site banner

Small-Scale Question Sunday for March 3, 2024

Do you have a dumb question that you're kind of embarrassed to ask in the main thread? Is there something you're just not sure about?

This is your opportunity to ask questions. No question too simple or too silly.

Culture war topics are accepted, and proposals for a better intro post are appreciated.

1
Jump in the discussion.

No email address required.

How do I get in touch with individuals that have the computational capabilities to find hash collisions for a monetary compensation? I've forgotten the password to a 7-zip archive, and my single 1080 Ti is currently cosplaying as a shop vac under the watchful eye of hashcat, but I doubt it can exhaust the search space alone.

If you're just bruteforcing it, it's not an efficient use of compute. Even modern graphics cards will struggle. Do you at least have the format of the password you might have used? Are you a Capital-letter word number kind of person? Do you have special characters in your life? That's the kind of thing you want to know for mask attacks. For example: ?u?l?l?l?l?l?l?d?d? for Upsala35. You can make a masklist for trying many different lengths (don't go too long, each character multiplies difficulty).

Alternately, just download a bunch of passphrases and rulesets and see how they go. OneruleotoRuleThemAll is OK, there are loads more out there. Try -O too, that can speed things up for shorter passwords.

If you figure this out please let me know - similar situation with a file that has sentimental value and I have some idea of what the passphrase might be

I have a 7800 XT I can point at it I guess. I could do with a tldr on how to use hashcat though.

I have a 4090 I’ll offer like /u/f3zinker.

I have a RTX 3080, I don't know that's enough, but if you can send me instructions on what to run, I will run my gpu for as long as it takes if you compensate

Thanks, but based on what I've learned today doubling or tripling my raw power won't cut it. I need someone who actually has a clever hashcat masklist or wordlist that doesn't try every combination like "hD$Pe4y!oO".

John the ripper has some modes that use mangling plus a word list. I don't know if hashcat supports that.

Let me know if you find one.

Have you considered renting a GPU instance or two from Amazon Web Sevices?

I would have to use the local equivalent of it due to sanctions, but I think a competent human intermediary should be able to reduce the search space a few orders of magnitude, since I think I used a passphrase for it. I definitely didn't generate a random string as a password.

Was it worth it to password protect that archive in the first place?

No, not really. But the contents have a lot of sentimental value to me.