haiti-hash 0.0.1

checksums.yaml

@@ -0,0 +1,7 @@
+---
+SHA256:
+  metadata.gz: ea489f10f5c1dbe663cde1ff954aa0883f4a8c75e317a5a88bba47a6bc806524
+  data.tar.gz: 79c1620f169053f58a53a45dc2727bb6cbf180aa75c9de0969909a7ac1946e98
+SHA512:
+  metadata.gz: 6cc3b6b014785fe7fee794af3a90c812b42bcb3a5eb50a413736faac263f1f5e2c1093bc2d589f57a9cb009794082e692cff15a4d6cbb2d10619c80cfc99c1bf
+  data.tar.gz: f1d02e7486b9126b997a198fd3ffcb889686378c227da43fc8c03cc2d3e9cae1174a9af32afa5355afa6c4c6ad74f9a6bc8dc5258d0f3f422f489abe225d233f

data/.editorconfig

@@ -0,0 +1,21 @@
+# EditorConfig: https://EditorConfig.org
+
+# top-most EditorConfig file
+root = true
+
+# Unix-style newlines with a newline ending every file
+[*]
+end_of_line = lf
+insert_final_newline = true
+
+# ruby
+[*.rb]
+charset = utf-8
+indent_style = space
+indent_size = 2
+trim_trailing_whitespace = true
+
+# keep source format
+[data/prototypes.json]
+indent_style = space
+indent_size = 4

data/.gitignore

@@ -0,0 +1,8 @@
+.yardoc
+*.gem
+/pkg
+/doc
+/vendor
+.bundle/
+/node_modules
+.git

data/.rubocop.yml

@@ -0,0 +1,25 @@
+# Metrics
+AllCops:
+  TargetRubyVersion: 2.4
+
+Layout/AlignHash:
+  Include:
+    - 'lib/**/*.rb'
+Metrics/AbcSize:
+  Enabled: false
+Metrics/ClassLength:
+  Max: 200
+Metrics/CyclomaticComplexity:
+  Enabled: false
+Metrics/LineLength:
+  Include:
+    - 'lib/**/*.rb'
+Metrics/BlockNesting:
+  Exclude:
+    - 'bin/*'
+Metrics/MethodLength:
+  Max: 25
+Metrics/PerceivedComplexity:
+  Max: 10
+Style/RedundantReturn:
+  Enabled: false

data/.yardopts

@@ -0,0 +1,4 @@
+--output-dir docs/yard
+-
+--main README.md
+LICENSE.txt

data/.yardopts-dev

@@ -0,0 +1,6 @@
+--output-dir docs/yard
+--protected
+--private
+-
+--main README.md
+LICENSE.txt

data/Gemfile

@@ -0,0 +1,6 @@
+# frozen_string_literal: true
+
+source 'https://rubygems.org'
+
+# Specify your gem's dependencies in .gemspec
+gemspec

data/Gemfile.lock

@@ -0,0 +1,56 @@
+PATH
+  remote: .
+  specs:
+    haiti-hash (0.0.1)
+      docopt (~> 0.6)
+      paint (~> 2.1)
+
+GEM
+  remote: https://rubygems.org/
+  specs:
+    ast (2.4.0)
+    commonmarker (0.20.1)
+      ruby-enum (~> 0.5)
+    concurrent-ruby (1.1.5)
+    docopt (0.6.1)
+    github-markup (3.0.4)
+    i18n (1.7.0)
+      concurrent-ruby (~> 1.0)
+    jaro_winkler (1.5.3)
+    minitest (5.12.2)
+    paint (2.1.1)
+    parallel (1.18.0)
+    parser (2.6.5.0)
+      ast (~> 2.4.0)
+    rainbow (3.0.0)
+    rake (13.0.0)
+    redcarpet (3.5.0)
+    rubocop (0.75.1)
+      jaro_winkler (~> 1.5.1)
+      parallel (~> 1.10)
+      parser (>= 2.6)
+      rainbow (>= 2.2.2, < 4.0)
+      ruby-progressbar (~> 1.7)
+      unicode-display_width (>= 1.4.0, < 1.7)
+    ruby-enum (0.7.2)
+      i18n
+    ruby-progressbar (1.10.1)
+    unicode-display_width (1.6.0)
+    yard (0.9.20)
+
+PLATFORMS
+  ruby
+
+DEPENDENCIES
+  bundler (~> 2.0)
+  commonmarker (~> 0.20)
+  github-markup (~> 3.0)
+  haiti-hash!
+  minitest (~> 5.12)
+  rake (~> 13.0)
+  redcarpet (~> 3.5)
+  rubocop (~> 0.75)
+  yard (~> 0.9)
+
+BUNDLED WITH
+   2.0.2

data/LICENSE.txt

@@ -0,0 +1,21 @@
+The MIT License (MIT)
+
+Copyright (c) 2019 Alexandre ZANNI
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in
+all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+THE SOFTWARE.

data/README.md

@@ -0,0 +1,32 @@
+# HAITI
+
+[![Gem Version](https://badge.fury.io/rb/haiti.svg)](https://badge.fury.io/rb/haiti-hash)
+![GitHub tag (latest SemVer)](https://img.shields.io/github/tag/Orange-Cyberdefense/haiti)
+[![GitHub forks](https://img.shields.io/github/forks/Orange-Cyberdefense/haiti)](https://github.com/Orange-Cyberdefense/haiti/network)
+[![GitHub stars](https://img.shields.io/github/stars/Orange-Cyberdefense/haiti)](https://github.com/Orange-Cyberdefense/haiti/stargazers)
+[![GitHub license](https://img.shields.io/github/license/Orange-Cyberdefense/haiti)](https://github.com/Orange-Cyberdefense/haiti/blob/master/LICENSE.txt)
+
+[![Packaging status](https://repology.org/badge/vertical-allrepos/haiti.svg)](https://repology.org/project/haiti/versions)
+
+![](https://orange-cyberdefense.github.io/haiti/_media/logo.png)
+
+> _**HA**sh **I**den**T**if**I**er_
+
+## What is it?
+
+A CLI tool to identify the hash type of a given hash.
+
+## Features
+
+- 270+ hash types detected
+- Hashcat and John the Ripper references
+- CLI tool & library
+- Hackable
+
+## References
+
+Homepage / Documentation: https://orange-cyberdefense.github.io/haiti/
+
+## Author
+
+Made by Alexandre ZANNI ([@noraj](https://github.com/noraj)), pentester from Orange Cyberdefense.

data/Rakefile

@@ -0,0 +1,10 @@
+require 'rake/testtask'
+require 'bundler/gem_tasks'
+
+Rake::TestTask.new do |t|
+  t.libs << 'test'
+end
+
+desc 'Run tests'
+task default: :test
+

data/bin/haiti

@@ -0,0 +1,69 @@
+#!/usr/bin/env ruby
+# frozen_string_literal: true
+
+# Ruby internal
+require 'pp'
+# Project internal
+require 'haiti'
+# External
+require 'docopt'
+require 'paint'
+
+doc = <<~DOCOPT
+  HAITI  (HAsh IdenTifIer)
+
+  Usage:
+    haiti [options] <hash>
+    haiti -h | --help
+    haiti --version
+
+  Options:
+    --no-color      Disable colorized output
+    -e, --extended  List all possible hash algorithms including ones using salt
+    --short         Display in a short format: do not display hashcat and john the ripper references
+    --hashcat-only  Show only hashcat references
+    --john-only     Show only john the ripper references
+    --debug         Display arguments
+    -h, --help      Show this screen
+    --version       Show version
+
+  Examples:
+    haiti -e d41d8cd98f00b204e9800998ecf8427e
+    haiti --no-color --short d41d8cd98f00b204e9800998ecf8427e
+DOCOPT
+
+begin
+  args = Docopt.docopt(doc, version: HashIdentifier::VERSION)
+  pp args if args['--debug']
+  # use case 1, using the tool
+  if args['<hash>']
+    hi = HashIdentifier.new(args['<hash>'])
+    if hi.type.empty?
+      puts 'Unknown hash type'
+      exit(0)
+    end
+    if args['--no-color']
+      hi.type.each do |type|
+        next if type.extended && !args['--extended']
+
+        line = type.name
+        line += " [HC: #{type.hashcat}]" unless type.hashcat.nil? || args['--short'] || args['--john-only']
+        line += " [JtR: #{type.john}]" unless type.john.nil? || args['--short'] || args['--hashcat-only']
+        puts line
+      end
+    else
+      hi.type.each do |type|
+        next if type.extended && !args['--extended']
+
+        print Paint[type.name, :bold]
+        print Paint[" [HC: #{type.hashcat}]", :blue] unless type.hashcat.nil? || args['--short'] || args['--john-only']
+        print Paint[" [JtR: #{type.john}]", :green] unless type.john.nil? || args['--short'] || args['--hashcat-only']
+        puts
+      end
+    end
+  end
+  # use case 2, help: already handled by docopt
+  # use case 3, version: already handled by docopt
+rescue Docopt::Exit => e
+  puts e.message
+end

data/bin/haiti_console

@@ -0,0 +1,7 @@
+#!/usr/bin/env ruby
+# frozen_string_literal: true
+
+require 'haiti'
+require 'irb'
+
+IRB.start(__FILE__)

data/bin/haiti_setup

@@ -0,0 +1,7 @@
+
+#!/usr/bin/env bash
+set -euo pipefail
+IFS=$'\n\t'
+set -vx
+
+bundle install

data/data/prototypes.json

@@ -0,0 +1,2389 @@
+[
+    {
+        "regex": "^[a-f0-9]{4}$",
+        "modes": [
+            {
+                "john": null,
+                "hashcat": null,
+                "extended": false,
+                "name": "CRC-16"
+            },
+            {
+                "john": null,
+                "hashcat": null,
+                "extended": false,
+                "name": "CRC-16-CCITT"
+            },
+            {
+                "john": null,
+                "hashcat": null,
+                "extended": false,
+                "name": "FCS-16"
+            }
+        ]
+    },
+    {
+        "regex": "^[a-f0-9]{8}$",
+        "modes": [
+            {
+                "john": null,
+                "hashcat": null,
+                "extended": false,
+                "name": "Adler-32"
+            },
+            {
+                "john": null,
+                "hashcat": null,
+                "extended": false,
+                "name": "CRC-32B"
+            },
+            {
+                "john": null,
+                "hashcat": null,
+                "extended": false,
+                "name": "FCS-32"
+            },
+            {
+                "john": null,
+                "hashcat": null,
+                "extended": false,
+                "name": "GHash-32-3"
+            },
+            {
+                "john": null,
+                "hashcat": null,
+                "extended": false,
+                "name": "GHash-32-5"
+            },
+            {
+                "john": null,
+                "hashcat": null,
+                "extended": false,
+                "name": "FNV-132"
+            },
+            {
+                "john": null,
+                "hashcat": null,
+                "extended": false,
+                "name": "Fletcher-32"
+            },
+            {
+                "john": null,
+                "hashcat": null,
+                "extended": false,
+                "name": "Joaat"
+            },
+            {
+                "john": null,
+                "hashcat": null,
+                "extended": false,
+                "name": "ELF-32"
+            },
+            {
+                "john": null,
+                "hashcat": null,
+                "extended": false,
+                "name": "XOR-32"
+            }
+        ]
+    },
+    {
+        "regex": "^[a-f0-9]{6}$",
+        "modes": [
+            {
+                "john": null,
+                "hashcat": null,
+                "extended": false,
+                "name": "CRC-24"
+            }
+        ]
+    },
+    {
+        "regex": "^(\\$crc32\\$[a-f0-9]{8}.)?[a-f0-9]{8}$",
+        "modes": [
+            {
+                "john": "crc32",
+                "hashcat": null,
+                "extended": false,
+                "name": "CRC-32"
+            }
+        ]
+    },
+    {
+        "regex": "^\\+[a-z0-9\\/.]{12}$",
+        "modes": [
+            {
+                "john": "bfegg",
+                "hashcat": null,
+                "extended": false,
+                "name": "Eggdrop IRC Bot"
+            }
+        ]
+    },
+    {
+        "regex": "^[a-z0-9\\/.]{13}$",
+        "modes": [
+            {
+                "john": "descrypt",
+                "hashcat": 1500,
+                "extended": false,
+                "name": "DES(Unix)"
+            },
+            {
+                "john": "descrypt",
+                "hashcat": 1500,
+                "extended": false,
+                "name": "Traditional DES"
+            },
+            {
+                "john": "descrypt",
+                "hashcat": 1500,
+                "extended": false,
+                "name": "DEScrypt"
+            }
+        ]
+    },
+    {
+        "regex": "^[a-f0-9]{16}$",
+        "modes": [
+            {
+                "john": "mysql",
+                "hashcat": 200,
+                "extended": false,
+                "name": "MySQL323"
+            },
+            {
+                "john": null,
+                "hashcat": 3100,
+                "extended": false,
+                "name": "DES(Oracle)"
+            },
+            {
+                "john": null,
+                "hashcat": 5100,
+                "extended": false,
+                "name": "Half MD5"
+            },
+            {
+                "john": null,
+                "hashcat": 3100,
+                "extended": false,
+                "name": "Oracle 7-10g"
+            },
+            {
+                "john": null,
+                "hashcat": null,
+                "extended": false,
+                "name": "FNV-164"
+            },
+            {
+                "john": null,
+                "hashcat": null,
+                "extended": false,
+                "name": "CRC-64"
+            }
+        ]
+    },
+    {
+        "regex": "^[a-z0-9\\/.]{16}$",
+        "modes": [
+            {
+                "john": "pix-md5",
+                "hashcat": 2400,
+                "extended": false,
+                "name": "Cisco-PIX(MD5)"
+            }
+        ]
+    },
+    {
+        "regex": "^\\([a-z0-9\\/+]{20}\\)$",
+        "modes": [
+            {
+                "john": "dominosec",
+                "hashcat": 8700,
+                "extended": false,
+                "name": "Lotus Notes/Domino 6"
+            }
+        ]
+    },
+    {
+        "regex": "^_[a-z0-9\\/.]{19}$",
+        "modes": [
+            {
+                "john": "bsdicrypt",
+                "hashcat": null,
+                "extended": false,
+                "name": "BSDi Crypt"
+            }
+        ]
+    },
+    {
+        "regex": "^[a-f0-9]{24}$",
+        "modes": [
+            {
+                "john": null,
+                "hashcat": null,
+                "extended": false,
+                "name": "CRC-96(ZIP)"
+            }
+        ]
+    },
+    {
+        "regex": "^[a-z0-9\\/.]{24}$",
+        "modes": [
+            {
+                "john": null,
+                "hashcat": null,
+                "extended": false,
+                "name": "Crypt16"
+            }
+        ]
+    },
+    {
+        "regex": "^(\\$md2\\$)?[a-f0-9]{32}$",
+        "modes": [
+            {
+                "john": "md2",
+                "hashcat": null,
+                "extended": false,
+                "name": "MD2"
+            }
+        ]
+    },
+    {
+        "regex": "^[a-f0-9]{32}(:.+)?$",
+        "modes": [
+            {
+                "john": "raw-md5",
+                "hashcat": 0,
+                "extended": false,
+                "name": "MD5"
+            },
+            {
+                "john": "raw-md4",
+                "hashcat": 900,
+                "extended": false,
+                "name": "MD4"
+            },
+            {
+                "john": null,
+                "hashcat": 2600,
+                "extended": false,
+                "name": "Double MD5"
+            },
+            {
+                "john": "lm",
+                "hashcat": 3000,
+                "extended": false,
+                "name": "LM"
+            },
+            {
+                "john": "ripemd-128",
+                "hashcat": null,
+                "extended": false,
+                "name": "RIPEMD-128"
+            },
+            {
+                "john": "haval-128-4",
+                "hashcat": null,
+                "extended": false,
+                "name": "Haval-128"
+            },
+            {
+                "john": null,
+                "hashcat": null,
+                "extended": false,
+                "name": "Tiger-128"
+            },
+            {
+                "john": null,
+                "hashcat": null,
+                "extended": false,
+                "name": "Skein-256(128)"
+            },
+            {
+                "john": null,
+                "hashcat": null,
+                "extended": false,
+                "name": "Skein-512(128)"
+            },
+            {
+                "john": "lotus5",
+                "hashcat": 8600,
+                "extended": false,
+                "name": "Lotus Notes/Domino 5"
+            },
+            {
+                "john": null,
+                "hashcat": 23,
+                "extended": false,
+                "name": "Skype"
+            },
+            {
+                "john": null,
+                "hashcat": null,
+                "extended": true,
+                "name": "ZipMonster"
+            },
+            {
+                "john": null,
+                "hashcat": 11000,
+                "extended": true,
+                "name": "PrestaShop"
+            },
+            {
+                "john": null,
+                "hashcat": 3500,
+                "extended": true,
+                "name": "md5(md5(md5($pass)))"
+            },
+            {
+                "john": null,
+                "hashcat": 4300,
+                "extended": true,
+                "name": "md5(strtoupper(md5($pass)))"
+            },
+            {
+                "john": null,
+                "hashcat": 4400,
+                "extended": true,
+                "name": "md5(sha1($pass))"
+            },
+            {
+                "john": null,
+                "hashcat": 10,
+                "extended": true,
+                "name": "md5($pass.$salt)"
+            },
+            {
+                "john": null,
+                "hashcat": 20,
+                "extended": true,
+                "name": "md5($salt.$pass)"
+            },
+            {
+                "john": null,
+                "hashcat": 30,
+                "extended": true,
+                "name": "md5(unicode($pass).$salt)"
+            },
+            {
+                "john": null,
+                "hashcat": 40,
+                "extended": true,
+                "name": "md5($salt.unicode($pass))"
+            },
+            {
+                "john": "hmac-md5",
+                "hashcat": 50,
+                "extended": true,
+                "name": "HMAC-MD5 (key = $pass)"
+            },
+            {
+                "john": "hmac-md5",
+                "hashcat": 60,
+                "extended": true,
+                "name": "HMAC-MD5 (key = $salt)"
+            },
+            {
+                "john": null,
+                "hashcat": 3610,
+                "extended": true,
+                "name": "md5(md5($salt).$pass)"
+            },
+            {
+                "john": null,
+                "hashcat": 3710,
+                "extended": true,
+                "name": "md5($salt.md5($pass))"
+            },
+            {
+                "john": null,
+                "hashcat": 3720,
+                "extended": true,
+                "name": "md5($pass.md5($salt))"
+            },
+            {
+                "john": null,
+                "hashcat": 3810,
+                "extended": true,
+                "name": "md5($salt.$pass.$salt)"
+            },
+            {
+                "john": null,
+                "hashcat": 3910,
+                "extended": true,
+                "name": "md5(md5($pass).md5($salt))"
+            },
+            {
+                "john": null,
+                "hashcat": 4010,
+                "extended": true,
+                "name": "md5($salt.md5($salt.$pass))"
+            },
+            {
+                "john": null,
+                "hashcat": 4110,
+                "extended": true,
+                "name": "md5($salt.md5($pass.$salt))"
+            },
+            {
+                "john": null,
+                "hashcat": 4210,
+                "extended": true,
+                "name": "md5($username.0.$pass)"
+            }
+        ]
+    },
+    {
+        "regex": "^(\\$snefru\\$)?[a-f0-9]{32}$",
+        "modes": [
+            {
+                "john": "snefru-128",
+                "hashcat": null,
+                "extended": false,
+                "name": "Snefru-128"
+            }
+        ]
+    },
+    {
+        "regex": "^(\\$NT\\$)?[a-f0-9]{32}$",
+        "modes": [
+            {
+                "john": "nt",
+                "hashcat": 1000,
+                "extended": false,
+                "name": "NTLM"
+            }
+        ]
+    },
+    {
+        "regex": "^([^\\\\\\/:*?\"<>|]{1,20}:)?[a-f0-9]{32}(:[^\\\\\\/:*?\"<>|]{1,20})?$",
+        "modes": [
+            {
+                "john": "mscach",
+                "hashcat": 1100,
+                "extended": false,
+                "name": "Domain Cached Credentials"
+            }
+        ]
+    },
+    {
+        "regex": "^([^\\\\\\/:*?\"<>|]{1,20}:)?(\\$DCC2\\$10240#[^\\\\\\/:*?\"<>|]{1,20}#)?[a-f0-9]{32}$",
+        "modes": [
+            {
+                "john": "mscach2",
+                "hashcat": 2100,
+                "extended": false,
+                "name": "Domain Cached Credentials 2"
+            }
+        ]
+    },
+    {
+        "regex": "^{SHA}[a-z0-9\\/+]{27}=$",
+        "modes": [
+            {
+                "john": "nsldap",
+                "hashcat": 101,
+                "extended": false,
+                "name": "SHA-1(Base64)"
+            },
+            {
+                "john": "nsldap",
+                "hashcat": 101,
+                "extended": false,
+                "name": "Netscape LDAP SHA"
+            }
+        ]
+    },
+    {
+        "regex": "^\\$1\\$[a-z0-9\\/.]{0,8}\\$[a-z0-9\\/.]{22}(:.*)?$",
+        "modes": [
+            {
+                "john": "md5crypt",
+                "hashcat": 500,
+                "extended": false,
+                "name": "MD5 Crypt"
+            },
+            {
+                "john": "md5crypt",
+                "hashcat": 500,
+                "extended": false,
+                "name": "Cisco-IOS(MD5)"
+            },
+            {
+                "john": "md5crypt",
+                "hashcat": 500,
+                "extended": false,
+                "name": "FreeBSD MD5"
+            }
+        ]
+    },
+    {
+        "regex": "^0x[a-f0-9]{32}$",
+        "modes": [
+            {
+                "john": null,
+                "hashcat": null,
+                "extended": false,
+                "name": "Lineage II C4"
+            }
+        ]
+    },
+    {
+        "regex": "^\\$H\\$[a-z0-9\\/.]{31}$",
+        "modes": [
+            {
+                "john": "phpass",
+                "hashcat": 400,
+                "extended": false,
+                "name": "phpBB v3.x"
+            },
+            {
+                "john": "phpass",
+                "hashcat": 400,
+                "extended": false,
+                "name": "Wordpress v2.6.0/2.6.1"
+            },
+            {
+                "john": "phpass",
+                "hashcat": 400,
+                "extended": false,
+                "name": "PHPass' Portable Hash"
+            }
+        ]
+    },
+    {
+        "regex": "^\\$P\\$[a-z0-9\\/.]{31}$",
+        "modes": [
+            {
+                "john": "phpass",
+                "hashcat": 400,
+                "extended": false,
+                "name": "Wordpress \u2265 v2.6.2"
+            },
+            {
+                "john": "phpass",
+                "hashcat": 400,
+                "extended": false,
+                "name": "Joomla \u2265 v2.5.18"
+            },
+            {
+                "john": "phpass",
+                "hashcat": 400,
+                "extended": false,
+                "name": "PHPass' Portable Hash"
+            }
+        ]
+    },
+    {
+        "regex": "^[a-f0-9]{32}:[a-z0-9]{2}$",
+        "modes": [
+            {
+                "john": null,
+                "hashcat": 21,
+                "extended": false,
+                "name": "osCommerce"
+            },
+            {
+                "john": null,
+                "hashcat": 21,
+                "extended": false,
+                "name": "xt:Commerce"
+            }
+        ]
+    },
+    {
+        "regex": "^\\$apr1\\$[a-z0-9\\/.]{0,8}\\$[a-z0-9\\/.]{22}$",
+        "modes": [
+            {
+                "john": null,
+                "hashcat": 1600,
+                "extended": false,
+                "name": "MD5(APR)"
+            },
+            {
+                "john": null,
+                "hashcat": 1600,
+                "extended": false,
+                "name": "Apache MD5"
+            },
+            {
+                "john": null,
+                "hashcat": 1600,
+                "extended": true,
+                "name": "md5apr1"
+            }
+        ]
+    },
+    {
+        "regex": "^{smd5}[a-z0-9$\\/.]{31}$",
+        "modes": [
+            {
+                "john": "aix-smd5",
+                "hashcat": 6300,
+                "extended": false,
+                "name": "AIX(smd5)"
+            }
+        ]
+    },
+    {
+        "regex": "^[a-f0-9]{32}:[a-f0-9]{32}$",
+        "modes": [
+            {
+                "john": null,
+                "hashcat": 3721,
+                "extended": false,
+                "name": "WebEdition CMS"
+            }
+        ]
+    },
+    {
+        "regex": "^[a-f0-9]{32}:.{5}$",
+        "modes": [
+            {
+                "john": null,
+                "hashcat": 2811,
+                "extended": false,
+                "name": "IP.Board \u2265 v2+"
+            }
+        ]
+    },
+    {
+        "regex": "^[a-f0-9]{32}:.{8}$",
+        "modes": [
+            {
+                "john": null,
+                "hashcat": 2811,
+                "extended": false,
+                "name": "MyBB \u2265 v1.2+"
+            }
+        ]
+    },
+    {
+        "regex": "^[a-z0-9]{34}$",
+        "modes": [
+            {
+                "john": null,
+                "hashcat": null,
+                "extended": false,
+                "name": "CryptoCurrency(Adress)"
+            }
+        ]
+    },
+    {
+        "regex": "^[a-f0-9]{40}(:.+)?$",
+        "modes": [
+            {
+                "john": "raw-sha1",
+                "hashcat": 100,
+                "extended": false,
+                "name": "SHA-1"
+            },
+            {
+                "john": null,
+                "hashcat": 4500,
+                "extended": false,
+                "name": "Double SHA-1"
+            },
+            {
+                "john": "ripemd-160",
+                "hashcat": 6000,
+                "extended": false,
+                "name": "RIPEMD-160"
+            },
+            {
+                "john": null,
+                "hashcat": null,
+                "extended": false,
+                "name": "Haval-160"
+            },
+            {
+                "john": null,
+                "hashcat": null,
+                "extended": false,
+                "name": "Tiger-160"
+            },
+            {
+                "john": null,
+                "hashcat": null,
+                "extended": false,
+                "name": "HAS-160"
+            },
+            {
+                "john": "raw-sha1-linkedin",
+                "hashcat": 190,
+                "extended": false,
+                "name": "LinkedIn"
+            },
+            {
+                "john": null,
+                "hashcat": null,
+                "extended": false,
+                "name": "Skein-256(160)"
+            },
+            {
+                "john": null,
+                "hashcat": null,
+                "extended": false,
+                "name": "Skein-512(160)"
+            },
+            {
+                "john": null,
+                "hashcat": null,
+                "extended": true,
+                "name": "MangosWeb Enhanced CMS"
+            },
+            {
+                "john": null,
+                "hashcat": 4600,
+                "extended": true,
+                "name": "sha1(sha1(sha1($pass)))"
+            },
+            {
+                "john": null,
+                "hashcat": 4700,
+                "extended": true,
+                "name": "sha1(md5($pass))"
+            },
+            {
+                "john": null,
+                "hashcat": 110,
+                "extended": true,
+                "name": "sha1($pass.$salt)"
+            },
+            {
+                "john": null,
+                "hashcat": 120,
+                "extended": true,
+                "name": "sha1($salt.$pass)"
+            },
+            {
+                "john": null,
+                "hashcat": 130,
+                "extended": true,
+                "name": "sha1(unicode($pass).$salt)"
+            },
+            {
+                "john": null,
+                "hashcat": 140,
+                "extended": true,
+                "name": "sha1($salt.unicode($pass))"
+            },
+            {
+                "john": "hmac-sha1",
+                "hashcat": 150,
+                "extended": true,
+                "name": "HMAC-SHA1 (key = $pass)"
+            },
+            {
+                "john": "hmac-sha1",
+                "hashcat": 160,
+                "extended": true,
+                "name": "HMAC-SHA1 (key = $salt)"
+            },
+            {
+                "john": null,
+                "hashcat": 4710,
+                "extended": true,
+                "name": "sha1($salt.$pass.$salt)"
+            }
+        ]
+    },
+    {
+        "regex": "^\\*[a-f0-9]{40}$",
+        "modes": [
+            {
+                "john": "mysql-sha1",
+                "hashcat": 300,
+                "extended": false,
+                "name": "MySQL5.x"
+            },
+            {
+                "john": "mysql-sha1",
+                "hashcat": 300,
+                "extended": false,
+                "name": "MySQL4.1"
+            }
+        ]
+    },
+    {
+        "regex": "^[a-z0-9]{43}$",
+        "modes": [
+            {
+                "john": null,
+                "hashcat": 5700,
+                "extended": false,
+                "name": "Cisco-IOS(SHA-256)"
+            }
+        ]
+    },
+    {
+        "regex": "^{SSHA}[a-z0-9\\/+]{38}==$",
+        "modes": [
+            {
+                "john": "nsldaps",
+                "hashcat": 111,
+                "extended": false,
+                "name": "SSHA-1(Base64)"
+            },
+            {
+                "john": "nsldaps",
+                "hashcat": 111,
+                "extended": false,
+                "name": "Netscape LDAP SSHA"
+            },
+            {
+                "john": "nsldaps",
+                "hashcat": 111,
+                "extended": true,
+                "name": "nsldaps"
+            }
+        ]
+    },
+    {
+        "regex": "^[a-z0-9=]{47}$",
+        "modes": [
+            {
+                "john": "fortigate",
+                "hashcat": 7000,
+                "extended": false,
+                "name": "Fortigate(FortiOS)"
+            }
+        ]
+    },
+    {
+        "regex": "^[a-f0-9]{48}$",
+        "modes": [
+            {
+                "john": null,
+                "hashcat": null,
+                "extended": false,
+                "name": "Haval-192"
+            },
+            {
+                "john": "tiger",
+                "hashcat": null,
+                "extended": false,
+                "name": "Tiger-192"
+            },
+            {
+                "john": null,
+                "hashcat": null,
+                "extended": false,
+                "name": "SHA-1(Oracle)"
+            },
+            {
+                "john": "xsha",
+                "hashcat": 122,
+                "extended": false,
+                "name": "OSX v10.4"
+            },
+            {
+                "john": "xsha",
+                "hashcat": 122,
+                "extended": false,
+                "name": "OSX v10.5"
+            },
+            {
+                "john": "xsha",
+                "hashcat": 122,
+                "extended": false,
+                "name": "OSX v10.6"
+            }
+        ]
+    },
+    {
+        "regex": "^[a-f0-9]{51}$",
+        "modes": [
+            {
+                "john": null,
+                "hashcat": null,
+                "extended": false,
+                "name": "Palshop CMS"
+            }
+        ]
+    },
+    {
+        "regex": "^[a-z0-9]{51}$",
+        "modes": [
+            {
+                "john": null,
+                "hashcat": null,
+                "extended": false,
+                "name": "CryptoCurrency(PrivateKey)"
+            }
+        ]
+    },
+    {
+        "regex": "^{ssha1}[0-9]{2}\\$[a-z0-9$\\/.]{44}$",
+        "modes": [
+            {
+                "john": "aix-ssha1",
+                "hashcat": 6700,
+                "extended": false,
+                "name": "AIX(ssha1)"
+            }
+        ]
+    },
+    {
+        "regex": "^0x0100[a-f0-9]{48}$",
+        "modes": [
+            {
+                "john": "mssql05",
+                "hashcat": 132,
+                "extended": false,
+                "name": "MSSQL(2005)"
+            },
+            {
+                "john": "mssql05",
+                "hashcat": 132,
+                "extended": false,
+                "name": "MSSQL(2008)"
+            }
+        ]
+    },
+    {
+        "regex": "^(\\$md5,rounds=[0-9]+\\$|\\$md5\\$rounds=[0-9]+\\$|\\$md5\\$)[a-z0-9\\/.]{0,16}(\\$|\\$\\$)[a-z0-9\\/.]{22}$",
+        "modes": [
+            {
+                "john": "sunmd5",
+                "hashcat": 3300,
+                "extended": false,
+                "name": "Sun MD5 Crypt"
+            }
+        ]
+    },
+    {
+        "regex": "^[a-f0-9]{56}$",
+        "modes": [
+            {
+                "john": "raw-sha224",
+                "hashcat": null,
+                "extended": false,
+                "name": "SHA-224"
+            },
+            {
+                "john": null,
+                "hashcat": null,
+                "extended": false,
+                "name": "Haval-224"
+            },
+            {
+                "john": null,
+                "hashcat": 17300,
+                "extended": false,
+                "name": "SHA3-224"
+            },
+            {
+                "john": null,
+                "hashcat": 17700,
+                "extended": false,
+                "name": "Keccak-224"
+            },
+            {
+                "john": null,
+                "hashcat": null,
+                "extended": false,
+                "name": "Skein-256(224)"
+            },
+            {
+                "john": null,
+                "hashcat": null,
+                "extended": false,
+                "name": "Skein-512(224)"
+            }
+        ]
+    },
+    {
+        "regex": "^(\\$2[axy]|\\$2)\\$[0-9]{2}\\$[a-z0-9\\/.]{53}$",
+        "modes": [
+            {
+                "john": "bcrypt",
+                "hashcat": 3200,
+                "extended": false,
+                "name": "Blowfish(OpenBSD)"
+            },
+            {
+                "john": null,
+                "hashcat": null,
+                "extended": false,
+                "name": "Woltlab Burning Board 4.x"
+            },
+            {
+                "john": "bcrypt",
+                "hashcat": 3200,
+                "extended": false,
+                "name": "bcrypt"
+            }
+        ]
+    },
+    {
+        "regex": "^[a-f0-9]{40}:[a-f0-9]{16}$",
+        "modes": [
+            {
+                "john": null,
+                "hashcat": 5800,
+                "extended": false,
+                "name": "Android PIN"
+            }
+        ]
+    },
+    {
+        "regex": "^(S:)?[a-f0-9]{40}(:)?[a-f0-9]{20}$",
+        "modes": [
+            {
+                "john": "oracle11",
+                "hashcat": 112,
+                "extended": false,
+                "name": "Oracle 11g/12c"
+            }
+        ]
+    },
+    {
+        "regex": "^\\$bcrypt-sha256\\$(2[axy]|2)\\,[0-9]+\\$[a-z0-9\\/.]{22}\\$[a-z0-9\\/.]{31}$",
+        "modes": [
+            {
+                "john": null,
+                "hashcat": null,
+                "extended": false,
+                "name": "bcrypt(SHA-256)"
+            }
+        ]
+    },
+    {
+        "regex": "^[a-f0-9]{32}:.{3}$",
+        "modes": [
+            {
+                "john": null,
+                "hashcat": 2611,
+                "extended": false,
+                "name": "vBulletin < v3.8.5"
+            }
+        ]
+    },
+    {
+        "regex": "^[a-f0-9]{32}:.{30}$",
+        "modes": [
+            {
+                "john": null,
+                "hashcat": 2711,
+                "extended": false,
+                "name": "vBulletin \u2265 v3.8.5"
+            }
+        ]
+    },
+    {
+        "regex": "^(\\$snefru\\$)?[a-f0-9]{64}$",
+        "modes": [
+            {
+                "john": "snefru-256",
+                "hashcat": null,
+                "extended": false,
+                "name": "Snefru-256"
+            }
+        ]
+    },
+    {
+        "regex": "^[a-f0-9]{64}(:.+)?$",
+        "modes": [
+            {
+                "john": "raw-sha256",
+                "hashcat": 1400,
+                "extended": false,
+                "name": "SHA-256"
+            },
+            {
+                "john": null,
+                "hashcat": null,
+                "extended": false,
+                "name": "RIPEMD-256"
+            },
+            {
+                "john": "haval-256-3",
+                "hashcat": null,
+                "extended": false,
+                "name": "Haval-256"
+            },
+            {
+                "john": "gost",
+                "hashcat": 6900,
+                "extended": false,
+                "name": "GOST R 34.11-94"
+            },
+            {
+                "john": null,
+                "hashcat": null,
+                "extended": false,
+                "name": "GOST CryptoPro S-Box"
+            },
+            {
+                "john": null,
+                "hashcat": 17400,
+                "extended": false,
+                "name": "SHA3-256"
+            },
+            {
+                "john": "raw-keccak-256",
+                "hashcat": 17800,
+                "extended": false,
+                "name": "Keccak-256"
+            },
+            {
+                "john": "skein-256",
+                "hashcat": null,
+                "extended": false,
+                "name": "Skein-256"
+            },
+            {
+                "john": null,
+                "hashcat": null,
+                "extended": false,
+                "name": "Skein-512(256)"
+            },
+            {
+                "john": null,
+                "hashcat": null,
+                "extended": true,
+                "name": "Ventrilo"
+            },
+            {
+                "john": null,
+                "hashcat": 1410,
+                "extended": true,
+                "name": "sha256($pass.$salt)"
+            },
+            {
+                "john": null,
+                "hashcat": 1420,
+                "extended": true,
+                "name": "sha256($salt.$pass)"
+            },
+            {
+                "john": null,
+                "hashcat": 1430,
+                "extended": true,
+                "name": "sha256(unicode($pass).$salt)"
+            },
+            {
+                "john": null,
+                "hashcat": 1440,
+                "extended": true,
+                "name": "sha256($salt.unicode($pass))"
+            },
+            {
+                "john": "hmac-sha256",
+                "hashcat": 1450,
+                "extended": true,
+                "name": "HMAC-SHA256 (key = $pass)"
+            },
+            {
+                "john": "hmac-sha256",
+                "hashcat": 1460,
+                "extended": true,
+                "name": "HMAC-SHA256 (key = $salt)"
+            }
+        ]
+    },
+    {
+        "regex": "^[a-f0-9]{32}:[a-z0-9]{32}$",
+        "modes": [
+            {
+                "john": null,
+                "hashcat": 11,
+                "extended": false,
+                "name": "Joomla < v2.5.18"
+            }
+        ]
+    },
+    {
+        "regex": "^[a-f0-9]{32}:[a-f0-9]{32}$",
+        "modes": [
+            {
+                "john": null,
+                "hashcat": null,
+                "extended": false,
+                "name": "SAM(LM_Hash:NT_Hash)"
+            }
+        ]
+    },
+    {
+        "regex": "^(\\$chap\\$0\\*)?[a-f0-9]{32}[\\*:][a-f0-9]{32}(:[0-9]{2})?$",
+        "modes": [
+            {
+                "john": "chap",
+                "hashcat": 4800,
+                "extended": false,
+                "name": "MD5(Chap)"
+            },
+            {
+                "john": "chap",
+                "hashcat": 4800,
+                "extended": false,
+                "name": "iSCSI CHAP Authentication"
+            }
+        ]
+    },
+    {
+        "regex": "^\\$episerver\\$\\*0\\*[a-z0-9\\/=+]+\\*[a-z0-9\\/=+]{27,28}$",
+        "modes": [
+            {
+                "john": "episerver",
+                "hashcat": 141,
+                "extended": false,
+                "name": "EPiServer 6.x < v4"
+            }
+        ]
+    },
+    {
+        "regex": "^{ssha256}[0-9]{2}\\$[a-z0-9$\\/.]{60}$",
+        "modes": [
+            {
+                "john": "aix-ssha256",
+                "hashcat": 6400,
+                "extended": false,
+                "name": "AIX(ssha256)"
+            }
+        ]
+    },
+    {
+        "regex": "^[a-f0-9]{80}$",
+        "modes": [
+            {
+                "john": null,
+                "hashcat": null,
+                "extended": false,
+                "name": "RIPEMD-320"
+            }
+        ]
+    },
+    {
+        "regex": "^\\$episerver\\$\\*1\\*[a-z0-9\\/=+]+\\*[a-z0-9\\/=+]{42,43}$",
+        "modes": [
+            {
+                "john": "episerver",
+                "hashcat": 1441,
+                "extended": false,
+                "name": "EPiServer 6.x \u2265 v4"
+            }
+        ]
+    },
+    {
+        "regex": "^0x0100[a-f0-9]{88}$",
+        "modes": [
+            {
+                "john": "mssql",
+                "hashcat": 131,
+                "extended": false,
+                "name": "MSSQL(2000)"
+            }
+        ]
+    },
+    {
+        "regex": "^[a-f0-9]{96}$",
+        "modes": [
+            {
+                "john": "raw-sha384",
+                "hashcat": 10800,
+                "extended": false,
+                "name": "SHA-384"
+            },
+            {
+                "john": null,
+                "hashcat": 17500,
+                "extended": false,
+                "name": "SHA3-384"
+            },
+            {
+                "john": null,
+                "hashcat": 17900,
+                "extended": false,
+                "name": "Keccak-384"
+            },
+            {
+                "john": null,
+                "hashcat": null,
+                "extended": false,
+                "name": "Skein-512(384)"
+            },
+            {
+                "john": null,
+                "hashcat": null,
+                "extended": false,
+                "name": "Skein-1024(384)"
+            }
+        ]
+    },
+    {
+        "regex": "^{SSHA512}[a-z0-9\\/+]{96}$",
+        "modes": [
+            {
+                "john": "ssha512",
+                "hashcat": 1711,
+                "extended": false,
+                "name": "SSHA-512(Base64)"
+            },
+            {
+                "john": "ssha512",
+                "hashcat": 1711,
+                "extended": false,
+                "name": "LDAP(SSHA-512)"
+            }
+        ]
+    },
+    {
+        "regex": "^{ssha512}[0-9]{2}\\$[a-z0-9\\/.]{16,48}\\$[a-z0-9\\/.]{86}$",
+        "modes": [
+            {
+                "john": "aix-ssha512",
+                "hashcat": 6500,
+                "extended": false,
+                "name": "AIX(ssha512)"
+            }
+        ]
+    },
+    {
+        "regex": "^[a-f0-9]{128}(:.+)?$",
+        "modes": [
+            {
+                "john": "raw-sha512",
+                "hashcat": 1700,
+                "extended": false,
+                "name": "SHA-512"
+            },
+            {
+                "john": "whirlpool",
+                "hashcat": 6100,
+                "extended": false,
+                "name": "Whirlpool"
+            },
+            {
+                "john": null,
+                "hashcat": null,
+                "extended": false,
+                "name": "Salsa10"
+            },
+            {
+                "john": null,
+                "hashcat": null,
+                "extended": false,
+                "name": "Salsa20"
+            },
+            {
+                "john": "raw-sha3",
+                "hashcat": 17600,
+                "extended": false,
+                "name": "SHA3-512"
+            },
+            {
+                "john": "raw-keccak",
+                "hashcat": 18000,
+                "extended": false,
+                "name": "Keccak-512"
+            },
+            {
+                "john": "raw-blake2",
+                "hashcat": 600,
+                "extended": false,
+                "name": "Blake2"
+            },
+            {
+                "john": "skein-512",
+                "hashcat": null,
+                "extended": false,
+                "name": "Skein-512"
+            },
+            {
+                "john": null,
+                "hashcat": null,
+                "extended": false,
+                "name": "Skein-1024(512)"
+            },
+            {
+                "john": null,
+                "hashcat": 1710,
+                "extended": true,
+                "name": "sha512($pass.$salt)"
+            },
+            {
+                "john": null,
+                "hashcat": 1720,
+                "extended": true,
+                "name": "sha512($salt.$pass)"
+            },
+            {
+                "john": null,
+                "hashcat": 1730,
+                "extended": true,
+                "name": "sha512(unicode($pass).$salt)"
+            },
+            {
+                "john": null,
+                "hashcat": 1740,
+                "extended": true,
+                "name": "sha512($salt.unicode($pass))"
+            },
+            {
+                "john": "hmac-sha512",
+                "hashcat": 1750,
+                "extended": true,
+                "name": "HMAC-SHA512 (key = $pass)"
+            },
+            {
+                "john": "hmac-sha512",
+                "hashcat": 1760,
+                "extended": true,
+                "name": "HMAC-SHA512 (key = $salt)"
+            }
+        ]
+    },
+    {
+        "regex": "^[a-f0-9]{136}$",
+        "modes": [
+            {
+                "john": "xsha512",
+                "hashcat": 1722,
+                "extended": false,
+                "name": "OSX v10.7"
+            }
+        ]
+    },
+    {
+        "regex": "^0x0200[a-f0-9]{136}$",
+        "modes": [
+            {
+                "john": "msql12",
+                "hashcat": 1731,
+                "extended": false,
+                "name": "MSSQL(2012)"
+            },
+            {
+                "john": "msql12",
+                "hashcat": 1731,
+                "extended": false,
+                "name": "MSSQL(2014)"
+            }
+        ]
+    },
+    {
+        "regex": "^\\$ml\\$[0-9]+\\$[a-f0-9]{64}\\$[a-f0-9]{128}$",
+        "modes": [
+            {
+                "john": "pbkdf2-hmac-sha512",
+                "hashcat": 7100,
+                "extended": false,
+                "name": "OSX v10.8"
+            },
+            {
+                "john": "pbkdf2-hmac-sha512",
+                "hashcat": 7100,
+                "extended": false,
+                "name": "OSX v10.9"
+            }
+        ]
+    },
+    {
+        "regex": "^[a-f0-9]{256}$",
+        "modes": [
+            {
+                "john": null,
+                "hashcat": null,
+                "extended": false,
+                "name": "Skein-1024"
+            }
+        ]
+    },
+    {
+        "regex": "^grub\\.pbkdf2\\.sha512\\.[0-9]+\\.([a-f0-9]{128,2048}\\.|[0-9]+\\.)?[a-f0-9]{128}$",
+        "modes": [
+            {
+                "john": null,
+                "hashcat": 7200,
+                "extended": false,
+                "name": "GRUB 2"
+            }
+        ]
+    },
+    {
+        "regex": "^sha1\\$[a-z0-9]+\\$[a-f0-9]{40}$",
+        "modes": [
+            {
+                "john": null,
+                "hashcat": 124,
+                "extended": false,
+                "name": "Django(SHA-1)"
+            }
+        ]
+    },
+    {
+        "regex": "^[a-f0-9]{49}$",
+        "modes": [
+            {
+                "john": "citrix_ns10",
+                "hashcat": 8100,
+                "extended": false,
+                "name": "Citrix Netscaler"
+            }
+        ]
+    },
+    {
+        "regex": "^\\$S\\$[a-z0-9\\/.]{52}$",
+        "modes": [
+            {
+                "john": "drupal7",
+                "hashcat": 7900,
+                "extended": false,
+                "name": "Drupal > v7.x"
+            }
+        ]
+    },
+    {
+        "regex": "^\\$5\\$(rounds=[0-9]+\\$)?[a-z0-9\\/.]{0,16}\\$[a-z0-9\\/.]{43}$",
+        "modes": [
+            {
+                "john": "sha256crypt",
+                "hashcat": 7400,
+                "extended": false,
+                "name": "SHA-256 Crypt"
+            }
+        ]
+    },
+    {
+        "regex": "^0x[a-f0-9]{4}[a-f0-9]{16}[a-f0-9]{64}$",
+        "modes": [
+            {
+                "john": "sybasease",
+                "hashcat": 8000,
+                "extended": false,
+                "name": "Sybase ASE"
+            }
+        ]
+    },
+    {
+        "regex": "^\\$6\\$(rounds=[0-9]+\\$)?[a-z0-9\\/.]{0,16}\\$[a-z0-9\\/.]{86}$",
+        "modes": [
+            {
+                "john": "sha512crypt",
+                "hashcat": 1800,
+                "extended": false,
+                "name": "SHA-512 Crypt"
+            }
+        ]
+    },
+    {
+        "regex": "^\\$sha\\$[a-z0-9]{1,16}\\$([a-f0-9]{32}|[a-f0-9]{40}|[a-f0-9]{64}|[a-f0-9]{128}|[a-f0-9]{140})$",
+        "modes": [
+            {
+                "john": null,
+                "hashcat": null,
+                "extended": false,
+                "name": "Minecraft(AuthMe Reloaded)"
+            }
+        ]
+    },
+    {
+        "regex": "^sha256\\$[a-z0-9]+\\$[a-f0-9]{64}$",
+        "modes": [
+            {
+                "john": null,
+                "hashcat": null,
+                "extended": false,
+                "name": "Django(SHA-256)"
+            }
+        ]
+    },
+    {
+        "regex": "^sha384\\$[a-z0-9]+\\$[a-f0-9]{96}$",
+        "modes": [
+            {
+                "john": null,
+                "hashcat": null,
+                "extended": false,
+                "name": "Django(SHA-384)"
+            }
+        ]
+    },
+    {
+        "regex": "^crypt1:[a-z0-9+=]{12}:[a-z0-9+=]{12}$",
+        "modes": [
+            {
+                "john": null,
+                "hashcat": null,
+                "extended": false,
+                "name": "Clavister Secure Gateway"
+            }
+        ]
+    },
+    {
+        "regex": "^[a-f0-9]{112}$",
+        "modes": [
+            {
+                "john": null,
+                "hashcat": null,
+                "extended": false,
+                "name": "Cisco VPN Client(PCF-File)"
+            }
+        ]
+    },
+    {
+        "regex": "^[a-f0-9]{1329}$",
+        "modes": [
+            {
+                "john": null,
+                "hashcat": null,
+                "extended": false,
+                "name": "Microsoft MSTSC(RDP-File)"
+            }
+        ]
+    },
+    {
+        "regex": "^[^\\\\\\/:*?\"<>|]{1,20}[:]{2,3}([^\\\\\\/:*?\"<>|]{1,20})?:[a-f0-9]{48}:[a-f0-9]{48}:[a-f0-9]{16}$",
+        "modes": [
+            {
+                "john": "netntlm",
+                "hashcat": 5500,
+                "extended": false,
+                "name": "NetNTLMv1-VANILLA / NetNTLMv1+ESS"
+            }
+        ]
+    },
+    {
+        "regex": "^([^\\\\\\/:*?\"<>|]{1,20}\\\\)?[^\\\\\\/:*?\"<>|]{1,20}[:]{2,3}([^\\\\\\/:*?\"<>|]{1,20}:)?[^\\\\\\/:*?\"<>|]{1,20}:[a-f0-9]{32}:[a-f0-9]+$",
+        "modes": [
+            {
+                "john": "netntlmv2",
+                "hashcat": 5600,
+                "extended": false,
+                "name": "NetNTLMv2"
+            }
+        ]
+    },
+    {
+        "regex": "^\\$(krb5pa|mskrb5)\\$([0-9]{2})?\\$.+\\$[a-f0-9]{1,}$",
+        "modes": [
+            {
+                "john": "krb5pa-md5",
+                "hashcat": 7500,
+                "extended": false,
+                "name": "Kerberos 5 AS-REQ Pre-Auth"
+            }
+        ]
+    },
+    {
+        "regex": "^\\$scram\\$[0-9]+\\$[a-z0-9\\/.]{16}\\$sha-1=[a-z0-9\\/.]{27},sha-256=[a-z0-9\\/.]{43},sha-512=[a-z0-9\\/.]{86}$",
+        "modes": [
+            {
+                "john": null,
+                "hashcat": null,
+                "extended": false,
+                "name": "SCRAM Hash"
+            }
+        ]
+    },
+    {
+        "regex": "^[a-f0-9]{40}:[a-f0-9]{0,32}$",
+        "modes": [
+            {
+                "john": null,
+                "hashcat": 7600,
+                "extended": false,
+                "name": "Redmine Project Management Web App"
+            }
+        ]
+    },
+    {
+        "regex": "^(.+)?\\$[a-f0-9]{16}$",
+        "modes": [
+            {
+                "john": "sapb",
+                "hashcat": 7700,
+                "extended": false,
+                "name": "SAP CODVN B (BCODE)"
+            }
+        ]
+    },
+    {
+        "regex": "^(.+)?\\$[a-f0-9]{40}$",
+        "modes": [
+            {
+                "john": "sapg",
+                "hashcat": 7800,
+                "extended": false,
+                "name": "SAP CODVN F/G (PASSCODE)"
+            }
+        ]
+    },
+    {
+        "regex": "^(.+\\$)?[a-z0-9\\/.+]{30}(:.+)?$",
+        "modes": [
+            {
+                "john": "md5ns",
+                "hashcat": 22,
+                "extended": false,
+                "name": "Juniper Netscreen/SSG(ScreenOS)"
+            }
+        ]
+    },
+    {
+        "regex": "^0x[a-f0-9]{60}\\s0x[a-f0-9]{40}$",
+        "modes": [
+            {
+                "john": null,
+                "hashcat": 123,
+                "extended": false,
+                "name": "EPi"
+            }
+        ]
+    },
+    {
+        "regex": "^[a-f0-9]{40}:[^*]{1,25}$",
+        "modes": [
+            {
+                "john": null,
+                "hashcat": 121,
+                "extended": false,
+                "name": "SMF \u2265 v1.1"
+            }
+        ]
+    },
+    {
+        "regex": "^(\\$wbb3\\$\\*1\\*)?[a-f0-9]{40}[:*][a-f0-9]{40}$",
+        "modes": [
+            {
+                "john": "wbb3",
+                "hashcat": 8400,
+                "extended": false,
+                "name": "Woltlab Burning Board 3.x"
+            }
+        ]
+    },
+    {
+        "regex": "^[a-f0-9]{130}(:[a-f0-9]{40})?$",
+        "modes": [
+            {
+                "john": null,
+                "hashcat": 7300,
+                "extended": false,
+                "name": "IPMI2 RAKP HMAC-SHA1"
+            }
+        ]
+    },
+    {
+        "regex": "^[a-f0-9]{32}:[0-9]+:[a-z0-9_.+\\-]+@[a-z0-9\\-]+\\.[a-z0-9\\-.]+$",
+        "modes": [
+            {
+                "john": null,
+                "hashcat": 6800,
+                "extended": false,
+                "name": "Lastpass"
+            }
+        ]
+    },
+    {
+        "regex": "^[a-z0-9\\/.]{16}([:$].{1,})?$",
+        "modes": [
+            {
+                "john": "asa-md5",
+                "hashcat": 2410,
+                "extended": false,
+                "name": "Cisco-ASA(MD5)"
+            }
+        ]
+    },
+    {
+        "regex": "^\\$vnc\\$\\*[a-f0-9]{32}\\*[a-f0-9]{32}$",
+        "modes": [
+            {
+                "john": "vnc",
+                "hashcat": null,
+                "extended": false,
+                "name": "VNC"
+            }
+        ]
+    },
+    {
+        "regex": "^[a-z0-9]{32}(:([a-z0-9\\-]+\\.)?[a-z0-9\\-.]+\\.[a-z]{2,7}:.+:[0-9]+)?$",
+        "modes": [
+            {
+                "john": null,
+                "hashcat": 8300,
+                "extended": false,
+                "name": "DNSSEC(NSEC3)"
+            }
+        ]
+    },
+    {
+        "regex": "^(user-.+:)?\\$racf\\$\\*.+\\*[a-f0-9]{16}$",
+        "modes": [
+            {
+                "john": "racf",
+                "hashcat": 8500,
+                "extended": false,
+                "name": "RACF"
+            }
+        ]
+    },
+    {
+        "regex": "^\\$3\\$\\$[a-f0-9]{32}$",
+        "modes": [
+            {
+                "john": null,
+                "hashcat": null,
+                "extended": false,
+                "name": "NTHash(FreeBSD Variant)"
+            }
+        ]
+    },
+    {
+        "regex": "^\\$sha1\\$[0-9]+\\$[a-z0-9\\/.]{0,64}\\$[a-z0-9\\/.]{28}$",
+        "modes": [
+            {
+                "john": "sha1crypt",
+                "hashcat": null,
+                "extended": false,
+                "name": "SHA-1 Crypt"
+            }
+        ]
+    },
+    {
+        "regex": "^[a-f0-9]{70}$",
+        "modes": [
+            {
+                "john": "hmailserver",
+                "hashcat": 1421,
+                "extended": false,
+                "name": "hMailServer"
+            }
+        ]
+    },
+    {
+        "regex": "^[:\\$][AB][:\\$]([a-f0-9]{1,8}[:\\$])?[a-f0-9]{32}$",
+        "modes": [
+            {
+                "john": "mediawiki",
+                "hashcat": 3711,
+                "extended": false,
+                "name": "MediaWiki"
+            }
+        ]
+    },
+    {
+        "regex": "^[a-f0-9]{140}$",
+        "modes": [
+            {
+                "john": null,
+                "hashcat": null,
+                "extended": false,
+                "name": "Minecraft(xAuth)"
+            }
+        ]
+    },
+    {
+        "regex": "^\\$pbkdf2(-sha1)?\\$[0-9]+\\$[a-z0-9\\/.]+\\$[a-z0-9\\/.]{27}$",
+        "modes": [
+            {
+                "john": null,
+                "hashcat": null,
+                "extended": false,
+                "name": "PBKDF2-SHA1(Generic)"
+            }
+        ]
+    },
+    {
+        "regex": "^\\$pbkdf2-sha256\\$[0-9]+\\$[a-z0-9\\/.]+\\$[a-z0-9\\/.]{43}$",
+        "modes": [
+            {
+                "john": "pbkdf2-hmac-sha256",
+                "hashcat": null,
+                "extended": false,
+                "name": "PBKDF2-SHA256(Generic)"
+            }
+        ]
+    },
+    {
+        "regex": "^\\$pbkdf2-sha512\\$[0-9]+\\$[a-z0-9\\/.]+\\$[a-z0-9\\/.]{86}$",
+        "modes": [
+            {
+                "john": null,
+                "hashcat": null,
+                "extended": false,
+                "name": "PBKDF2-SHA512(Generic)"
+            }
+        ]
+    },
+    {
+        "regex": "^\\$p5k2\\$[0-9]+\\$[a-z0-9\\/+=\\-]+\\$[a-z0-9\\/+\\-]{27}=$",
+        "modes": [
+            {
+                "john": null,
+                "hashcat": null,
+                "extended": false,
+                "name": "PBKDF2(Cryptacular)"
+            }
+        ]
+    },
+    {
+        "regex": "^\\$p5k2\\$[0-9]+\\$[a-z0-9\\/.]+\\$[a-z0-9\\/.]{32}$",
+        "modes": [
+            {
+                "john": null,
+                "hashcat": null,
+                "extended": false,
+                "name": "PBKDF2(Dwayne Litzenberger)"
+            }
+        ]
+    },
+    {
+        "regex": "^{FSHP[0123]\\|[0-9]+\\|[0-9]+}[a-z0-9\\/+=]+$",
+        "modes": [
+            {
+                "john": null,
+                "hashcat": null,
+                "extended": false,
+                "name": "Fairly Secure Hashed Password"
+            }
+        ]
+    },
+    {
+        "regex": "^\\$PHPS\\$.+\\$[a-f0-9]{32}$",
+        "modes": [
+            {
+                "john": "phps",
+                "hashcat": 2612,
+                "extended": false,
+                "name": "PHPS"
+            }
+        ]
+    },
+    {
+        "regex": "^[0-9]{4}:[a-f0-9]{16}:[a-f0-9]{2080}$",
+        "modes": [
+            {
+                "john": null,
+                "hashcat": 6600,
+                "extended": false,
+                "name": "1Password(Agile Keychain)"
+            }
+        ]
+    },
+    {
+        "regex": "^[a-f0-9]{64}:[a-f0-9]{32}:[0-9]{5}:[a-f0-9]{608}$",
+        "modes": [
+            {
+                "john": null,
+                "hashcat": 8200,
+                "extended": false,
+                "name": "1Password(Cloud Keychain)"
+            }
+        ]
+    },
+    {
+        "regex": "^[a-f0-9]{256}:[a-f0-9]{256}:[a-f0-9]{16}:[a-f0-9]{16}:[a-f0-9]{320}:[a-f0-9]{16}:[a-f0-9]{40}:[a-f0-9]{40}:[a-f0-9]{32}$",
+        "modes": [
+            {
+                "john": null,
+                "hashcat": 5300,
+                "extended": false,
+                "name": "IKE-PSK MD5"
+            }
+        ]
+    },
+    {
+        "regex": "^[a-f0-9]{256}:[a-f0-9]{256}:[a-f0-9]{16}:[a-f0-9]{16}:[a-f0-9]{320}:[a-f0-9]{16}:[a-f0-9]{40}:[a-f0-9]{40}:[a-f0-9]{40}$",
+        "modes": [
+            {
+                "john": null,
+                "hashcat": 5400,
+                "extended": false,
+                "name": "IKE-PSK SHA1"
+            }
+        ]
+    },
+    {
+        "regex": "^[a-z0-9\\/+]{27}=$",
+        "modes": [
+            {
+                "john": null,
+                "hashcat": 133,
+                "extended": false,
+                "name": "PeopleSoft"
+            }
+        ]
+    },
+    {
+        "regex": "^crypt\\$[a-f0-9]{5}\\$[a-z0-9\\/.]{13}$",
+        "modes": [
+            {
+                "john": null,
+                "hashcat": null,
+                "extended": false,
+                "name": "Django(DES Crypt Wrapper)"
+            }
+        ]
+    },
+    {
+        "regex": "^(\\$django\\$\\*1\\*)?pbkdf2_sha256\\$[0-9]+\\$[a-z0-9]+\\$[a-z0-9\\/+=]{44}$",
+        "modes": [
+            {
+                "john": "django",
+                "hashcat": 10000,
+                "extended": false,
+                "name": "Django(PBKDF2-HMAC-SHA256)"
+            }
+        ]
+    },
+    {
+        "regex": "^pbkdf2_sha1\\$[0-9]+\\$[a-z0-9]+\\$[a-z0-9\\/+=]{28}$",
+        "modes": [
+            {
+                "john": null,
+                "hashcat": null,
+                "extended": false,
+                "name": "Django(PBKDF2-HMAC-SHA1)"
+            }
+        ]
+    },
+    {
+        "regex": "^bcrypt(\\$2[axy]|\\$2)\\$[0-9]{2}\\$[a-z0-9\\/.]{53}$",
+        "modes": [
+            {
+                "john": null,
+                "hashcat": null,
+                "extended": false,
+                "name": "Django(bcrypt)"
+            }
+        ]
+    },
+    {
+        "regex": "^md5\\$[a-f0-9]+\\$[a-f0-9]{32}$",
+        "modes": [
+            {
+                "john": null,
+                "hashcat": null,
+                "extended": false,
+                "name": "Django(MD5)"
+            }
+        ]
+    },
+    {
+        "regex": "^\\{PKCS5S2\\}[a-z0-9\\/+]{64}$",
+        "modes": [
+            {
+                "john": null,
+                "hashcat": null,
+                "extended": false,
+                "name": "PBKDF2(Atlassian)"
+            }
+        ]
+    },
+    {
+        "regex": "^md5[a-f0-9]{32}$",
+        "modes": [
+            {
+                "john": null,
+                "hashcat": null,
+                "extended": false,
+                "name": "PostgreSQL MD5"
+            }
+        ]
+    },
+    {
+        "regex": "^\\([a-z0-9\\/+]{49}\\)$",
+        "modes": [
+            {
+                "john": null,
+                "hashcat": 9100,
+                "extended": false,
+                "name": "Lotus Notes/Domino 8"
+            }
+        ]
+    },
+    {
+        "regex": "^SCRYPT:[0-9]{1,}:[0-9]{1}:[0-9]{1}:[a-z0-9:\\/+=]{1,}$",
+        "modes": [
+            {
+                "john": null,
+                "hashcat": 8900,
+                "extended": false,
+                "name": "scrypt"
+            }
+        ]
+    },
+    {
+        "regex": "^\\$8\\$[a-z0-9\\/.]{14}\\$[a-z0-9\\/.]{43}$",
+        "modes": [
+            {
+                "john": "cisco8",
+                "hashcat": 9200,
+                "extended": false,
+                "name": "Cisco Type 8"
+            }
+        ]
+    },
+    {
+        "regex": "^\\$9\\$[a-z0-9\\/.]{14}\\$[a-z0-9\\/.]{43}$",
+        "modes": [
+            {
+                "john": "cisco9",
+                "hashcat": 9300,
+                "extended": false,
+                "name": "Cisco Type 9"
+            }
+        ]
+    },
+    {
+        "regex": "^\\$office\\$\\*2007\\*[0-9]{2}\\*[0-9]{3}\\*[0-9]{2}\\*[a-z0-9]{32}\\*[a-z0-9]{32}\\*[a-z0-9]{40}$",
+        "modes": [
+            {
+                "john": "office",
+                "hashcat": 9400,
+                "extended": false,
+                "name": "Microsoft Office 2007"
+            }
+        ]
+    },
+    {
+        "regex": "^\\$office\\$\\*2010\\*[0-9]{6}\\*[0-9]{3}\\*[0-9]{2}\\*[a-z0-9]{32}\\*[a-z0-9]{32}\\*[a-z0-9]{64}$",
+        "modes": [
+            {
+                "john": null,
+                "hashcat": 9500,
+                "extended": false,
+                "name": "Microsoft Office 2010"
+            }
+        ]
+    },
+    {
+        "regex": "^\\$office\\$\\*2013\\*[0-9]{6}\\*[0-9]{3}\\*[0-9]{2}\\*[a-z0-9]{32}\\*[a-z0-9]{32}\\*[a-z0-9]{64}$",
+        "modes": [
+            {
+                "john": null,
+                "hashcat": 9600,
+                "extended": false,
+                "name": "Microsoft Office 2013"
+            }
+        ]
+    },
+    {
+        "regex": "^\\$fde\\$[0-9]{2}\\$[a-f0-9]{32}\\$[0-9]{2}\\$[a-f0-9]{32}\\$[a-f0-9]{3072}$",
+        "modes": [
+            {
+                "john": "fde",
+                "hashcat": 8800,
+                "extended": false,
+                "name": "Android FDE \u2264 4.3"
+            }
+        ]
+    },
+    {
+        "regex": "^\\$oldoffice\\$[01]\\*[a-f0-9]{32}\\*[a-f0-9]{32}\\*[a-f0-9]{32}$",
+        "modes": [
+            {
+                "john": "oldoffice",
+                "hashcat": 9700,
+                "extended": false,
+                "name": "Microsoft Office \u2264 2003 (MD5+RC4)"
+            },
+            {
+                "john": "oldoffice",
+                "hashcat": 9710,
+                "extended": false,
+                "name": "Microsoft Office \u2264 2003 (MD5+RC4) collider-mode #1"
+            },
+            {
+                "john": "oldoffice",
+                "hashcat": 9720,
+                "extended": false,
+                "name": "Microsoft Office \u2264 2003 (MD5+RC4) collider-mode #2"
+            }
+        ]
+    },
+    {
+        "regex": "^\\$oldoffice\\$[34]\\*[a-f0-9]{32}\\*[a-f0-9]{32}\\*[a-f0-9]{40}$",
+        "modes": [
+            {
+                "john": null,
+                "hashcat": 9800,
+                "extended": false,
+                "name": "Microsoft Office \u2264 2003 (SHA1+RC4)"
+            },
+            {
+                "john": null,
+                "hashcat": 9810,
+                "extended": false,
+                "name": "Microsoft Office \u2264 2003 (SHA1+RC4) collider-mode #1"
+            },
+            {
+                "john": null,
+                "hashcat": 9820,
+                "extended": false,
+                "name": "Microsoft Office \u2264 2003 (SHA1+RC4) collider-mode #2"
+            }
+        ]
+    },
+    {
+        "regex": "^(\\$radmin2\\$)?[a-f0-9]{32}$",
+        "modes": [
+            {
+                "john": "radmin",
+                "hashcat": 9900,
+                "extended": false,
+                "name": "RAdmin v2.x"
+            }
+        ]
+    },
+    {
+        "regex": "^{x-issha,\\s[0-9]{4}}[a-z0-9\\/+=]+$",
+        "modes": [
+            {
+                "john": "saph",
+                "hashcat": 10300,
+                "extended": false,
+                "name": "SAP CODVN H (PWDSALTEDHASH) iSSHA-1"
+            }
+        ]
+    },
+    {
+        "regex": "^\\$cram_md5\\$[a-z0-9\\/+=\\-]+\\$[a-z0-9\\/+=\\-]{52}$",
+        "modes": [
+            {
+                "john": null,
+                "hashcat": 10200,
+                "extended": false,
+                "name": "CRAM-MD5"
+            }
+        ]
+    },
+    {
+        "regex": "^[a-f0-9]{16}:2:4:[a-f0-9]{32}$",
+        "modes": [
+            {
+                "john": null,
+                "hashcat": 10100,
+                "extended": false,
+                "name": "SipHash"
+            }
+        ]
+    },
+    {
+        "regex": "^[a-f0-9]{4,}$",
+        "modes": [
+            {
+                "john": null,
+                "hashcat": null,
+                "extended": true,
+                "name": "Cisco Type 7"
+            }
+        ]
+    },
+    {
+        "regex": "^[a-z0-9\\/.]{13,}$",
+        "modes": [
+            {
+                "john": "bigcrypt",
+                "hashcat": null,
+                "extended": true,
+                "name": "BigCrypt"
+            }
+        ]
+    },
+    {
+        "regex": "^(\\$cisco4\\$)?[a-z0-9\\/.]{43}$",
+        "modes": [
+            {
+                "john": "cisco4",
+                "hashcat": null,
+                "extended": false,
+                "name": "Cisco Type 4"
+            }
+        ]
+    },
+    {
+        "regex": "^bcrypt_sha256\\$\\$(2[axy]|2)\\$[0-9]+\\$[a-z0-9\\/.]{53}$",
+        "modes": [
+            {
+                "john": null,
+                "hashcat": null,
+                "extended": false,
+                "name": "Django(bcrypt-SHA256)"
+            }
+        ]
+    },
+    {
+        "regex": "^\\$postgres\\$.[^\\*]+[*:][a-f0-9]{1,32}[*:][a-f0-9]{32}$",
+        "modes": [
+            {
+                "john": "postgres",
+                "hashcat": 11100,
+                "extended": false,
+                "name": "PostgreSQL Challenge-Response Authentication (MD5)"
+            }
+        ]
+    },
+    {
+        "regex": "^\\$siemens-s7\\$[0-9]{1}\\$[a-f0-9]{40}\\$[a-f0-9]{40}$",
+        "modes": [
+            {
+                "john": "siemens-s7",
+                "hashcat": null,
+                "extended": false,
+                "name": "Siemens-S7"
+            }
+        ]
+    },
+    {
+        "regex": "^(\\$pst\\$)?[a-f0-9]{8}$",
+        "modes": [
+            {
+                "john": null,
+                "hashcat": null,
+                "extended": false,
+                "name": "Microsoft Outlook PST"
+            }
+        ]
+    },
+    {
+        "regex": "^sha256[:$][0-9]+[:$][a-z0-9\\/+]+[:$][a-z0-9\\/+]{32,128}$",
+        "modes": [
+            {
+                "john": null,
+                "hashcat": 10900,
+                "extended": false,
+                "name": "PBKDF2-HMAC-SHA256(PHP)"
+            }
+        ]
+    },
+    {
+        "regex": "^(\\$dahua\\$)?[a-z0-9]{8}$",
+        "modes": [
+            {
+                "john": "dahua",
+                "hashcat": null,
+                "extended": false,
+                "name": "Dahua"
+            }
+        ]
+    },
+    {
+        "regex": "^\\$mysqlna\\$[a-f0-9]{40}[:*][a-f0-9]{40}$",
+        "modes": [
+            {
+                "john": null,
+                "hashcat": 11200,
+                "extended": false,
+                "name": "MySQL Challenge-Response Authentication (SHA1)"
+            }
+        ]
+    },
+    {
+        "regex": "^\\$pdf\\$[24]\\*[34]\\*128\\*[0-9\\-]{1,5}\\*1\\*(16|32)\\*[a-f0-9]{32,64}\\*32\\*[a-f0-9]{64}\\*(8|16|32)\\*[a-f0-9]{16,64}$",
+        "modes": [
+            {
+                "john": "pdf",
+                "hashcat": 10500,
+                "extended": false,
+                "name": "PDF 1.4 - 1.6 (Acrobat 5 - 8)"
+            }
+        ]
+    }
+]