | Network Protocols100121 | SMF (Simple Machines Forum) > v1.1 | Forums, CMS, E-Commerce, Frameworks101400 | phpBB3 (MD5) | Forums, CMS, E-Commerce, Frameworks1022611 | vBulletin < v3.8.5 | Forums, CMS, E-Commerce, Frameworks1032711 | vBulletin >= v3.8.5 | Forums, CMS, E-Commerce, Frameworks1042811 | MyBB 1.2+ | Forums, CMS, E-Commerce, Frameworks1052811 | IPB2+ (Invision Power Board) | Forums, CMS, E-Commerce, Frameworks1068400 | WBB3 (Woltlab Burning Board) | Forums, CMS, E-Commerce, Frameworks10711 | Joomla < 2.5.18 | Forums, CMS, E-Commerce, Frameworks108400 | Joomla >= 2.5.18 (MD5) | Forums, CMS, E-Commerce, Frameworks109400 | WordPress (MD5) | Forums, CMS, E-Commerce, Frameworks1102612 | PHPS | Forums, CMS, E-Commerce, Frameworks1117900 | Drupal7 | Forums, CMS, E-Commerce, Frameworks11221 | osCommerce | Forums, CMS, E-Commerce, Frameworks11321 | xt:Commerce | Forums, CMS, E-Commerce, Frameworks11411000 | PrestaShop | Forums, CMS, E-Commerce, Frameworks115124 | Django (SHA-1) | Forums, CMS, E-Commerce, Frameworks11610000 | Django (PBKDF2-SHA256) | Forums, CMS, E-Commerce, Frameworks11716000 | Tripcode | Forums, CMS, E-Commerce, Frameworks1183711 | MediaWiki B type | Forums, CMS, E-Commerce, Frameworks11913900 | OpenCart | Forums, CMS, E-Commerce, Frameworks1204521 | Redmine | Forums, CMS, E-Commerce, Frameworks1214522 | PunBB | Forums, CMS, E-Commerce, Frameworks12212001 | Atlassian (PBKDF2-HMAC-SHA1) | Forums, CMS, E-Commerce, Frameworks12312 | PostgreSQL | Database Server124131 | MSSQL (2000) | Database Server125132 | MSSQL (2005) | Database Server1261731 | MSSQL (2012, 2014) | Database Server127200 | MySQL323 | Database Server128300 | MySQL4.1/MySQL5 | Database Server1293100 | Oracle H: Type (Oracle 7+) | Database Server130112 | Oracle S: Type (Oracle 11+) | Database Server13112300 | Oracle T: Type (Oracle 12+) | Database Server1328000 | Sybase ASE | Database Server133141 | Episerver 6.x < .NET 4 | HTTP, SMTP, LDAP Server1341441 | Episerver 6.x >= .NET 4 | HTTP, SMTP, LDAP Server1351600 | Apache $apr1$ MD5, md5apr1, MD5 (APR) | HTTP, SMTP, LDAP Server13612600 | ColdFusion 10+ | HTTP, SMTP, LDAP Server1371421 | hMailServer | HTTP, SMTP, LDAP Server138101 | nsldap, SHA-1(Base64), Netscape LDAP SHA | HTTP, SMTP, LDAP Server139111 | nsldaps, SSHA-1(Base64), Netscape LDAP SSHA | HTTP, SMTP, LDAP Server1401411 | SSHA-256(Base64), LDAP {SSHA256} | HTTP, SMTP, LDAP Server1411711 | SSHA-512(Base64), LDAP {SSHA512} | HTTP, SMTP, LDAP Server14216400 | CRAM-MD5 Dovecot | HTTP, SMTP, LDAP Server14315000 | FileZilla Server >= 0.9.55 | FTP Server14411500 | CRC32 | Checksums1453000 | LM | Operating Systems1461000 | NTLM | Operating Systems1471100 | Domain Cached Credentials (DCC), MS Cache | Operating Systems1482100 | Domain Cached Credentials 2 (DCC2), MS Cache 2 | Operating Systems14915300 | DPAPI masterkey file v1 | Operating Systems15015900 | DPAPI masterkey file v2 | Operating Systems15112800 | MS-AzureSync PBKDF2-HMAC-SHA256 | Operating Systems1521500 | descrypt, DES (Unix), Traditional DES | Operating Systems15312400 | BSDi Crypt, Extended DES | Operating Systems154500 | md5crypt, MD5 (Unix), Cisco-IOS $1$ (MD5) | Operating Systems1553200 | bcrypt $2*$, Blowfish (Unix) | Operating Systems1567400 | sha256crypt $5$, SHA256 (Unix) | Operating Systems1571800 | sha512crypt $6$, SHA512 (Unix) | Operating Systems158122 | macOS v10.4, MacOS v10.5, MacOS v10.6 | Operating Systems1591722 | macOS v10.7 | Operating Systems1607100 | macOS v10.8+ (PBKDF2-SHA512) | Operating Systems1616300 | AIX {smd5} | Operating Systems1626700 | AIX {ssha1} | Operating Systems1636400 | AIX {ssha256} | Operating Systems1646500 | AIX {ssha512} | Operating Systems1652400 | Cisco-PIX MD5 | Operating Systems1662410 | Cisco-ASA MD5 | Operating Systems167500 | Cisco-IOS $1$ (MD5) | Operating Systems1685700 | Cisco-IOS type 4 (SHA256) | Operating Systems1699200 | Cisco-IOS $8$ (PBKDF2-SHA256) | Operating Systems1709300 | Cisco-IOS $9$ (scrypt) | Operating Systems17122 | Juniper NetScreen/SSG (ScreenOS) | Operating Systems172501 | Juniper IVE | Operating Systems17315100 | Juniper/NetBSD sha1crypt | Operating Systems1747000 | FortiGate (FortiOS) | Operating Systems1755800 | Samsung Android Password/PIN | Operating Systems17613800 | Windows Phone 8+ PIN/password | Operating Systems1778100 | Citrix NetScaler | Operating Systems1788500 | RACF | Operating Systems1797200 | GRUB 2 | Operating Systems1809900 | Radmin2 | Operating Systems181125 | ArubaOS | Operating Systems1827700 | SAP CODVN B (BCODE) | Enterprise Application Software (EAS)1837701 | SAP CODVN B (BCODE) via RFC_READ_TABLE | Enterprise Application Software (EAS)1847800 | SAP CODVN F/G (PASSCODE) | Enterprise Application Software (EAS)1857801 | SAP CODVN F/G (PASSCODE) via RFC_READ_TABLE | Enterprise Application Software (EAS)18610300 | SAP CODVN H (PWDSALTEDHASH) iSSHA-1 | Enterprise Application Software (EAS)1878600 | Lotus Notes/Domino 5 | Enterprise Application Software (EAS)1888700 | Lotus Notes/Domino 6 | Enterprise Application Software (EAS)1899100 | Lotus Notes/Domino 8 | Enterprise Application Software (EAS)190133 | PeopleSoft | Enterprise Application Software (EAS)19113500 | PeopleSoft PS_TOKEN | Enterprise Application Software (EAS)19211600 | 7-Zip | Archives19312500 | RAR3-hp | Archives19413000 | RAR5 | Archives19513200 | AxCrypt | Archives19613300 | AxCrypt in-memory SHA1 | Archives19713600 | WinZip | Archives19814700 | iTunes backup < 10.0 | Backup19914800 | iTunes backup >= 10.0 | Backup20062XY | TrueCrypt | Full-Disk Encryption (FDE)201X | 1 = PBKDF2-HMAC-RIPEMD160 | Full-Disk Encryption (FDE)202X | 2 = PBKDF2-HMAC-SHA512 | Full-Disk Encryption (FDE)203X | 3 = PBKDF2-HMAC-Whirlpool | Full-Disk Encryption (FDE)204X | 4 = PBKDF2-HMAC-RIPEMD160 + boot-mode | Full-Disk Encryption (FDE)205Y | 1 = XTS 512 bit pure AES | Full-Disk Encryption (FDE)206Y | 1 = XTS 512 bit pure Serpent | Full-Disk Encryption (FDE)207Y | 1 = XTS 512 bit pure Twofish | Full-Disk Encryption (FDE)208Y | 2 = XTS 1024 bit pure AES | Full-Disk Encryption (FDE)209Y | 2 = XTS 1024 bit pure Serpent | Full-Disk Encryption (FDE)210Y | 2 = XTS 1024 bit pure Twofish | Full-Disk Encryption (FDE)211Y | 2 = XTS 1024 bit cascaded AES-Twofish | Full-Disk Encryption (FDE)212Y | 2 = XTS 1024 bit cascaded Serpent-AES | Full-Disk Encryption (FDE)213Y | 2 = XTS 1024 bit cascaded Twofish-Serpent | Full-Disk Encryption (FDE)214Y | 3 = XTS 1536 bit all | Full-Disk Encryption (FDE)2158800 | Android FDE <= 4.3 | Full-Disk Encryption (FDE)21612900 | Android FDE (Samsung DEK) | Full-Disk Encryption (FDE)21712200 | eCryptfs | Full-Disk Encryption (FDE)218137XY | VeraCrypt | Full-Disk Encryption (FDE)219X | 1 = PBKDF2-HMAC-RIPEMD160 | Full-Disk Encryption (FDE)220X | 2 = PBKDF2-HMAC-SHA512 | Full-Disk Encryption (FDE)221X | 3 = PBKDF2-HMAC-Whirlpool | Full-Disk Encryption (FDE)222X | 4 = PBKDF2-HMAC-RIPEMD160 + boot-mode | Full-Disk Encryption (FDE)223X | 5 = PBKDF2-HMAC-SHA256 | Full-Disk Encryption (FDE)224X | 6 = PBKDF2-HMAC-SHA256 + boot-mode | Full-Disk Encryption (FDE)225X | 7 = PBKDF2-HMAC-Streebog-512 | Full-Disk Encryption (FDE)226Y | 1 = XTS 512 bit pure AES | Full-Disk Encryption (FDE)227Y | 1 = XTS 512 bit pure Serpent | Full-Disk Encryption (FDE)228Y | 1 = XTS 512 bit pure Twofish | Full-Disk Encryption (FDE)229Y | 1 = XTS 512 bit pure Camellia | Full-Disk Encryption (FDE)230Y | 1 = XTS 512 bit pure Kuznyechik | Full-Disk Encryption (FDE)231Y | 2 = XTS 1024 bit pure AES | Full-Disk Encryption (FDE)232Y | 2 = XTS 1024 bit pure Serpent | Full-Disk Encryption (FDE)233Y | 2 = XTS 1024 bit pure Twofish | Full-Disk Encryption (FDE)234Y | 2 = XTS 1024 bit pure Camellia | Full-Disk Encryption (FDE)235Y | 2 = XTS 1024 bit pure Kuznyechik | Full-Disk Encryption (FDE)236Y | 2 = XTS 1024 bit cascaded AES-Twofish | Full-Disk Encryption (FDE)237Y | 2 = XTS 1024 bit cascaded Camellia-Kuznyechik | Full-Disk Encryption (FDE)238Y | 2 = XTS 1024 bit cascaded Camellia-Serpent | Full-Disk Encryption (FDE)239Y | 2 = XTS 1024 bit cascaded Kuznyechik-AES | Full-Disk Encryption (FDE)240Y | 2 = XTS 1024 bit cascaded Kuznyechik-Twofish | Full-Disk Encryption (FDE)241Y | 2 = XTS 1024 bit cascaded Serpent-AES | Full-Disk Encryption (FDE)242Y | 2 = XTS 1024 bit cascaded Twofish-Serpent | Full-Disk Encryption (FDE)243Y | 3 = XTS 1536 bit all | Full-Disk Encryption (FDE)24414600 | LUKS | Full-Disk Encryption (FDE)24516700 | FileVault 2 | Full-Disk Encryption (FDE)24618300 | Apple File System (APFS) | Full-Disk Encryption (FDE)2479700 | MS Office <= 2003 $0/$1, MD5 + RC4 | Documents2489710 | MS Office <= 2003 $0/$1, MD5 + RC4, collider #1 | Documents2499720 | MS Office <= 2003 $0/$1, MD5 + RC4, collider #2 | Documents2509800 | MS Office <= 2003 $3/$4, SHA1 + RC4 | Documents2519810 | MS Office <= 2003 $3, SHA1 + RC4, collider #1 | Documents2529820 | MS Office <= 2003 $3, SHA1 + RC4, collider #2 | Documents2539400 | MS Office 2007 | Documents2549500 | MS Office 2010 | Documents2559600 | MS Office 2013 | Documents25610400 | PDF 1.1 - 1.3 (Acrobat 2 - 4) | Documents25710410 | PDF 1.1 - 1.3 (Acrobat 2 - 4), collider #1 | Documents25810420 | PDF 1.1 - 1.3 (Acrobat 2 - 4), collider #2 | Documents25910500 | PDF 1.4 - 1.6 (Acrobat 5 - 8) | Documents26010600 | PDF 1.7 Level 3 (Acrobat 9) | Documents26110700 | PDF 1.7 Level 8 (Acrobat 10 - 11) | Documents26216200 | Apple Secure Notes | Documents2639000 | Password Safe v2 | Password Managers2645200 | Password Safe v3 | Password Managers2656800 | LastPass + LastPass sniffed | Password Managers2666600 | 1Password, agilekeychain | Password Managers2678200 | 1Password, cloudkeychain | Password Managers26811300 | Bitcoin/Litecoin wallet.dat | Password Managers26912700 | Blockchain, My Wallet | Password Managers27015200 | Blockchain, My Wallet, V2 | Password Managers27116600 | Electrum Wallet (Salt-Type 1-3) | Password Managers27213400 | KeePass 1 (AES/Twofish) and KeePass 2 (AES) | Password Managers27315500 | JKS Java Key Store Private Keys (SHA1) | Password Managers27415600 | Ethereum Wallet, PBKDF2-HMAC-SHA256 | Password Managers27515700 | Ethereum Wallet, SCRYPT | Password Managers27616300 | Ethereum Pre-Sale Wallet, PBKDF2-HMAC-SHA256 | Password Managers27716900 | Ansible Vault | Password Managers27818100 | TOTP (HMAC-SHA1) | One-Time Passwords27999999 | Plaintext | Plaintext
```