WC4 hash list check up  Go to the WC Hashing Game challenge

Hi,

is the WC4 hash list generated for this challenge all right? It seems a bit weird that it changes with each page refresh (WC3 list doesn't). Also, attacking WC4 hashes never got any result for me (which of course might be my problem ).

Edit: Never mind. It was my problem and the changing hash is actually a feature of the random salt...

Haven't noticed this before, but this should not pose a problem.

cheers, p0lar

Quote from IPYouFy

Apr 06, 2011 - 22:35:11

Edit: Never mind. It was my problem and the changing hash is actually a feature of the random salt...

Of course i could have computed a fixed table for the hashes.
But this is against my "Code you see is code in use" philosophy

Happy Challenging!

Hello all dear Challengers,
... I see right now how the hashes shame on me. I leave the question under the spoiler so you can make fun of me
Kindest Regards to All - occasus

I got a little question about the code of WC4 part. On line 19 after the function hash(...) how to interpret this: ).$salt; ? I'm really not understanding that concatenation... Maybe it's obvious for many, but not for me, yet.

Any explanation highly appreciated and thanks in advance

Not really a spoiler, but...

This is normal when you have a unique salt per password hash, as is the case here. Here you have to store the salt with the hash, otherwise you cannot verify the hash at a later point. Perhaps it is clearer if you try to make corresponding verification functions (e.g. function verify_wc4($password, $hash)).

The reason to do this should be(come) clear from the difference in cracking the WC3 and WC4 hashes.