API tools faq
paste
Rwkregime

Don Juji's Complete Guide To Parsing Databases | Part I

Rwkregime
Feb 24th, 2020
1,192
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 28.17 KB | None | 0 0
raw download clone embed print report
  1. Don Juji's Complete Guide To Parsing, Cracking and creating combos from raw sql databases.
  2.  
  3. PART I OF III: Parsing For Hashcat
  4.  
  5.  
  6. This guide is part 1 of 3 and will cover how to parse out the three needed text files so that you can start cracking in hashcat and be ready for matching.
  7. The following two guides will then cover how to crack in hashcat in part II, followed by the matching and finalizing into combos in part III.
  8.  
  9. PREREQUISITES
  10.  
  11.  
  12. Software requirements for this section of the guide:
  13.  
  14. 1. Em-editor - https://support.emeditor.com/en/downloads/latest/installer/64
  15.  
  16. Software requirements for the entire guide:
  17.  
  18. 1. Em-editor - https://support.emeditor.com/en/downloads/latest/installer/64
  19. 2. Hashcat - https://hashcat.net/files/hashcat-5.1.0.7z
  20. 3. Unified List Manager - http://downloads.unifiedlm.com/uploads/ULM_V1E139.zip
  21.  
  22.  
  23. INTRODUCTION
  24.  
  25.  
  26.  
  27. To prepare for cracking hashes and later matching up your cracked founds with usernames and emails to get emailpass and userpass the following three text files are required:
  28.  
  29. 1. user:hash
  30. 2. email:hash
  31. 3. hash or hash:salt (depending on if your database uses a hashtype with salts.
  32.  
  33. For this example I will use the first few lines of a vB database. vBulletin contain one of three different hashtypes depending on the version. This is because older vB forums used a more simple 3 character salt as opposed to the now mostly standardized 30 character salts. In addition, some vB forums have begun to start adopting bcrypt hashing algorithms, although this is still quite rare. Most of the time you are going to find that a vB dump will have 30 char salts towards the end and 3 char salts at the start because the forum's version was upgraded at some point. For the sake of simplicity our example contains only the older 3 char salts. Here are the numbers that you will need to specify later on to hashcat in order to tell it which hashtype you are using, when dealing with vB databases.
  34.  
  35. -- vB 3 character salt: 2611
  36. -- vB 30 character salt: 2711
  37. -- bcrypt: 3200
  38.  
  39. Full reference list for hashcat hashtype examples/modes: https://hashcat.net/wiki/doku.php?id=example_hashes
  40.  
  41. PART I -- INITIAL PARSING
  42.  
  43.  
  44.  
  45.  
  46.  
  47. Ok now lets begin, here is your example:
  48.  
  49.  
  50. Adminer 4.7.3 MySQL dump
  51.  
  52. SET NAMES utf8;
  53. SET time_zone = '+00:00';
  54. SET foreign_key_checks = 0;
  55. SET sql_mode = 'NO_AUTO_VALUE_ON_ZERO';
  56.  
  57. DROP TABLE IF EXISTS `vb_user`;
  58. CREATE TABLE `vb_user` (
  59. `userid` int(10) unsigned NOT NULL AUTO_INCREMENT,
  60. `usergroupid` smallint(5) unsigned NOT NULL DEFAULT '0',
  61. `membergroupids` char(250) NOT NULL DEFAULT '',
  62. `displaygroupid` smallint(5) unsigned NOT NULL DEFAULT '0',
  63. `username` varchar(100) NOT NULL DEFAULT '',
  64. `password` char(32) NOT NULL DEFAULT '',
  65. `passworddate` date NOT NULL DEFAULT '1000-01-01',
  66. `email` char(100) NOT NULL DEFAULT '',
  67. `styleid` smallint(5) unsigned NOT NULL DEFAULT '0',
  68. `parentemail` char(50) NOT NULL DEFAULT '',
  69. `homepage` char(100) NOT NULL DEFAULT '',
  70. `icq` char(20) NOT NULL DEFAULT '',
  71. `aim` char(20) NOT NULL DEFAULT '',
  72. `yahoo` char(32) NOT NULL DEFAULT '',
  73. `msn` char(100) NOT NULL DEFAULT '',
  74. `skype` char(32) NOT NULL DEFAULT '',
  75. `showvbcode` smallint(5) unsigned NOT NULL DEFAULT '0',
  76. `showbirthday` smallint(5) unsigned NOT NULL DEFAULT '2',
  77. `usertitle` char(250) NOT NULL DEFAULT '',
  78. `customtitle` smallint(6) NOT NULL DEFAULT '0',
  79. `joindate` int(10) unsigned NOT NULL DEFAULT '0',
  80. `daysprune` smallint(6) NOT NULL DEFAULT '0',
  81. `lastvisit` int(10) unsigned NOT NULL DEFAULT '0',
  82. `lastactivity` int(10) unsigned NOT NULL DEFAULT '0',
  83. `lastpost` int(10) unsigned NOT NULL DEFAULT '0',
  84. `lastpostid` int(10) unsigned NOT NULL DEFAULT '0',
  85. `posts` int(10) unsigned NOT NULL DEFAULT '0',
  86. `reputation` int(11) NOT NULL DEFAULT '10',
  87. `reputationlevelid` int(10) unsigned NOT NULL DEFAULT '1',
  88. `timezoneoffset` char(4) NOT NULL DEFAULT '',
  89. `pmpopup` smallint(6) NOT NULL DEFAULT '0',
  90. `avatarid` smallint(6) NOT NULL DEFAULT '0',
  91. `avatarrevision` int(10) unsigned NOT NULL DEFAULT '0',
  92. `profilepicrevision` int(10) unsigned NOT NULL DEFAULT '0',
  93. `sigpicrevision` int(10) unsigned NOT NULL DEFAULT '0',
  94. `options` int(10) unsigned NOT NULL DEFAULT '33570831',
  95. `birthday` char(10) NOT NULL DEFAULT '',
  96. `birthday_search` date NOT NULL DEFAULT '1000-01-01',
  97. `maxposts` smallint(6) NOT NULL DEFAULT '-1',
  98. `startofweek` smallint(6) NOT NULL DEFAULT '1',
  99. `ipaddress` varchar(45) NOT NULL DEFAULT '',
  100. `referrerid` int(10) unsigned NOT NULL DEFAULT '0',
  101. `languageid` smallint(5) unsigned NOT NULL DEFAULT '0',
  102. `emailstamp` int(10) unsigned NOT NULL DEFAULT '0',
  103. `threadedmode` smallint(5) unsigned NOT NULL DEFAULT '0',
  104. `autosubscribe` smallint(6) NOT NULL DEFAULT '-1',
  105. `pmtotal` smallint(5) unsigned NOT NULL DEFAULT '0',
  106. `pmunread` smallint(5) unsigned NOT NULL DEFAULT '0',
  107. `salt` char(30) NOT NULL DEFAULT '',
  108. `ipoints` int(10) unsigned NOT NULL DEFAULT '0',
  109. `infractions` int(10) unsigned NOT NULL DEFAULT '0',
  110. `warnings` int(10) unsigned NOT NULL DEFAULT '0',
  111. `infractiongroupids` varchar(255) NOT NULL DEFAULT '',
  112. `infractiongroupid` smallint(5) unsigned NOT NULL DEFAULT '0',
  113. `adminoptions` int(10) unsigned NOT NULL DEFAULT '0',
  114. `importuserid` bigint(20) NOT NULL DEFAULT '0',
  115. `profilevisits` int(10) unsigned NOT NULL DEFAULT '0',
  116. `friendcount` int(10) unsigned NOT NULL DEFAULT '0',
  117. `friendreqcount` int(10) unsigned NOT NULL DEFAULT '0',
  118. `vmunreadcount` int(10) unsigned NOT NULL DEFAULT '0',
  119. `vmmoderatedcount` int(10) unsigned NOT NULL DEFAULT '0',
  120. `socgroupinvitecount` int(10) unsigned NOT NULL DEFAULT '0',
  121. `socgroupreqcount` int(10) unsigned NOT NULL DEFAULT '0',
  122. `pcunreadcount` int(10) unsigned NOT NULL DEFAULT '0',
  123. `pcmoderatedcount` int(10) unsigned NOT NULL DEFAULT '0',
  124. `gmmoderatedcount` int(10) unsigned NOT NULL DEFAULT '0',
  125. `assetposthash` varchar(32) NOT NULL DEFAULT '',
  126. `fbuserid` varchar(255) NOT NULL,
  127. `fbjoindate` int(10) unsigned NOT NULL DEFAULT '0',
  128. `fbname` varchar(255) NOT NULL,
  129. `logintype` enum('vb','fb') NOT NULL DEFAULT 'vb',
  130. `fbaccesstoken` varchar(255) NOT NULL,
  131. `dbtech_usertag_excluded` tinyint(1) unsigned NOT NULL DEFAULT '0',
  132. `dbtech_usertag_mentioncount` int(10) unsigned NOT NULL DEFAULT '0',
  133. `dbtech_usertag_tagcount` int(10) unsigned NOT NULL DEFAULT '0',
  134. `dbtech_usertag_mentions` int(10) unsigned NOT NULL DEFAULT '0',
  135. `dbtech_usertag_tags` int(10) unsigned NOT NULL DEFAULT '0',
  136. `dbtech_usertag_settings` int(10) unsigned NOT NULL DEFAULT '0',
  137. `newrepcount` smallint(5) unsigned NOT NULL DEFAULT '0',
  138. `panjo_selling` tinyint(1) DEFAULT NULL,
  139. PRIMARY KEY (`userid`),
  140. KEY `usergroupid` (`usergroupid`),
  141. KEY `username` (`username`),
  142. KEY `birthday` (`birthday`,`showbirthday`),
  143. KEY `birthday_search` (`birthday_search`),
  144. KEY `importuser_index` (`importuserid`),
  145. KEY `referrerid` (`referrerid`),
  146. KEY `fbuserid` (`fbuserid`),
  147. KEY `email` (`email`),
  148. KEY `lastactivity` (`lastactivity`)
  149. ) ENGINE=InnoDB DEFAULT CHARSET=latin1;
  150.  
  151. INSERT INTO `vb_user` (`userid`, `usergroupid`, `membergroupids`, `displaygroupid`, `username`, `password`, `passworddate`, `email`, `styleid`, `parentemail`, `homepage`, `icq`, `aim`, `yahoo`, `msn`, `skype`, `showvbcode`, `showbirthday`, `usertitle`, `customtitle`, `joindate`, `daysprune`, `lastvisit`, `lastactivity`, `lastpost`, `lastpostid`, `posts`, `reputation`, `reputationlevelid`, `timezoneoffset`, `pmpopup`, `avatarid`, `avatarrevision`, `profilepicrevision`, `sigpicrevision`, `options`, `birthday`, `birthday_search`, `maxposts`, `startofweek`, `ipaddress`, `referrerid`, `languageid`, `emailstamp`, `threadedmode`, `autosubscribe`, `pmtotal`, `pmunread`, `salt`, `ipoints`, `infractions`, `warnings`, `infractiongroupids`, `infractiongroupid`, `adminoptions`, `importuserid`, `profilevisits`, `friendcount`, `friendreqcount`, `vmunreadcount`, `vmmoderatedcount`, `socgroupinvitecount`, `socgroupreqcount`, `pcunreadcount`, `pcmoderatedcount`, `gmmoderatedcount`, `assetposthash`, `fbuserid`, `fbjoindate`, `fbname`, `logintype`, `fbaccesstoken`, `dbtech_usertag_excluded`, `dbtech_usertag_mentioncount`, `dbtech_usertag_tagcount`, `dbtech_usertag_mentions`, `dbtech_usertag_tags`, `dbtech_usertag_settings`, `newrepcount`, `panjo_selling`) VALUES
  152. (1, 6, '', 0, 'drfrightner', 'fa382cd22986762d60cac8e0bb7644e6', '2019-01-16', '[email protected]', 3, '', 'http://www.halloweenproductions.com', '', 'drfrightnr', '[email protected]', '', '', 2, 2, 'Administrator', 0, 1060016100, 0, 1550744779, 1550825167, 1550744778, 325434, 9572, 10, 5, '-6', 0, 0, 5, 2, 1, 45631575, '03-24-1969', '1969-03-24', -1, 1, '', 0, 0, 0, 0, -1, 115, 89, '8RQW_;6#^!\'UO|c{m>zv3Ov1c?`q`|', 0, 0, 0, '', 0, 0, 0, 39882, 44, 13, 0, 0, 0, 0, 0, 0, 0, 'ca6a8636a65cc4dc4a861ed404487632', '', 0, '', 'vb', 'EAAEmB3oT4FQBAL0hhf1a9NdEwxej8WGzdDUwdPGXUg8uTYZBmJAcdZCuRlkAup7cdMqOquS3YfN26FFIvGUYA1RhPhQ3Bmh6ix6zWNvMUHZBBoPbD0QfEikzSdgMy2H8dwAZBshTOoY7nfZBDATnnry4XognDjDFulOm5tzZAByxt0NUWvZBaCKcAJZCpQFDzZCUZD', 0, 0, 0, 1, 0, 0, 0, NULL),
  153. (2, 2, '', 0, 'zzap', '3e00bf226141320e8a29221fadeb8063', '2007-05-30', '[email protected]', 0, '', '', '', 'FrightmistressLS', '', '', '', 2, 2, 'Junior Member', 0, 1058763710, 0, 1164642583, 1190035020, 1164296466, 0, 12, 10, 5, '-5', 0, 0, 0, 0, 0, 45108439, '', '1000-01-01', -1, 2, '', 0, 0, 0, 0, 0, 26, 25, 'L2q', 0, 0, 0, '', 0, 0, 2, 4415, 0, 0, 0, 0, 0, 0, 0, 0, 0, '', '', 0, '', 'vb', '', 0, 0, 0, 0, 0, 0, 0, NULL),
  154. (3, 2, '', 0, 'spookologist', 'ff0288a33eff49a605efe21c40e68abc', '2007-05-30', '[email protected]', 0, '', 'http://www.trailofterror.com', '', 'TofTerror9', '', 'spookologist', '', 2, 2, 'Senior Member', 0, 1058799339, 0, 1463031519, 1487566867, 1401255481, 158642, 305, 10, 5, '-5', 0, 0, 3, 0, 3, 45108311, '', '1000-01-01', -1, 1, '', 0, 0, 1390459933, 0, 0, 17, 1, 'MHL', 0, 0, 0, '', 0, 0, 3, 6463, 2, 0, 0, 0, 0, 0, 0, 0, 0, '490760778ea030e501c1b5d0f1f7fe44', '', 0, '', 'vb', '', 0, 0, 0, 0, 0, 0, 0, NULL),
  155. (4, 2, '', 0, 'Karl Fields', '81db9df708d9271474618712ae2a15ff', '2017-03-30', '[email protected]', 0, '', 'http://www.piratesofemerson.com', '', '', '', '', '', 2, 2, 'Senior Member', 0, 1060009860, 0, 1550543619, 1550627215, 1540969825, 325094, 284, 10, 5, '-8', 1, 0, 3, 1, 0, 45633367, '', '1000-01-01', -1, 1, '', 0, 0, 1440104673, 0, 0, 100, 0, '6qDG0}s6L\'o4b=mu&$x6{Y*8<yR>UN', 0, 0, 0, '', 0, 0, 4, 8876, 0, 1, 0, 0, 0, 0, 0, 0, 0, '0be677bf077bb048d215e2c1667d5654', '', 0, '', 'vb', '', 0, 0, 0, 1, 0, 0, 0, NULL),
  156. (6, 2, '', 0, 'Kevin Kruse', '9de88bca6f156e7149509391ad717c52', '2010-05-16', '[email protected]', 0, '', '', '', '', '', '', '', 0, 2, 'Junior Member', 0, 1060020312, 0, 1362628072, 1362628072, 0, 0, 0, 10, 5, '', 0, 0, 0, 0, 0, 45107287, '', '1000-01-01', 0, 0, '', 0, 0, 0, 0, 0, 4, 0, '^;V', 0, 0, 0, '', 0, 0, 7, 3788, 0, 2, 0, 0, 0, 0, 0, 0, 0, '', '', 0, '', 'vb', '', 0, 0, 0, 0, 0, 0, 0, NULL),
  157. (7, 2, '', 0, 'Xanthar', 'c6649d94e71a8565fc9d600f4bddf3aa', '2007-05-30', '[email protected]', 0, '', '', '', '', '', '', '', 0, 2, 'Member', 0, 1060021238, 0, 1398640882, 1452889365, 1398640535, 158271, 70, 10, 5, '', 0, 0, 3, 0, 0, 45107287, '', '1000-01-01', 0, 0, '', 0, 0, 0, 0, 0, 8, 2, '_+:', 0, 0, 0, '', 0, 0, 8, 4819, 0, 0, 0, 0, 0, 0, 0, 0, 0, '', '', 0, '', 'vb', '', 0, 0, 0, 0, 0, 0, 0, NULL),
  158. (8, 2, '', 0, 'Ironman', 'd1736238c2ce98cbf4a2e965e3f71f23', '2007-05-30', '[email protected]', 0, '', 'http://www.theironkingdom.com', '', '', '', '', '', 0, 2, 'Senior Member', 0, 1060021319, 0, 1384275005, 1384783352, 1359753888, 146153, 126, 10, 5, '', 0, 0, 0, 0, 0, 45107287, '', '1000-01-01', 0, 0, '', 0, 0, 1305065197, 0, 0, 41, 2, 'pZ)', 0, 0, 0, '', 0, 0, 9, 6249, 1, 0, 0, 0, 0, 0, 0, 0, 0, '7391eba23e7f3b24ffd14416d78953d5', '', 0, '', 'vb', '', 0, 0, 0, 0, 0, 0, 0, NULL),
  159. (9, 2, '', 0, 'Haunted Illinois', 'b8cff9a85a61f2a8fc61f8070ffcd1e2', '2007-05-30', '[email protected]', 0, '', 'http://www.hauntedillinois.com', '', '', '', '', '', 2, 2, 'Senior Member', 0, 1060021320, 0, 1453136312, 1453142636, 1407591961, 159603, 483, 10, 5, '-6', 0, 0, 3, 0, 0, 45632855, '', '1000-01-01', -1, 1, '', 0, 0, 0, 0, 1, 6, 2, '*ry', 0, 0, 0, '', 0, 0, 10, 7338, 6, 0, 0, 0, 0, 0, 0, 0, 0, '', '', 0, '', 'vb', '', 0, 0, 0, 0, 0, 0, 0, NULL),
  160.  
  161. <END EXAMPLE ------------------------------------------------------------------------------------------------------------------------------------------------------- END EXAMPLE>
  162.  
  163. Please note that you may need to remove lines after the columns at the end of the database as well, it should be obvious where the columns end at the closing schema data start
  164. First thing we need to do is remove any lines that are not column data. The actual data begins where the columns start so we will remove all this.
  165.  
  166. The result should like this:
  167.  
  168.  
  169.  
  170. (1, 6, '', 0, 'drfrightner', 'fa382cd22986762d60cac8e0bb7644e6', '2019-01-16', '[email protected]', 3, '', 'http://www.halloweenproductions.com', '', 'drfrightnr', '[email protected]', '', '', 2, 2, 'Administrator', 0, 1060016100, 0, 1550744779, 1550825167, 1550744778, 325434, 9572, 10, 5, '-6', 0, 0, 5, 2, 1, 45631575, '03-24-1969', '1969-03-24', -1, 1, '', 0, 0, 0, 0, -1, 115, 89, '8RQW_;6#^!\'UO|c{m>zv3Ov1c?`q`|', 0, 0, 0, '', 0, 0, 0, 39882, 44, 13, 0, 0, 0, 0, 0, 0, 0, 'ca6a8636a65cc4dc4a861ed404487632', '', 0, '', 'vb', 'EAAEmB3oT4FQBAL0hhf1a9NdEwxej8WGzdDUwdPGXUg8uTYZBmJAcdZCuRlkAup7cdMqOquS3YfN26FFIvGUYA1RhPhQ3Bmh6ix6zWNvMUHZBBoPbD0QfEikzSdgMy2H8dwAZBshTOoY7nfZBDATnnry4XognDjDFulOm5tzZAByxt0NUWvZBaCKcAJZCpQFDzZCUZD', 0, 0, 0, 1, 0, 0, 0, NULL),
  171. (2, 2, '', 0, 'zzap', '3e00bf226141320e8a29221fadeb8063', '2007-05-30', '[email protected]', 0, '', '', '', 'FrightmistressLS', '', '', '', 2, 2, 'Junior Member', 0, 1058763710, 0, 1164642583, 1190035020, 1164296466, 0, 12, 10, 5, '-5', 0, 0, 0, 0, 0, 45108439, '', '1000-01-01', -1, 2, '', 0, 0, 0, 0, 0, 26, 25, 'L2q', 0, 0, 0, '', 0, 0, 2, 4415, 0, 0, 0, 0, 0, 0, 0, 0, 0, '', '', 0, '', 'vb', '', 0, 0, 0, 0, 0, 0, 0, NULL),
  172. (3, 2, '', 0, 'spookologist', 'ff0288a33eff49a605efe21c40e68abc', '2007-05-30', '[email protected]', 0, '', 'http://www.trailofterror.com', '', 'TofTerror9', '', 'spookologist', '', 2, 2, 'Senior Member', 0, 1058799339, 0, 1463031519, 1487566867, 1401255481, 158642, 305, 10, 5, '-5', 0, 0, 3, 0, 3, 45108311, '', '1000-01-01', -1, 1, '', 0, 0, 1390459933, 0, 0, 17, 1, 'MHL', 0, 0, 0, '', 0, 0, 3, 6463, 2, 0, 0, 0, 0, 0, 0, 0, 0, '490760778ea030e501c1b5d0f1f7fe44', '', 0, '', 'vb', '', 0, 0, 0, 0, 0, 0, 0, NULL),
  173. (4, 2, '', 0, 'Karl Fields', '81db9df708d9271474618712ae2a15ff', '2017-03-30', '[email protected]', 0, '', 'http://www.piratesofemerson.com', '', '', '', '', '', 2, 2, 'Senior Member', 0, 1060009860, 0, 1550543619, 1550627215, 1540969825, 325094, 284, 10, 5, '-8', 1, 0, 3, 1, 0, 45633367, '', '1000-01-01', -1, 1, '', 0, 0, 1440104673, 0, 0, 100, 0, '6qDG0}s6L\'o4b=mu&$x6{Y*8<yR>UN', 0, 0, 0, '', 0, 0, 4, 8876, 0, 1, 0, 0, 0, 0, 0, 0, 0, '0be677bf077bb048d215e2c1667d5654', '', 0, '', 'vb', '', 0, 0, 0, 1, 0, 0, 0, NULL),
  174. (6, 2, '', 0, 'Kevin Kruse', '9de88bca6f156e7149509391ad717c52', '2010-05-16', '[email protected]', 0, '', '', '', '', '', '', '', 0, 2, 'Junior Member', 0, 1060020312, 0, 1362628072, 1362628072, 0, 0, 0, 10, 5, '', 0, 0, 0, 0, 0, 45107287, '', '1000-01-01', 0, 0, '', 0, 0, 0, 0, 0, 4, 0, '^;V', 0, 0, 0, '', 0, 0, 7, 3788, 0, 2, 0, 0, 0, 0, 0, 0, 0, '', '', 0, '', 'vb', '', 0, 0, 0, 0, 0, 0, 0, NULL),
  175. (7, 2, '', 0, 'Xanthar', 'c6649d94e71a8565fc9d600f4bddf3aa', '2007-05-30', '[email protected]', 0, '', '', '', '', '', '', '', 0, 2, 'Member', 0, 1060021238, 0, 1398640882, 1452889365, 1398640535, 158271, 70, 10, 5, '', 0, 0, 3, 0, 0, 45107287, '', '1000-01-01', 0, 0, '', 0, 0, 0, 0, 0, 8, 2, '_+:', 0, 0, 0, '', 0, 0, 8, 4819, 0, 0, 0, 0, 0, 0, 0, 0, 0, '', '', 0, '', 'vb', '', 0, 0, 0, 0, 0, 0, 0, NULL),
  176. (8, 2, '', 0, 'Ironman', 'd1736238c2ce98cbf4a2e965e3f71f23', '2007-05-30', '[email protected]', 0, '', 'http://www.theironkingdom.com', '', '', '', '', '', 0, 2, 'Senior Member', 0, 1060021319, 0, 1384275005, 1384783352, 1359753888, 146153, 126, 10, 5, '', 0, 0, 0, 0, 0, 45107287, '', '1000-01-01', 0, 0, '', 0, 0, 1305065197, 0, 0, 41, 2, 'pZ)', 0, 0, 0, '', 0, 0, 9, 6249, 1, 0, 0, 0, 0, 0, 0, 0, 0, '7391eba23e7f3b24ffd14416d78953d5', '', 0, '', 'vb', '', 0, 0, 0, 0, 0, 0, 0, NULL),
  177. (9, 2, '', 0, 'Haunted Illinois', 'b8cff9a85a61f2a8fc61f8070ffcd1e2', '2007-05-30', '[email protected]', 0, '', 'http://www.hauntedillinois.com', '', '', '', '', '', 2, 2, 'Senior Member', 0, 1060021320, 0, 1453136312, 1453142636, 1407591961, 159603, 483, 10, 5, '-6', 0, 0, 3, 0, 0, 45632855, '', '1000-01-01', -1, 1, '', 0, 0, 0, 0, 1, 6, 2, '*ry', 0, 0, 0, '', 0, 0, 10, 7338, 6, 0, 0, 0, 0, 0, 0, 0, 0, '', '', 0, '', 'vb', '', 0, 0, 0, 0, 0, 0, 0, NULL),
  178.  
  179.  
  180. <END EXAMPLE ------------------------------------------------------------------------------------------------------------------------------------------------------- END EXAMPLE>
  181.  
  182.  
  183. Because single quotes do not appear in the actual salts and neither do commas, and for this example we will be using tab as our separator for parsing, we can simply remove all single quotes and commas by pressing ctrl + h and putting first a comma in the find field, leaving the replace field blank and then selecting replace all. Then again we will repeat this process using a single quote in place of the comma.
  184.  
  185. The result should look like this:
  186.  
  187. (1 6 0 drfrightner fa382cd22986762d60cac8e0bb7644e6 2019-01-16 [email protected] 3 http://www.halloweenproductions.com drfrightnr [email protected] 2 2 Administrator 0 1060016100 0 1550744779 1550825167 1550744778 325434 9572 10 5 -6 0 0 5 2 1 45631575 03-24-1969 1969-03-24 -1 1 0 0 0 0 -1 115 89 8RQW_;6#^!\UO|c{m>zv3Ov1c?`q`| 0 0 0 0 0 0 39882 44 13 0 0 0 0 0 0 0 ca6a8636a65cc4dc4a861ed404487632 0 vb EAAEmB3oT4FQBAL0hhf1a9NdEwxej8WGzdDUwdPGXUg8uTYZBmJAcdZCuRlkAup7cdMqOquS3YfN26FFIvGUYA1RhPhQ3Bmh6ix6zWNvMUHZBBoPbD0QfEikzSdgMy2H8dwAZBshTOoY7nfZBDATnnry4XognDjDFulOm5tzZAByxt0NUWvZBaCKcAJZCpQFDzZCUZD 0 0 0 1 0 0 0 NULL)
  188. (2 2 0 zzap 3e00bf226141320e8a29221fadeb8063 2007-05-30 [email protected] 0 FrightmistressLS 2 2 Junior Member 0 1058763710 0 1164642583 1190035020 1164296466 0 12 10 5 -5 0 0 0 0 0 45108439 1000-01-01 -1 2 0 0 0 0 0 26 25 L2q 0 0 0 0 0 2 4415 0 0 0 0 0 0 0 0 0 0 vb 0 0 0 0 0 0 0 NULL)
  189. (3 2 0 spookologist ff0288a33eff49a605efe21c40e68abc 2007-05-30 [email protected] 0 http://www.trailofterror.com TofTerror9 spookologist 2 2 Senior Member 0 1058799339 0 1463031519 1487566867 1401255481 158642 305 10 5 -5 0 0 3 0 3 45108311 1000-01-01 -1 1 0 0 1390459933 0 0 17 1 MHL 0 0 0 0 0 3 6463 2 0 0 0 0 0 0 0 0 490760778ea030e501c1b5d0f1f7fe44 0 vb 0 0 0 0 0 0 0 NULL)
  190. (4 2 0 Karl Fields 81db9df708d9271474618712ae2a15ff 2017-03-30 [email protected] 0 http://www.piratesofemerson.com 2 2 Senior Member 0 1060009860 0 1550543619 1550627215 1540969825 325094 284 10 5 -8 1 0 3 1 0 45633367 1000-01-01 -1 1 0 0 1440104673 0 0 100 0 6qDG0}s6L\o4b=mu&$x6{Y*8<yR>UN 0 0 0 0 0 4 8876 0 1 0 0 0 0 0 0 0 0be677bf077bb048d215e2c1667d5654 0 vb 0 0 0 1 0 0 0 NULL)
  191. (6 2 0 Kevin Kruse 9de88bca6f156e7149509391ad717c52 2010-05-16 [email protected] 0 0 2 Junior Member 0 1060020312 0 1362628072 1362628072 0 0 0 10 5 0 0 0 0 0 45107287 1000-01-01 0 0 0 0 0 0 0 4 0 ^;V 0 0 0 0 0 7 3788 0 2 0 0 0 0 0 0 0 0 vb 0 0 0 0 0 0 0 NULL)
  192. (7 2 0 Xanthar c6649d94e71a8565fc9d600f4bddf3aa 2007-05-30 [email protected] 0 0 2 Member 0 1060021238 0 1398640882 1452889365 1398640535 158271 70 10 5 0 0 3 0 0 45107287 1000-01-01 0 0 0 0 0 0 0 8 2 _+: 0 0 0 0 0 8 4819 0 0 0 0 0 0 0 0 0 0 vb 0 0 0 0 0 0 0 NULL)
  193. (8 2 0 Ironman d1736238c2ce98cbf4a2e965e3f71f23 2007-05-30 [email protected] 0 http://www.theironkingdom.com 0 2 Senior Member 0 1060021319 0 1384275005 1384783352 1359753888 146153 126 10 5 0 0 0 0 0 45107287 1000-01-01 0 0 0 0 1305065197 0 0 41 2 pZ) 0 0 0 0 0 9 6249 1 0 0 0 0 0 0 0 0 7391eba23e7f3b24ffd14416d78953d5 0 vb 0 0 0 0 0 0 0 NULL)
  194. (9 2 0 Haunted Illinois b8cff9a85a61f2a8fc61f8070ffcd1e2 2007-05-30 [email protected] 0 http://www.hauntedillinois.com 2 2 Senior Member 0 1060021320 0 1453136312 1453142636 1407591961 159603 483 10 5 -6 0 0 3 0 0 45632855 1000-01-01 -1 1 0 0 0 0 1 6 2 *ry 0 0 0 0 0 10 7338 6 0 0 0 0 0 0 0 0 0 vb 0 0 0 0 0 0 0 NULL)
  195.  
  196.  
  197. <END EXAMPLE ------------------------------------------------------------------------------------------------------------------------------------------------------- END EXAMPLE>
  198.  
  199.  
  200. When parsing vB databases into emailpass and userpass combos, and most user table databases in general, we only need to worry about the following four columns:
  201.  
  202. 1.Username
  203. 2.Email
  204. 3.Password
  205. 4.Salt
  206.  
  207. The rest needs to be removed. There are many ways one can accomplish this, but the easiest is probably opening the database in em-editor and selecting the "tab separated" button near the top on the left. This works because most databases have their columns separated by tabs. However they are usually also separated by tabs and single quotation marks but we choose to remove those already. After pressing the tab separator your data will be automatically formatted into columns based on the tab separators. We must now remove all columns besides the four mentioned above.
  208.  
  209. To start we will remove columns 1 through 4 by clicking on the 1 at the top of the column and holding shift until you click the 4 at the top of that column and then right clicking on the bar with the numbers and selecting "delete columns". Now remove the "3" column in the same way, as we don't need dates either. Now we have to scroll to the right to find our salt column as we have 3 our of the four columns we need. In this case the salt is column is number 44 so we want to click on the 4 column and hold shift and scroll all the way down to column 43 just before the salt column and click on that to select and once again right and click remove. We now have the four fields we need together and finally we must remove the left over columns after the four we need using the same method, optionally you can leave one blank column at the end if you don't want to use my regex method explained later.
  210.  
  211. The result should look like this:
  212.  
  213. zzap 3e00bf226141320e8a29221fadeb8063 [email protected] L2q
  214. spookologist ff0288a33eff49a605efe21c40e68abc [email protected] MHL
  215. Kevin Kruse 9de88bca6f156e7149509391ad717c52 [email protected] ^;V
  216. Xanthar c6649d94e71a8565fc9d600f4bddf3aa [email protected] _+:
  217. Ironman d1736238c2ce98cbf4a2e965e3f71f23 [email protected] pZ)
  218. Haunted Illinois b8cff9a85a61f2a8fc61f8070ffcd1e2 [email protected] *ry
  219.  
  220. <END EXAMPLE ------------------------------------------------------------------------------------------------------------------------------------------------------- END EXAMPLE>
  221.  
  222.  
  223. Next we need to start creating the three lists I mentioned at the start.
  224.  
  225. First we will do hash:salt
  226.  
  227. Open up a new tab in em-editor by pressing ctrl + n and copy paste the data into the new tab but do not close the original tab we will still need that.
  228. We will need to click the "tab separated" button again for the new tab as well.
  229.  
  230. For hash:salt we will need to remove the email in between the two. Simply use the same column deletion method to remove the email column between them and then after words delete the user column.
  231.  
  232. The result should look like this:
  233.  
  234. 3e00bf226141320e8a29221fadeb8063 L2q
  235. ff0288a33eff49a605efe21c40e68abc MHL
  236. 9de88bca6f156e7149509391ad717c52 ^;V
  237. c6649d94e71a8565fc9d600f4bddf3aa _+:
  238. d1736238c2ce98cbf4a2e965e3f71f23 pZ)
  239. b8cff9a85a61f2a8fc61f8070ffcd1e2 *ry
  240.  
  241. <END EXAMPLE ------------------------------------------------------------------------------------------------------------------------------------------------------- END EXAMPLE>
  242.  
  243.  
  244. Now all that is let to do is to git rid of the remaining tab spaces and replace them with colon separators as this is the standard separator used in cracking tools, combos and hashcat.
  245. So again pull up the find/replace menu with ctrl + h (if not already open) and in the find field write \t. \t is a standard short code for tab and will be treated as a tab space.
  246. In the replace field put a colon because we are replacing tabs with colons. Again click replace all.
  247.  
  248. The result should look like this:
  249.  
  250. 3e00bf226141320e8a29221fadeb8063:L2q
  251. ff0288a33eff49a605efe21c40e68abc:MHL
  252. 9de88bca6f156e7149509391ad717c52:^;V
  253. c6649d94e71a8565fc9d600f4bddf3aa:_+:
  254. d1736238c2ce98cbf4a2e965e3f71f23:pZ)
  255. b8cff9a85a61f2a8fc61f8070ffcd1e2:*ry
  256.  
  257. <END EXAMPLE ------------------------------------------------------------------------------------------------------------------------------------------------------- END EXAMPLE>
  258.  
  259.  
  260. Congratulations hash:salt is parsed and is now ready to be loaded into hashcat for cracking. However we still need to parse email:hash and user:hash .
  261. Save this tab in its own text document and return to the first tab, copy the contents of the four original fields and open a new tab and paste them.
  262.  
  263. Now we will do user:hash
  264. Now you will repeat the same process but this time you will be removing the last two columns, the email and salt fields. Once again replace \t with : and save the document.
  265.  
  266. The result should look like this:
  267.  
  268. zzap:3e00bf226141320e8a29221fadeb8063
  269. spookologist:ff0288a33eff49a605efe21c40e68abc
  270. Kevin Kruse:9de88bca6f156e7149509391ad717c52
  271. Xanthar:c6649d94e71a8565fc9d600f4bddf3aa
  272. Ironman:d1736238c2ce98cbf4a2e965e3f71f23
  273. Haunted Illinois:b8cff9a85a61f2a8fc61f8070ffcd1e2
  274.  
  275. <END EXAMPLE ------------------------------------------------------------------------------------------------------------------------------------------------------- END EXAMPLE>
  276.  
  277.  
  278. Last we have email:hash
  279. Start by removing the salt and user columns so that you are left with hash and email only
  280. BUT WAIT! we need email:hash not hash:email!
  281. Because the email occurs after the hash in this database we will need to either select the hash column and instead of deleting it right click and go to cut and paste it on the other side of the email (providing you have a free column left).
  282. ORRRR, the easier way is to simply select the "regular expression" bullet under (none) in the ctrl + h find/replace menu and in the find field put (.*)\t(.*) and in the replace field put \2:\1
  283. I am not going to break down why or how this regular expression or "Regex" works, I will cover that at a later time. This regular expression has the added bonus of not only reordering the columns correctly but replacing the tabs with colons all in one command.
  284.  
  285.  
  286. The result should look like this:
  287.  
  288. [email protected]:3e00bf226141320e8a29221fadeb8063
  289. [email protected]:ff0288a33eff49a605efe21c40e68abc
  290. [email protected]:9de88bca6f156e7149509391ad717c52
  291. [email protected]:c6649d94e71a8565fc9d600f4bddf3aa
  292. [email protected]:d1736238c2ce98cbf4a2e965e3f71f23
  293. [email protected]:b8cff9a85a61f2a8fc61f8070ffcd1e2
  294.  
  295. <END EXAMPLE ------------------------------------------------------------------------------------------------------------------------------------------------------- END EXAMPLE>
  296.  
  297.  
  298. YE. The database is now parsed not only for dehashing within hashcat (the correct term is cracking not dehashing actually).
  299. In addition email:hash and user:hash are parsed which will be needed later to match up with the hashcat results in order to create an emailpass and a userpass combo.
  300. I will be covering how to use hashcat to crack the hashes in the next guide, followed by the third and final guide on parsing/matching the results from hashcat and your email:hash and user:hash.
  301.  
  302. If this guide helped you, instead of repping me or replying with a thank you ( i have enough rep and thank yous) please make an attempt to pass on this knowledge to your felllow crackers and hackers instead of flexing your knowledge on them, so that all of us, each and every one of us, can become HQ and live in peace and harmony free of confused skids.
  303.  
  304. If this guide confused you, well fucking deal w/ it because I tried really hard to make this something that anybody could comprehend so basically you are either just stupid or you need to try harder and concentrate more. If you really are stuck try contacting me on telegram @bashscripts but please be patient because I am a popular guy and a busy one at that.
  305.  
  306. Love you,
  307.  
  308. - The Gay-ass Greek God Juji
Advertisement
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!