hashcat Forum

Exactly how are "candidates" supposed to be used from the output? I have two that look nothing alike ...

lets call it "visual flavour". It doesn't really mean anything for markov mask attacks.

(06-22-2017, 10:43 AM)undeath Wrote: [ -> ]lets call it "visual flavour". It doesn't really mean anything for markov mask attacks.

I mean, are those words supposed to be used in an attack?

The word "candidates" are the passwords that are used as input the for the select hash-mode.

(06-23-2017, 03:20 PM)atom Wrote: [ -> ]The word "candidates" are the passwords that are used as input the for the select hash-mode.

Can you explain that in more detail?  I have two candidates how do I use them as an input?

Add them into a textfile and use that as wordlist

Hi Atom,

I am currently running hashcat in mode 14000 (DES-ECB) and it displays the following candidates:-

Candidates.#1....: $HEX[7305bf613969ed4f] -> $HEX[ff6fbfffbf17ed4f]
Candidates.#2....: $HEX[73617f61812bed4f] -> $HEX[ff0f7fff1f2fed4f]
Candidates.#3....: $HEX[736b3d613943ed4f] -> $HEX[ff1f4dffbf31ed4f]
Candidates.#4....: $HEX[73e143610335ed4f] -> $HEX[ffef43ffff37ed4f]
Candidates.#5....: $HEX[73c113618145ed4f] -> $HEX[ffcf13ff1f49ed4f]
Candidates.#6....: $HEX[735b2f617345ed4f] -> $HEX[ff5f4fff9f3bed4f]
Candidates.#7....: $HEX[73f12b61a13bed4f] -> $HEX[ffff2bff3f71ed4f]
Candidates.#8....: $HEX[73b12561e141ed4f] -> $HEX[ffbf25ff7f45ed4f]
Candidates.#9....: $HEX[730529615721ed4f] -> $HEX[ff6f53ffdf41ed4f]
Candidates.#10....: $HEX[73a19b61a121ed4f] -> $HEX[ffaf9bff3f41ed4f]
Candidates.#11....: $HEX[735b9161e127ed4f] -> $HEX[ff5f91ff7f2bed4f]
Candidates.#12....: $HEX[735bab61c117ed4f] -> $HEX[ff5fabff5f69ed4f]
Candidates.#13....: $HEX[73d1a561031bed4f] -> $HEX[ffdfa5ffff1ded4f]
Candidates.#14....: $HEX[736ba1617335ed4f] -> $HEX[ff1fa1ff9f21ed4f]
Candidates.#15....: $HEX[735b0161c131ed4f] -> $HEX[ff5f5bff5f49ed4f]
Candidates.#16....: $HEX[73e195615751ed4f] -> $HEX[ffef95ffdf27ed4f]

I'm not sure how to interpret these values in hexadecimal - the first two digits on the right hand column have always been $ff.... which doesn't seem right as $ff = 1111 1111 in binary, which has 8 zeros in it, which indicates even parity - an invalid DES key.

Another thing I have noticed is that the first two digits on the left hand column are always set to $73 (At least that have been for the past few days while its beene crunching away - is this normal?

I apologise if this has been answered elsewhere, I have done some searching and couldn't find anything specific to hyow candidates are displayed with DES-ECB.

Cheers,
Matt

I think there is some gross confusion here. "Candidates" just means these are the keys that are currently being tested. It doesn't mean they are keys that have been cracked, those will be written to your .potfile and the Cracked counter will increment when one is found.

In the context of my question, an "invalid" key doesn't just mean the wrong key for my hash - it means a key that cannot be used with the DES cipher..

I understand a candidate is - just not what the hexadecimal values are trying to tell me....

In DES cracking, parity doesn't matter