Cracking Drupal hashes
Taking a closer look at the format, as well as the Drupal documentation, tells us that this is a bcrypt hash, which is denoted with the $2 sequence. The 10 appears to indicate rounds of work, followed by the hash data. This could be interesting, as bcrypt is an algorithm designed to be computationally expensive for password hashing.
Let’s grab our hash, save it in a file, and try to find a compatible format to use for cracking. When looking at the hashcat documentation and examples, while a Drupal 7 mode exists, the hash format is very different from ours. However, running hashcat –help and piping the output to grep bcrypt yields a few possibilities, as shown in Figure 8.12:
Figure 8.12 – bcrypt modes in hashcat
In this case, the closest match seems to be mode 3200, which directly references the $2 format we see in the hash, so this is likely to be a good candidate. Let’s try this with our virtual machine...
