title: Password cracking using a dictionary and hashing
body: <p>I'm working on an assignment for school regarding security and how to crack passwords using a dictionary. We are provided six hashed passwords, a dictionary of words, and a salt hash value. Three of the passwords are not salted, I have already cracked those. I am having trouble finding the three salted passwords.</p>
  
  <p>I have my code set up to iterate through the large dictionary and hash each word and then compare to the hashed passwords. I've tried to hash the salt value on to the front and/or back of each word that I am hashing for comparison, but I can't find any matches. We're using three different algorithms (MD-5, SHA-256, and SHA-1). My program checks the length of the password hash and routes it to which algorithm needs to be used for cracking.</p>
  
  <p>Here's an example of what I have running for the salted MD-5 password:</p>
  
  <pre><code>MessageDigest md = MessageDigest.getInstance("MD5");
             md.update((word + salt).getBytes());
          byte[] bytes = md.digest();
          StringBuffer sb = new StringBuffer();
  
          for (int i = 0; i &lt; bytes.length; i++) {
              sb.append(Integer.toString((bytes[i] &amp; 0xff) 
  + 0x100, 16).substring(1));
          }       
  
          return sb.toString();
  </code></pre>
  
  <p>"word" is the password sent in to be checked, "salt" is the salt hex in a string. This returns the value after hashing to a for loop that is running through my dictionary looking for a match. I can't understand why it can find the three unsalted versions but appending the salt to the front (or back) wont work. Obviously I'm misunderstanding something here. Any clarity is greatly appreciated. Thanks!</p>