Tracking Hashmob progress on cracking downloadable SHA1 hashes from Pwned Passwords.
Each new target hashlist is a delta - the "net new" from the previous downloads. My list here is in reverse chronological order.
| ID | Hashlist Name | Hash Type | Found | Total | Recovered % |
|---|---|---|---|---|---|
| #H11651 | Have I been Pwned v2025-03 (Delta V8.12) | SHA1 (100) | 411,723,586 | 420,878,532 | 97.82% |
| #H9259 | Have I been Pwned V8.12 (Delta V8.4) | SHA1 (100) | 630,532 | 778,688 | 80.97% |
| #H7464 | Have I been Pwned V8.4 (Delta V8) | SHA1 (100) | 16,019,292 |
| #----------------------------------------------------------------------------- | |
| # All HIBP SHA1 hashes beginning with b2e98, as of 2025-02-25, by frequency in leaks. | |
| # | |
| # The HIBP API receives a hex prefix, and returns all hashes with that prefix | |
| # (with the prefix omitted), including frequency count, across all leaks in HIBP. | |
| # The first hash is often much more likely to be the password behind the query, | |
| # demonstrating the limits of k-anonymity as a mitigation when frequency is included. | |
| # Of the 618,979 passwords represented, 96.8% of them (599,297) are the top one. | |
| # | |
| # Permalink: https://gist.github.com/roycewilliams/2034c9253d46fbcaefb13f8e5d42daa2 |
| # Download from ftp.logitech.com/pub/quickcam | |
| # Contains file listing, plus various checksums | |
| # As of: 2024-12-13 | |
| 45056 Jan 23 2015 60patch.exe | |
| 4620192 Jan 23 2015 LogiCamSettings.exe | |
| 4666496 Jan 23 2015 LogiUCDpp.exe | |
| 1191792 Jan 23 2015 LogitechWebcamProperties.dmg | |
| 721408 Jan 23 2015 albumpatch.exe | |
| 72416 Jan 23 2015 avifix.exe |
| # Because this appeared to exist nowhere else in the Googles. | |
| = F2A0D5919C61DB3D (space) | |
| ! = 695109AB020E401C | |
| " = A02BAAA4A6AE5FEA | |
| # = C2A20CAE7226E17D | |
| $ = DB2294261F598B4C | |
| % = 1068F8D7B3E22BFF | |
| & = A86FB73C70515BD7 | |
| ' = 6D12862D8225EBC6 |
Original report
Affected Vendor OpenPrinting Affected Product Several components of the CUPS printing system: cups-browsed, libppd, libcupsfilters and cups-filters. Affected Version All versions <= 2.0.1 (latest release) and master. Significant ICS/OT impact?no Reporter Simone Margaritelli [evilsocket@gmail.com] Vendor contacted?yes The vendor has been notified trough Github Advisories and all bugs have been confirmed:
(reproduced from an email I received 2025-09-06 1:03AM AKT)
(Nitrokey Logo)
Recently, a significant security vulnerability in Infineon security chips was made public. Nitrokeys do not contain Infineon chips and are therefore not affected by this security vulnerability! Nevertheless, this incident holds interesting lessons for Nitrokey and our customers. In a nutshell: Security certifications are overrated and open source offers advantages over them. Nitrokeys offer a high level of investment security thanks to firmware updates. More on this below.
| # hashcat rule to only insert non-contiguous dots/periods | |
| # Created 2024-04-13 by TychoTithonus (Royce Williams) | |
| # Source: | |
| : | |
| i1. | |
| i2. | |
| i2.i1. | |
| i3. | |
| i3.i1. | |
| i3.i2. |
| #!/usr/bin/python | |
| # -*- coding: utf-8 -*- | |
| # | |
| # Copyright 2017, Francesco "dfirfpi" Picasso <francesco.picasso@gmail.com> | |
| # | |
| # Licensed under the Apache License, Version 2.0 (the "License"); | |
| # you may not use this file except in compliance with the License. | |
| # You may obtain a copy of the License at | |
| # | |
| # http://www.apache.org/licenses/LICENSE-2.0 |
(mirror snapshot of: https://infosec.exchange/@tychotithonus/111924626712765292)
summary: new DNSSEC validation DoS vulnerabilities CVE-2023-50387 ("KeyTrap"), CVE-2023-50868 (NSEC3 vuln)
(living doc, updated regularly - if you prefer a low-edit post to boost, use https://infosec.exchange/@tychotithonus/111926621712441626)
Looks like DNS-OARC coordinated fixes in advance, but I don't see a centralized analysis, other than this announcement from the team who discovered KeyTrap: https://www.athene-center.de/en/news/press/key-trap ... and their technical paper: https://www.athene-center.de/fileadmin/content/PDF/Technical_Report_KeyTrap.pdf
| # 10,000 iterations of SHA256 hash of an "empty" password (zero-length string). | |
| # Generated with: echo "" | mdxfind -h '^SHA256$' -i 10000 -z -f /dev/null stdin | |
| # MDXfind version: $Header: /home/dlr/src/mdfind/RCS/mdxfind.c,v 1.120 2024/01/22 20:41:23 dlr Exp dlr $ | |
| # Source: https://gist.github.com/roycewilliams/35a015f3914541ce829e2718dd4af871 | |
| SHA256x01 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855: | |
| SHA256x02 cd372fb85148700fa88095e3492d3f9f5beb43e555e5ff26d95f5a6adc36f8e6: | |
| SHA256x03 e67e72111b363d80c8124d28193926000980e1211c7986cacbd26aacc5528d48: | |
| SHA256x04 f7d062d662826ed95869851db06bb539b402047baee53a00e0aa35bfbe98265d: | |
| SHA256x05 2a132dbfe4784627b86aa3807cd19cfeff487aab3dd7a60d0ab119a72e736936: | |
| SHA256x06 bdca9e8dbca354e824e67bfe1533fa4a238b9ea832f23fb4271ebeb3a5a8f720: |