With the basics of SALT understanding out of the way,
let's take a look at a couple of examples and understand
what it is that we're actually looking at
when we see a SALTed password.
Now, you may remember earlier in this skill,
I pointed this out in the Etsy shadow file,
and I'm taking a look specifically at Kali.
And you can see here that we have a dollar sign,
a Y, another dollar sign, and a whole string of text.
And what I have highlighted is the actual password
that's SALTed and hashed and gives us
some critical information as to identify
what type of hashing and SALTing this is.
Now, it's not the exact same password,
but you can see that I have a string of text here.
I pulled this from my local Kali VM
that uses the same type of hashing algorithm
and has a different SALT.
And the reason I did this is because
I just want to break this down step-by-step.
Because as you can see with that long string of text up top,
this is a lot to take in.
So we're gonna break it down one piece at a time.
Between the first set of dollar signs,
you see a letter Y.
And this Y right here is going to identify
what type of hashing algorithm we're using.
In this particular instance, we're using YesCrypt.
More on that in a minute.
And in between the second set of dollar signs,
you see J9T.
And this is the information pertaining to YesCrypt.
This is specific to YesCrypt.
So what blocking information?
Specifically, the parameter block.
This encodes the algorithm parameters of cost,
the memory it uses, and the different flags
within the algorithm itself.
So it's not the actual SALT or the actual final hash.
Between the next set of dollar signs,
you see the actual SALT itself.
And this is, as our example showed earlier,
where we put in our plain text,
this would be the actual SALT
that we put in that SALT parameter.
And after the last dollar sign,
this right here, long string that you see
on the bottom of our image,
is the actual password itself that's hashed and SALTed
to YesCrypt standards.
So this is the breakdown of the entire password itself
and how it got to be in that long string of text.
Now I've found yet another website.
This one in particular does YesCrypt algorithm hashing
for us, where we can take a phrase in plain text,
put our SALT in there, if we want to use one,
it'll do it without it if you choose.
And then it spits out what the actual hash would be
from start to finish in our output.
And as you can see, the password plain text is Kali,
and the SALT is from previous in this video,
where we had the actual PXSS, et cetera, et cetera.
Now we did not put in the J9T,
that was there by default in this particular example
for the parameter information.
But as you can see in the highlighted text above,
that matches, if you want to pause here
and go back and look, the actual output of the hash itself.
So we were able to take that hash
or that plain text password of Kali,
which I know it's password because I use it,
and then the SALT and generate here, as you can see,
the exact same output that Kali outputted
in the Etsy shadow file on my local VM.
Good information to know in terms of how these passwords
are put together, hashed and displayed in the Etsy shadow
for all you POSIX based system users out there.
And lastly, and this pains me really,
because Wikipedia is not a source.
It's a good place to start to be able to go look up
reputable sources, but I did go through each one of these
and verify that the information is correct.
And I wanted to point out here,
and I'll have the link for this below,
that as we zoom in, you can see that on this Wikipedia page,
there are default examples of different types of hashing
inside of the Etsy shadow file and what they correlate to.
So you saw earlier where we had the dollar sign,
Y dollar sign for YesCrypt.
You'll notice that it's in there,
but you can also see a one for MD5,
two, two alpha, two bravo for Bcrypt,
five for SHA-256, six for SHA-512,
many, many more.
And again, I'll have this link below,
but I just wanted to show you that there is a baseline
for this and understanding the correlation
between what you see in the first set of dollar signs
and what it means in terms of algorithm use
to be able to get to that password.
Now, this doesn't include the salt.
This just gives you a starting point on understanding
which type of generator or reverse algorithm
or password cracker you need to use
in order to be able to get that password.