· 5 years ago · Feb 24, 2020, 11:06 AM
1Don Juji's Complete Guide To Parsing, Cracking and creating combos from raw sql databases.
2
3PART I OF III: Parsing For Hashcat
4
5
6This guide is part 1 of 3 and will cover how to parse out the three needed text files so that you can start cracking in hashcat and be ready for matching.
7The following two guides will then cover how to crack in hashcat in part II, followed by the matching and finalizing into combos in part III.
8
9PREREQUISITES
10
11
12Software requirements for this section of the guide:
13
141. Em-editor - https://support.emeditor.com/en/downloads/latest/installer/64
15
16Software requirements for the entire guide:
17
181. Em-editor - https://support.emeditor.com/en/downloads/latest/installer/64
192. Hashcat - https://hashcat.net/files/hashcat-5.1.0.7z
203. Unified List Manager - http://downloads.unifiedlm.com/uploads/ULM_V1E139.zip
21
22
23INTRODUCTION
24
25
26
27To prepare for cracking hashes and later matching up your cracked founds with usernames and emails to get emailpass and userpass the following three text files are required:
28
291. user:hash
302. email:hash
313. hash or hash:salt (depending on if your database uses a hashtype with salts.
32
33For this example I will use the first few lines of a vB database. vBulletin contain one of three different hashtypes depending on the version. This is because older vB forums used a more simple 3 character salt as opposed to the now mostly standardized 30 character salts. In addition, some vB forums have begun to start adopting bcrypt hashing algorithms, although this is still quite rare. Most of the time you are going to find that a vB dump will have 30 char salts towards the end and 3 char salts at the start because the forum's version was upgraded at some point. For the sake of simplicity our example contains only the older 3 char salts. Here are the numbers that you will need to specify later on to hashcat in order to tell it which hashtype you are using, when dealing with vB databases.
34
35-- vB 3 character salt: 2611
36-- vB 30 character salt: 2711
37-- bcrypt: 3200
38
39Full reference list for hashcat hashtype examples/modes: https://hashcat.net/wiki/doku.php?id=example_hashes
40
41PART I -- INITIAL PARSING
42
43
44
45
46
47Ok now lets begin, here is your example:
48
49
50Adminer 4.7.3 MySQL dump
51
52SET NAMES utf8;
53SET time_zone = '+00:00';
54SET foreign_key_checks = 0;
55SET sql_mode = 'NO_AUTO_VALUE_ON_ZERO';
56
57DROP TABLE IF EXISTS `vb_user`;
58CREATE TABLE `vb_user` (
59 `userid` int(10) unsigned NOT NULL AUTO_INCREMENT,
60 `usergroupid` smallint(5) unsigned NOT NULL DEFAULT '0',
61 `membergroupids` char(250) NOT NULL DEFAULT '',
62 `displaygroupid` smallint(5) unsigned NOT NULL DEFAULT '0',
63 `username` varchar(100) NOT NULL DEFAULT '',
64 `password` char(32) NOT NULL DEFAULT '',
65 `passworddate` date NOT NULL DEFAULT '1000-01-01',
66 `email` char(100) NOT NULL DEFAULT '',
67 `styleid` smallint(5) unsigned NOT NULL DEFAULT '0',
68 `parentemail` char(50) NOT NULL DEFAULT '',
69 `homepage` char(100) NOT NULL DEFAULT '',
70 `icq` char(20) NOT NULL DEFAULT '',
71 `aim` char(20) NOT NULL DEFAULT '',
72 `yahoo` char(32) NOT NULL DEFAULT '',
73 `msn` char(100) NOT NULL DEFAULT '',
74 `skype` char(32) NOT NULL DEFAULT '',
75 `showvbcode` smallint(5) unsigned NOT NULL DEFAULT '0',
76 `showbirthday` smallint(5) unsigned NOT NULL DEFAULT '2',
77 `usertitle` char(250) NOT NULL DEFAULT '',
78 `customtitle` smallint(6) NOT NULL DEFAULT '0',
79 `joindate` int(10) unsigned NOT NULL DEFAULT '0',
80 `daysprune` smallint(6) NOT NULL DEFAULT '0',
81 `lastvisit` int(10) unsigned NOT NULL DEFAULT '0',
82 `lastactivity` int(10) unsigned NOT NULL DEFAULT '0',
83 `lastpost` int(10) unsigned NOT NULL DEFAULT '0',
84 `lastpostid` int(10) unsigned NOT NULL DEFAULT '0',
85 `posts` int(10) unsigned NOT NULL DEFAULT '0',
86 `reputation` int(11) NOT NULL DEFAULT '10',
87 `reputationlevelid` int(10) unsigned NOT NULL DEFAULT '1',
88 `timezoneoffset` char(4) NOT NULL DEFAULT '',
89 `pmpopup` smallint(6) NOT NULL DEFAULT '0',
90 `avatarid` smallint(6) NOT NULL DEFAULT '0',
91 `avatarrevision` int(10) unsigned NOT NULL DEFAULT '0',
92 `profilepicrevision` int(10) unsigned NOT NULL DEFAULT '0',
93 `sigpicrevision` int(10) unsigned NOT NULL DEFAULT '0',
94 `options` int(10) unsigned NOT NULL DEFAULT '33570831',
95 `birthday` char(10) NOT NULL DEFAULT '',
96 `birthday_search` date NOT NULL DEFAULT '1000-01-01',
97 `maxposts` smallint(6) NOT NULL DEFAULT '-1',
98 `startofweek` smallint(6) NOT NULL DEFAULT '1',
99 `ipaddress` varchar(45) NOT NULL DEFAULT '',
100 `referrerid` int(10) unsigned NOT NULL DEFAULT '0',
101 `languageid` smallint(5) unsigned NOT NULL DEFAULT '0',
102 `emailstamp` int(10) unsigned NOT NULL DEFAULT '0',
103 `threadedmode` smallint(5) unsigned NOT NULL DEFAULT '0',
104 `autosubscribe` smallint(6) NOT NULL DEFAULT '-1',
105 `pmtotal` smallint(5) unsigned NOT NULL DEFAULT '0',
106 `pmunread` smallint(5) unsigned NOT NULL DEFAULT '0',
107 `salt` char(30) NOT NULL DEFAULT '',
108 `ipoints` int(10) unsigned NOT NULL DEFAULT '0',
109 `infractions` int(10) unsigned NOT NULL DEFAULT '0',
110 `warnings` int(10) unsigned NOT NULL DEFAULT '0',
111 `infractiongroupids` varchar(255) NOT NULL DEFAULT '',
112 `infractiongroupid` smallint(5) unsigned NOT NULL DEFAULT '0',
113 `adminoptions` int(10) unsigned NOT NULL DEFAULT '0',
114 `importuserid` bigint(20) NOT NULL DEFAULT '0',
115 `profilevisits` int(10) unsigned NOT NULL DEFAULT '0',
116 `friendcount` int(10) unsigned NOT NULL DEFAULT '0',
117 `friendreqcount` int(10) unsigned NOT NULL DEFAULT '0',
118 `vmunreadcount` int(10) unsigned NOT NULL DEFAULT '0',
119 `vmmoderatedcount` int(10) unsigned NOT NULL DEFAULT '0',
120 `socgroupinvitecount` int(10) unsigned NOT NULL DEFAULT '0',
121 `socgroupreqcount` int(10) unsigned NOT NULL DEFAULT '0',
122 `pcunreadcount` int(10) unsigned NOT NULL DEFAULT '0',
123 `pcmoderatedcount` int(10) unsigned NOT NULL DEFAULT '0',
124 `gmmoderatedcount` int(10) unsigned NOT NULL DEFAULT '0',
125 `assetposthash` varchar(32) NOT NULL DEFAULT '',
126 `fbuserid` varchar(255) NOT NULL,
127 `fbjoindate` int(10) unsigned NOT NULL DEFAULT '0',
128 `fbname` varchar(255) NOT NULL,
129 `logintype` enum('vb','fb') NOT NULL DEFAULT 'vb',
130 `fbaccesstoken` varchar(255) NOT NULL,
131 `dbtech_usertag_excluded` tinyint(1) unsigned NOT NULL DEFAULT '0',
132 `dbtech_usertag_mentioncount` int(10) unsigned NOT NULL DEFAULT '0',
133 `dbtech_usertag_tagcount` int(10) unsigned NOT NULL DEFAULT '0',
134 `dbtech_usertag_mentions` int(10) unsigned NOT NULL DEFAULT '0',
135 `dbtech_usertag_tags` int(10) unsigned NOT NULL DEFAULT '0',
136 `dbtech_usertag_settings` int(10) unsigned NOT NULL DEFAULT '0',
137 `newrepcount` smallint(5) unsigned NOT NULL DEFAULT '0',
138 `panjo_selling` tinyint(1) DEFAULT NULL,
139 PRIMARY KEY (`userid`),
140 KEY `usergroupid` (`usergroupid`),
141 KEY `username` (`username`),
142 KEY `birthday` (`birthday`,`showbirthday`),
143 KEY `birthday_search` (`birthday_search`),
144 KEY `importuser_index` (`importuserid`),
145 KEY `referrerid` (`referrerid`),
146 KEY `fbuserid` (`fbuserid`),
147 KEY `email` (`email`),
148 KEY `lastactivity` (`lastactivity`)
149) ENGINE=InnoDB DEFAULT CHARSET=latin1;
150
151INSERT INTO `vb_user` (`userid`, `usergroupid`, `membergroupids`, `displaygroupid`, `username`, `password`, `passworddate`, `email`, `styleid`, `parentemail`, `homepage`, `icq`, `aim`, `yahoo`, `msn`, `skype`, `showvbcode`, `showbirthday`, `usertitle`, `customtitle`, `joindate`, `daysprune`, `lastvisit`, `lastactivity`, `lastpost`, `lastpostid`, `posts`, `reputation`, `reputationlevelid`, `timezoneoffset`, `pmpopup`, `avatarid`, `avatarrevision`, `profilepicrevision`, `sigpicrevision`, `options`, `birthday`, `birthday_search`, `maxposts`, `startofweek`, `ipaddress`, `referrerid`, `languageid`, `emailstamp`, `threadedmode`, `autosubscribe`, `pmtotal`, `pmunread`, `salt`, `ipoints`, `infractions`, `warnings`, `infractiongroupids`, `infractiongroupid`, `adminoptions`, `importuserid`, `profilevisits`, `friendcount`, `friendreqcount`, `vmunreadcount`, `vmmoderatedcount`, `socgroupinvitecount`, `socgroupreqcount`, `pcunreadcount`, `pcmoderatedcount`, `gmmoderatedcount`, `assetposthash`, `fbuserid`, `fbjoindate`, `fbname`, `logintype`, `fbaccesstoken`, `dbtech_usertag_excluded`, `dbtech_usertag_mentioncount`, `dbtech_usertag_tagcount`, `dbtech_usertag_mentions`, `dbtech_usertag_tags`, `dbtech_usertag_settings`, `newrepcount`, `panjo_selling`) VALUES
152(1, 6, '', 0, 'drfrightner', 'fa382cd22986762d60cac8e0bb7644e6', '2019-01-16', 'darkrides@sbcglobal.net', 3, '', 'http://www.halloweenproductions.com', '', 'drfrightnr', 'darkrides@sbcglobal.net', '', '', 2, 2, 'Administrator', 0, 1060016100, 0, 1550744779, 1550825167, 1550744778, 325434, 9572, 10, 5, '-6', 0, 0, 5, 2, 1, 45631575, '03-24-1969', '1969-03-24', -1, 1, '', 0, 0, 0, 0, -1, 115, 89, '8RQW_;6#^!\'UO|c{m>zv3Ov1c?`q`|', 0, 0, 0, '', 0, 0, 0, 39882, 44, 13, 0, 0, 0, 0, 0, 0, 0, 'ca6a8636a65cc4dc4a861ed404487632', '', 0, '', 'vb', 'EAAEmB3oT4FQBAL0hhf1a9NdEwxej8WGzdDUwdPGXUg8uTYZBmJAcdZCuRlkAup7cdMqOquS3YfN26FFIvGUYA1RhPhQ3Bmh6ix6zWNvMUHZBBoPbD0QfEikzSdgMy2H8dwAZBshTOoY7nfZBDATnnry4XognDjDFulOm5tzZAByxt0NUWvZBaCKcAJZCpQFDzZCUZD', 0, 0, 0, 1, 0, 0, 0, NULL),
153(2, 2, '', 0, 'zzap', '3e00bf226141320e8a29221fadeb8063', '2007-05-30', 'webguy@brainstormstudios.com', 0, '', '', '', 'FrightmistressLS', '', '', '', 2, 2, 'Junior Member', 0, 1058763710, 0, 1164642583, 1190035020, 1164296466, 0, 12, 10, 5, '-5', 0, 0, 0, 0, 0, 45108439, '', '1000-01-01', -1, 2, '', 0, 0, 0, 0, 0, 26, 25, 'L2q', 0, 0, 0, '', 0, 0, 2, 4415, 0, 0, 0, 0, 0, 0, 0, 0, 0, '', '', 0, '', 'vb', '', 0, 0, 0, 0, 0, 0, 0, NULL),
154(3, 2, '', 0, 'spookologist', 'ff0288a33eff49a605efe21c40e68abc', '2007-05-30', 'wayne@trailofterror.com', 0, '', 'http://www.trailofterror.com', '', 'TofTerror9', '', 'spookologist', '', 2, 2, 'Senior Member', 0, 1058799339, 0, 1463031519, 1487566867, 1401255481, 158642, 305, 10, 5, '-5', 0, 0, 3, 0, 3, 45108311, '', '1000-01-01', -1, 1, '', 0, 0, 1390459933, 0, 0, 17, 1, 'MHL', 0, 0, 0, '', 0, 0, 3, 6463, 2, 0, 0, 0, 0, 0, 0, 0, 0, '490760778ea030e501c1b5d0f1f7fe44', '', 0, '', 'vb', '', 0, 0, 0, 0, 0, 0, 0, NULL),
155(4, 2, '', 0, 'Karl Fields', '81db9df708d9271474618712ae2a15ff', '2017-03-30', 'info@piratesofemerson.com', 0, '', 'http://www.piratesofemerson.com', '', '', '', '', '', 2, 2, 'Senior Member', 0, 1060009860, 0, 1550543619, 1550627215, 1540969825, 325094, 284, 10, 5, '-8', 1, 0, 3, 1, 0, 45633367, '', '1000-01-01', -1, 1, '', 0, 0, 1440104673, 0, 0, 100, 0, '6qDG0}s6L\'o4b=mu&$x6{Y*8<yR>UN', 0, 0, 0, '', 0, 0, 4, 8876, 0, 1, 0, 0, 0, 0, 0, 0, 0, '0be677bf077bb048d215e2c1667d5654', '', 0, '', 'vb', '', 0, 0, 0, 1, 0, 0, 0, NULL),
156(6, 2, '', 0, 'Kevin Kruse', '9de88bca6f156e7149509391ad717c52', '2010-05-16', 'emerald98@sbcglobal.net', 0, '', '', '', '', '', '', '', 0, 2, 'Junior Member', 0, 1060020312, 0, 1362628072, 1362628072, 0, 0, 0, 10, 5, '', 0, 0, 0, 0, 0, 45107287, '', '1000-01-01', 0, 0, '', 0, 0, 0, 0, 0, 4, 0, '^;V', 0, 0, 0, '', 0, 0, 7, 3788, 0, 2, 0, 0, 0, 0, 0, 0, 0, '', '', 0, '', 'vb', '', 0, 0, 0, 0, 0, 0, 0, NULL),
157(7, 2, '', 0, 'Xanthar', 'c6649d94e71a8565fc9d600f4bddf3aa', '2007-05-30', 'Xanthar@Wintermoor.org', 0, '', '', '', '', '', '', '', 0, 2, 'Member', 0, 1060021238, 0, 1398640882, 1452889365, 1398640535, 158271, 70, 10, 5, '', 0, 0, 3, 0, 0, 45107287, '', '1000-01-01', 0, 0, '', 0, 0, 0, 0, 0, 8, 2, '_+:', 0, 0, 0, '', 0, 0, 8, 4819, 0, 0, 0, 0, 0, 0, 0, 0, 0, '', '', 0, '', 'vb', '', 0, 0, 0, 0, 0, 0, 0, NULL),
158(8, 2, '', 0, 'Ironman', 'd1736238c2ce98cbf4a2e965e3f71f23', '2007-05-30', 'Ironman@theironkingdom.com', 0, '', 'http://www.theironkingdom.com', '', '', '', '', '', 0, 2, 'Senior Member', 0, 1060021319, 0, 1384275005, 1384783352, 1359753888, 146153, 126, 10, 5, '', 0, 0, 0, 0, 0, 45107287, '', '1000-01-01', 0, 0, '', 0, 0, 1305065197, 0, 0, 41, 2, 'pZ)', 0, 0, 0, '', 0, 0, 9, 6249, 1, 0, 0, 0, 0, 0, 0, 0, 0, '7391eba23e7f3b24ffd14416d78953d5', '', 0, '', 'vb', '', 0, 0, 0, 0, 0, 0, 0, NULL),
159(9, 2, '', 0, 'Haunted Illinois', 'b8cff9a85a61f2a8fc61f8070ffcd1e2', '2007-05-30', 'hauntedillinois@gmail.com', 0, '', 'http://www.hauntedillinois.com', '', '', '', '', '', 2, 2, 'Senior Member', 0, 1060021320, 0, 1453136312, 1453142636, 1407591961, 159603, 483, 10, 5, '-6', 0, 0, 3, 0, 0, 45632855, '', '1000-01-01', -1, 1, '', 0, 0, 0, 0, 1, 6, 2, '*ry', 0, 0, 0, '', 0, 0, 10, 7338, 6, 0, 0, 0, 0, 0, 0, 0, 0, '', '', 0, '', 'vb', '', 0, 0, 0, 0, 0, 0, 0, NULL),
160
161<END EXAMPLE ------------------------------------------------------------------------------------------------------------------------------------------------------- END EXAMPLE>
162
163Please note that you may need to remove lines after the columns at the end of the database as well, it should be obvious where the columns end at the closing schema data start
164First thing we need to do is remove any lines that are not column data. The actual data begins where the columns start so we will remove all this.
165
166The result should like this:
167
168
169
170(1, 6, '', 0, 'drfrightner', 'fa382cd22986762d60cac8e0bb7644e6', '2019-01-16', 'darkrides@sbcglobal.net', 3, '', 'http://www.halloweenproductions.com', '', 'drfrightnr', 'darkrides@sbcglobal.net', '', '', 2, 2, 'Administrator', 0, 1060016100, 0, 1550744779, 1550825167, 1550744778, 325434, 9572, 10, 5, '-6', 0, 0, 5, 2, 1, 45631575, '03-24-1969', '1969-03-24', -1, 1, '', 0, 0, 0, 0, -1, 115, 89, '8RQW_;6#^!\'UO|c{m>zv3Ov1c?`q`|', 0, 0, 0, '', 0, 0, 0, 39882, 44, 13, 0, 0, 0, 0, 0, 0, 0, 'ca6a8636a65cc4dc4a861ed404487632', '', 0, '', 'vb', 'EAAEmB3oT4FQBAL0hhf1a9NdEwxej8WGzdDUwdPGXUg8uTYZBmJAcdZCuRlkAup7cdMqOquS3YfN26FFIvGUYA1RhPhQ3Bmh6ix6zWNvMUHZBBoPbD0QfEikzSdgMy2H8dwAZBshTOoY7nfZBDATnnry4XognDjDFulOm5tzZAByxt0NUWvZBaCKcAJZCpQFDzZCUZD', 0, 0, 0, 1, 0, 0, 0, NULL),
171(2, 2, '', 0, 'zzap', '3e00bf226141320e8a29221fadeb8063', '2007-05-30', 'webguy@brainstormstudios.com', 0, '', '', '', 'FrightmistressLS', '', '', '', 2, 2, 'Junior Member', 0, 1058763710, 0, 1164642583, 1190035020, 1164296466, 0, 12, 10, 5, '-5', 0, 0, 0, 0, 0, 45108439, '', '1000-01-01', -1, 2, '', 0, 0, 0, 0, 0, 26, 25, 'L2q', 0, 0, 0, '', 0, 0, 2, 4415, 0, 0, 0, 0, 0, 0, 0, 0, 0, '', '', 0, '', 'vb', '', 0, 0, 0, 0, 0, 0, 0, NULL),
172(3, 2, '', 0, 'spookologist', 'ff0288a33eff49a605efe21c40e68abc', '2007-05-30', 'wayne@trailofterror.com', 0, '', 'http://www.trailofterror.com', '', 'TofTerror9', '', 'spookologist', '', 2, 2, 'Senior Member', 0, 1058799339, 0, 1463031519, 1487566867, 1401255481, 158642, 305, 10, 5, '-5', 0, 0, 3, 0, 3, 45108311, '', '1000-01-01', -1, 1, '', 0, 0, 1390459933, 0, 0, 17, 1, 'MHL', 0, 0, 0, '', 0, 0, 3, 6463, 2, 0, 0, 0, 0, 0, 0, 0, 0, '490760778ea030e501c1b5d0f1f7fe44', '', 0, '', 'vb', '', 0, 0, 0, 0, 0, 0, 0, NULL),
173(4, 2, '', 0, 'Karl Fields', '81db9df708d9271474618712ae2a15ff', '2017-03-30', 'info@piratesofemerson.com', 0, '', 'http://www.piratesofemerson.com', '', '', '', '', '', 2, 2, 'Senior Member', 0, 1060009860, 0, 1550543619, 1550627215, 1540969825, 325094, 284, 10, 5, '-8', 1, 0, 3, 1, 0, 45633367, '', '1000-01-01', -1, 1, '', 0, 0, 1440104673, 0, 0, 100, 0, '6qDG0}s6L\'o4b=mu&$x6{Y*8<yR>UN', 0, 0, 0, '', 0, 0, 4, 8876, 0, 1, 0, 0, 0, 0, 0, 0, 0, '0be677bf077bb048d215e2c1667d5654', '', 0, '', 'vb', '', 0, 0, 0, 1, 0, 0, 0, NULL),
174(6, 2, '', 0, 'Kevin Kruse', '9de88bca6f156e7149509391ad717c52', '2010-05-16', 'emerald98@sbcglobal.net', 0, '', '', '', '', '', '', '', 0, 2, 'Junior Member', 0, 1060020312, 0, 1362628072, 1362628072, 0, 0, 0, 10, 5, '', 0, 0, 0, 0, 0, 45107287, '', '1000-01-01', 0, 0, '', 0, 0, 0, 0, 0, 4, 0, '^;V', 0, 0, 0, '', 0, 0, 7, 3788, 0, 2, 0, 0, 0, 0, 0, 0, 0, '', '', 0, '', 'vb', '', 0, 0, 0, 0, 0, 0, 0, NULL),
175(7, 2, '', 0, 'Xanthar', 'c6649d94e71a8565fc9d600f4bddf3aa', '2007-05-30', 'Xanthar@Wintermoor.org', 0, '', '', '', '', '', '', '', 0, 2, 'Member', 0, 1060021238, 0, 1398640882, 1452889365, 1398640535, 158271, 70, 10, 5, '', 0, 0, 3, 0, 0, 45107287, '', '1000-01-01', 0, 0, '', 0, 0, 0, 0, 0, 8, 2, '_+:', 0, 0, 0, '', 0, 0, 8, 4819, 0, 0, 0, 0, 0, 0, 0, 0, 0, '', '', 0, '', 'vb', '', 0, 0, 0, 0, 0, 0, 0, NULL),
176(8, 2, '', 0, 'Ironman', 'd1736238c2ce98cbf4a2e965e3f71f23', '2007-05-30', 'Ironman@theironkingdom.com', 0, '', 'http://www.theironkingdom.com', '', '', '', '', '', 0, 2, 'Senior Member', 0, 1060021319, 0, 1384275005, 1384783352, 1359753888, 146153, 126, 10, 5, '', 0, 0, 0, 0, 0, 45107287, '', '1000-01-01', 0, 0, '', 0, 0, 1305065197, 0, 0, 41, 2, 'pZ)', 0, 0, 0, '', 0, 0, 9, 6249, 1, 0, 0, 0, 0, 0, 0, 0, 0, '7391eba23e7f3b24ffd14416d78953d5', '', 0, '', 'vb', '', 0, 0, 0, 0, 0, 0, 0, NULL),
177(9, 2, '', 0, 'Haunted Illinois', 'b8cff9a85a61f2a8fc61f8070ffcd1e2', '2007-05-30', 'hauntedillinois@gmail.com', 0, '', 'http://www.hauntedillinois.com', '', '', '', '', '', 2, 2, 'Senior Member', 0, 1060021320, 0, 1453136312, 1453142636, 1407591961, 159603, 483, 10, 5, '-6', 0, 0, 3, 0, 0, 45632855, '', '1000-01-01', -1, 1, '', 0, 0, 0, 0, 1, 6, 2, '*ry', 0, 0, 0, '', 0, 0, 10, 7338, 6, 0, 0, 0, 0, 0, 0, 0, 0, '', '', 0, '', 'vb', '', 0, 0, 0, 0, 0, 0, 0, NULL),
178
179
180<END EXAMPLE ------------------------------------------------------------------------------------------------------------------------------------------------------- END EXAMPLE>
181
182
183Because single quotes do not appear in the actual salts and neither do commas, and for this example we will be using tab as our separator for parsing, we can simply remove all single quotes and commas by pressing ctrl + h and putting first a comma in the find field, leaving the replace field blank and then selecting replace all. Then again we will repeat this process using a single quote in place of the comma.
184
185The result should look like this:
186
187(1 6 0 drfrightner fa382cd22986762d60cac8e0bb7644e6 2019-01-16 darkrides@sbcglobal.net 3 http://www.halloweenproductions.com drfrightnr darkrides@sbcglobal.net 2 2 Administrator 0 1060016100 0 1550744779 1550825167 1550744778 325434 9572 10 5 -6 0 0 5 2 1 45631575 03-24-1969 1969-03-24 -1 1 0 0 0 0 -1 115 89 8RQW_;6#^!\UO|c{m>zv3Ov1c?`q`| 0 0 0 0 0 0 39882 44 13 0 0 0 0 0 0 0 ca6a8636a65cc4dc4a861ed404487632 0 vb EAAEmB3oT4FQBAL0hhf1a9NdEwxej8WGzdDUwdPGXUg8uTYZBmJAcdZCuRlkAup7cdMqOquS3YfN26FFIvGUYA1RhPhQ3Bmh6ix6zWNvMUHZBBoPbD0QfEikzSdgMy2H8dwAZBshTOoY7nfZBDATnnry4XognDjDFulOm5tzZAByxt0NUWvZBaCKcAJZCpQFDzZCUZD 0 0 0 1 0 0 0 NULL)
188(2 2 0 zzap 3e00bf226141320e8a29221fadeb8063 2007-05-30 webguy@brainstormstudios.com 0 FrightmistressLS 2 2 Junior Member 0 1058763710 0 1164642583 1190035020 1164296466 0 12 10 5 -5 0 0 0 0 0 45108439 1000-01-01 -1 2 0 0 0 0 0 26 25 L2q 0 0 0 0 0 2 4415 0 0 0 0 0 0 0 0 0 0 vb 0 0 0 0 0 0 0 NULL)
189(3 2 0 spookologist ff0288a33eff49a605efe21c40e68abc 2007-05-30 wayne@trailofterror.com 0 http://www.trailofterror.com TofTerror9 spookologist 2 2 Senior Member 0 1058799339 0 1463031519 1487566867 1401255481 158642 305 10 5 -5 0 0 3 0 3 45108311 1000-01-01 -1 1 0 0 1390459933 0 0 17 1 MHL 0 0 0 0 0 3 6463 2 0 0 0 0 0 0 0 0 490760778ea030e501c1b5d0f1f7fe44 0 vb 0 0 0 0 0 0 0 NULL)
190(4 2 0 Karl Fields 81db9df708d9271474618712ae2a15ff 2017-03-30 info@piratesofemerson.com 0 http://www.piratesofemerson.com 2 2 Senior Member 0 1060009860 0 1550543619 1550627215 1540969825 325094 284 10 5 -8 1 0 3 1 0 45633367 1000-01-01 -1 1 0 0 1440104673 0 0 100 0 6qDG0}s6L\o4b=mu&$x6{Y*8<yR>UN 0 0 0 0 0 4 8876 0 1 0 0 0 0 0 0 0 0be677bf077bb048d215e2c1667d5654 0 vb 0 0 0 1 0 0 0 NULL)
191(6 2 0 Kevin Kruse 9de88bca6f156e7149509391ad717c52 2010-05-16 emerald98@sbcglobal.net 0 0 2 Junior Member 0 1060020312 0 1362628072 1362628072 0 0 0 10 5 0 0 0 0 0 45107287 1000-01-01 0 0 0 0 0 0 0 4 0 ^;V 0 0 0 0 0 7 3788 0 2 0 0 0 0 0 0 0 0 vb 0 0 0 0 0 0 0 NULL)
192(7 2 0 Xanthar c6649d94e71a8565fc9d600f4bddf3aa 2007-05-30 Xanthar@Wintermoor.org 0 0 2 Member 0 1060021238 0 1398640882 1452889365 1398640535 158271 70 10 5 0 0 3 0 0 45107287 1000-01-01 0 0 0 0 0 0 0 8 2 _+: 0 0 0 0 0 8 4819 0 0 0 0 0 0 0 0 0 0 vb 0 0 0 0 0 0 0 NULL)
193(8 2 0 Ironman d1736238c2ce98cbf4a2e965e3f71f23 2007-05-30 Ironman@theironkingdom.com 0 http://www.theironkingdom.com 0 2 Senior Member 0 1060021319 0 1384275005 1384783352 1359753888 146153 126 10 5 0 0 0 0 0 45107287 1000-01-01 0 0 0 0 1305065197 0 0 41 2 pZ) 0 0 0 0 0 9 6249 1 0 0 0 0 0 0 0 0 7391eba23e7f3b24ffd14416d78953d5 0 vb 0 0 0 0 0 0 0 NULL)
194(9 2 0 Haunted Illinois b8cff9a85a61f2a8fc61f8070ffcd1e2 2007-05-30 hauntedillinois@gmail.com 0 http://www.hauntedillinois.com 2 2 Senior Member 0 1060021320 0 1453136312 1453142636 1407591961 159603 483 10 5 -6 0 0 3 0 0 45632855 1000-01-01 -1 1 0 0 0 0 1 6 2 *ry 0 0 0 0 0 10 7338 6 0 0 0 0 0 0 0 0 0 vb 0 0 0 0 0 0 0 NULL)
195
196
197<END EXAMPLE ------------------------------------------------------------------------------------------------------------------------------------------------------- END EXAMPLE>
198
199
200When parsing vB databases into emailpass and userpass combos, and most user table databases in general, we only need to worry about the following four columns:
201
2021.Username
2032.Email
2043.Password
2054.Salt
206
207The rest needs to be removed. There are many ways one can accomplish this, but the easiest is probably opening the database in em-editor and selecting the "tab separated" button near the top on the left. This works because most databases have their columns separated by tabs. However they are usually also separated by tabs and single quotation marks but we choose to remove those already. After pressing the tab separator your data will be automatically formatted into columns based on the tab separators. We must now remove all columns besides the four mentioned above.
208
209To start we will remove columns 1 through 4 by clicking on the 1 at the top of the column and holding shift until you click the 4 at the top of that column and then right clicking on the bar with the numbers and selecting "delete columns". Now remove the "3" column in the same way, as we don't need dates either. Now we have to scroll to the right to find our salt column as we have 3 our of the four columns we need. In this case the salt is column is number 44 so we want to click on the 4 column and hold shift and scroll all the way down to column 43 just before the salt column and click on that to select and once again right and click remove. We now have the four fields we need together and finally we must remove the left over columns after the four we need using the same method, optionally you can leave one blank column at the end if you don't want to use my regex method explained later.
210
211The result should look like this:
212
213zzap 3e00bf226141320e8a29221fadeb8063 webguy@brainstormstudios.com L2q
214spookologist ff0288a33eff49a605efe21c40e68abc wayne@trailofterror.com MHL
215Kevin Kruse 9de88bca6f156e7149509391ad717c52 emerald98@sbcglobal.net ^;V
216Xanthar c6649d94e71a8565fc9d600f4bddf3aa Xanthar@Wintermoor.org _+:
217Ironman d1736238c2ce98cbf4a2e965e3f71f23 Ironman@theironkingdom.com pZ)
218Haunted Illinois b8cff9a85a61f2a8fc61f8070ffcd1e2 hauntedillinois@gmail.com *ry
219
220<END EXAMPLE ------------------------------------------------------------------------------------------------------------------------------------------------------- END EXAMPLE>
221
222
223Next we need to start creating the three lists I mentioned at the start.
224
225First we will do hash:salt
226
227Open up a new tab in em-editor by pressing ctrl + n and copy paste the data into the new tab but do not close the original tab we will still need that.
228We will need to click the "tab separated" button again for the new tab as well.
229
230For hash:salt we will need to remove the email in between the two. Simply use the same column deletion method to remove the email column between them and then after words delete the user column.
231
232The result should look like this:
233
2343e00bf226141320e8a29221fadeb8063 L2q
235ff0288a33eff49a605efe21c40e68abc MHL
2369de88bca6f156e7149509391ad717c52 ^;V
237c6649d94e71a8565fc9d600f4bddf3aa _+:
238d1736238c2ce98cbf4a2e965e3f71f23 pZ)
239b8cff9a85a61f2a8fc61f8070ffcd1e2 *ry
240
241<END EXAMPLE ------------------------------------------------------------------------------------------------------------------------------------------------------- END EXAMPLE>
242
243
244Now all that is let to do is to git rid of the remaining tab spaces and replace them with colon separators as this is the standard separator used in cracking tools, combos and hashcat.
245So again pull up the find/replace menu with ctrl + h (if not already open) and in the find field write \t. \t is a standard short code for tab and will be treated as a tab space.
246In the replace field put a colon because we are replacing tabs with colons. Again click replace all.
247
248The result should look like this:
249
2503e00bf226141320e8a29221fadeb8063:L2q
251ff0288a33eff49a605efe21c40e68abc:MHL
2529de88bca6f156e7149509391ad717c52:^;V
253c6649d94e71a8565fc9d600f4bddf3aa:_+:
254d1736238c2ce98cbf4a2e965e3f71f23:pZ)
255b8cff9a85a61f2a8fc61f8070ffcd1e2:*ry
256
257<END EXAMPLE ------------------------------------------------------------------------------------------------------------------------------------------------------- END EXAMPLE>
258
259
260Congratulations hash:salt is parsed and is now ready to be loaded into hashcat for cracking. However we still need to parse email:hash and user:hash .
261Save this tab in its own text document and return to the first tab, copy the contents of the four original fields and open a new tab and paste them.
262
263Now we will do user:hash
264Now you will repeat the same process but this time you will be removing the last two columns, the email and salt fields. Once again replace \t with : and save the document.
265
266The result should look like this:
267
268zzap:3e00bf226141320e8a29221fadeb8063
269spookologist:ff0288a33eff49a605efe21c40e68abc
270Kevin Kruse:9de88bca6f156e7149509391ad717c52
271Xanthar:c6649d94e71a8565fc9d600f4bddf3aa
272Ironman:d1736238c2ce98cbf4a2e965e3f71f23
273Haunted Illinois:b8cff9a85a61f2a8fc61f8070ffcd1e2
274
275<END EXAMPLE ------------------------------------------------------------------------------------------------------------------------------------------------------- END EXAMPLE>
276
277
278Last we have email:hash
279Start by removing the salt and user columns so that you are left with hash and email only
280BUT WAIT! we need email:hash not hash:email!
281Because the email occurs after the hash in this database we will need to either select the hash column and instead of deleting it right click and go to cut and paste it on the other side of the email (providing you have a free column left).
282ORRRR, the easier way is to simply select the "regular expression" bullet under (none) in the ctrl + h find/replace menu and in the find field put (.*)\t(.*) and in the replace field put \2:\1
283I am not going to break down why or how this regular expression or "Regex" works, I will cover that at a later time. This regular expression has the added bonus of not only reordering the columns correctly but replacing the tabs with colons all in one command.
284
285
286The result should look like this:
287
288webguy@brainstormstudios.com:3e00bf226141320e8a29221fadeb8063
289wayne@trailofterror.com:ff0288a33eff49a605efe21c40e68abc
290emerald98@sbcglobal.net:9de88bca6f156e7149509391ad717c52
291Xanthar@Wintermoor.org:c6649d94e71a8565fc9d600f4bddf3aa
292Ironman@theironkingdom.com:d1736238c2ce98cbf4a2e965e3f71f23
293hauntedillinois@gmail.com:b8cff9a85a61f2a8fc61f8070ffcd1e2
294
295<END EXAMPLE ------------------------------------------------------------------------------------------------------------------------------------------------------- END EXAMPLE>
296
297
298YE. The database is now parsed not only for dehashing within hashcat (the correct term is cracking not dehashing actually).
299In addition email:hash and user:hash are parsed which will be needed later to match up with the hashcat results in order to create an emailpass and a userpass combo.
300I will be covering how to use hashcat to crack the hashes in the next guide, followed by the third and final guide on parsing/matching the results from hashcat and your email:hash and user:hash.
301
302If this guide helped you, instead of repping me or replying with a thank you ( i have enough rep and thank yous) please make an attempt to pass on this knowledge to your felllow crackers and hackers instead of flexing your knowledge on them, so that all of us, each and every one of us, can become HQ and live in peace and harmony free of confused skids.
303
304If this guide confused you, well fucking deal w/ it because I tried really hard to make this something that anybody could comprehend so basically you are either just stupid or you need to try harder and concentrate more. If you really are stuck try contacting me on telegram @bashscripts but please be patient because I am a popular guy and a busy one at that.
305
306Love you,
307
308- The Gay-ass Greek God Juji