How can I match my passwords against Have I Been Pwned?












1















OK, so I've downloaded all the SHA-1 hashes from Have I Been Pwned, exported everything from my password manager, and processed that into a file with one password per line. How do I match these files effectively?






linux







share|improve this question















migrated from stackoverflow.com 1 hour ago


This question came from our site for professional and enthusiast programmers.




















    1















    OK, so I've downloaded all the SHA-1 hashes from Have I Been Pwned, exported everything from my password manager, and processed that into a file with one password per line. How do I match these files effectively?






    linux







    share|improve this question















    migrated from stackoverflow.com 1 hour ago


    This question came from our site for professional and enthusiast programmers.


















      1












      1








      1








      OK, so I've downloaded all the SHA-1 hashes from Have I Been Pwned, exported everything from my password manager, and processed that into a file with one password per line. How do I match these files effectively?






      linux







      share|improve this question
















      OK, so I've downloaded all the SHA-1 hashes from Have I Been Pwned, exported everything from my password manager, and processed that into a file with one password per line. How do I match these files effectively?






      linux




      linux






      share|improve this question















      share|improve this question













      share|improve this question




      share|improve this question








      edited 22 mins ago









      Michael Homer

      46.7k8123161




      46.7k8123161










      asked 21 hours ago









      l0b0l0b0

      27.9k17118246




      27.9k17118246




      migrated from stackoverflow.com 1 hour ago


      This question came from our site for professional and enthusiast programmers.






      migrated from stackoverflow.com 1 hour ago


      This question came from our site for professional and enthusiast programmers.
























          1 Answer
          1






          active

          oldest

          votes


















          3














          Prerequisites





          • 7z, which should be in the "p7zip" package.


          • sha1sum and shred, which should be in the "coreutils" package.


          • grep from the "grep" package.


          Process





          1. Create a file with unique upper case password hashes, and a file with passwords and their corresponding hashes:



            sort -u passwords.txt | while read -r password
            
do
            
    hash="$(printf '%s' "$password" | 
            
        sha1sum | 
            
        cut -d' ' -f1 | 
            
        tr 'a-f' 'A-F')"
            
    printf '%sn' "$hash" >> hashes.txt
            
    printf '%st%sn' "$hash" "$password" >> passwords-with-hashes.txt
            
done



          2. Match your hashes to all the entries in the downloaded file:



            7z e -so pwned-passwords-sha1-ordered-by-hash-v*.7z | 
            
cut -c 1-40 | 
            
grep -Fxf hashes.txt | 
            
tee matches.txt


            Be patient - this took nearly 20 minutes on a desktop machine with an SSD!




          3. Show the passwords related to the matches:



            grep -Ff matches.txt passwords-with-hashes.txt | cut -f2



          4. Securely remove the files you've created:



            shred --remove hashes.txt matches.txt passwords.txt passwords-with-hashes.txt







          share|improve this answer























            Your Answer








            StackExchange.ready(function() {
            var channelOptions = {
            tags: "".split(" "),
            id: "106"
            };
            initTagRenderer("".split(" "), "".split(" "), channelOptions);

            StackExchange.using("externalEditor", function() {
            // Have to fire editor after snippets, if snippets enabled
            if (StackExchange.settings.snippets.snippetsEnabled) {
            StackExchange.using("snippets", function() {
            createEditor();
            });
            }
            else {
            createEditor();
            }
            });

            function createEditor() {
            StackExchange.prepareEditor({
            heartbeatType: 'answer',
            autoActivateHeartbeat: false,
            convertImagesToLinks: false,
            noModals: true,
            showLowRepImageUploadWarning: true,
            reputationToPostImages: null,
            bindNavPrevention: true,
            postfix: "",
            imageUploader: {
            brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
            contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
            allowUrls: true
            },
            onDemand: true,
            discardSelector: ".discard-answer"
            ,immediatelyShowMarkdownHelp:true
            });


            }
            });














            draft saved

            draft discarded


















            StackExchange.ready(
            function () {
            StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2funix.stackexchange.com%2fquestions%2f495398%2fhow-can-i-match-my-passwords-against-have-i-been-pwned%23new-answer', 'question_page');
            }
            );

            Post as a guest















            Required, but never shown

























            1 Answer
            1






            active

            oldest

            votes








            1 Answer
            1






            active

            oldest

            votes









            active

            oldest

            votes






            active

            oldest

            votes









            3














            Prerequisites





            • 7z, which should be in the "p7zip" package.


            • sha1sum and shred, which should be in the "coreutils" package.


            • grep from the "grep" package.


            Process





            1. Create a file with unique upper case password hashes, and a file with passwords and their corresponding hashes:



              sort -u passwords.txt | while read -r password
              
do
              
    hash="$(printf '%s' "$password" | 
              
        sha1sum | 
              
        cut -d' ' -f1 | 
              
        tr 'a-f' 'A-F')"
              
    printf '%sn' "$hash" >> hashes.txt
              
    printf '%st%sn' "$hash" "$password" >> passwords-with-hashes.txt
              
done



            2. Match your hashes to all the entries in the downloaded file:



              7z e -so pwned-passwords-sha1-ordered-by-hash-v*.7z | 
              
cut -c 1-40 | 
              
grep -Fxf hashes.txt | 
              
tee matches.txt


              Be patient - this took nearly 20 minutes on a desktop machine with an SSD!




            3. Show the passwords related to the matches:



              grep -Ff matches.txt passwords-with-hashes.txt | cut -f2



            4. Securely remove the files you've created:



              shred --remove hashes.txt matches.txt passwords.txt passwords-with-hashes.txt







            share|improve this answer




























              3














              Prerequisites





              • 7z, which should be in the "p7zip" package.


              • sha1sum and shred, which should be in the "coreutils" package.


              • grep from the "grep" package.


              Process





              1. Create a file with unique upper case password hashes, and a file with passwords and their corresponding hashes:



                sort -u passwords.txt | while read -r password
                
do
                
    hash="$(printf '%s' "$password" | 
                
        sha1sum | 
                
        cut -d' ' -f1 | 
                
        tr 'a-f' 'A-F')"
                
    printf '%sn' "$hash" >> hashes.txt
                
    printf '%st%sn' "$hash" "$password" >> passwords-with-hashes.txt
                
done



              2. Match your hashes to all the entries in the downloaded file:



                7z e -so pwned-passwords-sha1-ordered-by-hash-v*.7z | 
                
cut -c 1-40 | 
                
grep -Fxf hashes.txt | 
                
tee matches.txt


                Be patient - this took nearly 20 minutes on a desktop machine with an SSD!




              3. Show the passwords related to the matches:



                grep -Ff matches.txt passwords-with-hashes.txt | cut -f2



              4. Securely remove the files you've created:



                shred --remove hashes.txt matches.txt passwords.txt passwords-with-hashes.txt







              share|improve this answer


























                3












                3








                3







                Prerequisites





                • 7z, which should be in the "p7zip" package.


                • sha1sum and shred, which should be in the "coreutils" package.


                • grep from the "grep" package.


                Process





                1. Create a file with unique upper case password hashes, and a file with passwords and their corresponding hashes:



                  sort -u passwords.txt | while read -r password
                  
do
                  
    hash="$(printf '%s' "$password" | 
                  
        sha1sum | 
                  
        cut -d' ' -f1 | 
                  
        tr 'a-f' 'A-F')"
                  
    printf '%sn' "$hash" >> hashes.txt
                  
    printf '%st%sn' "$hash" "$password" >> passwords-with-hashes.txt
                  
done



                2. Match your hashes to all the entries in the downloaded file:



                  7z e -so pwned-passwords-sha1-ordered-by-hash-v*.7z | 
                  
cut -c 1-40 | 
                  
grep -Fxf hashes.txt | 
                  
tee matches.txt


                  Be patient - this took nearly 20 minutes on a desktop machine with an SSD!




                3. Show the passwords related to the matches:



                  grep -Ff matches.txt passwords-with-hashes.txt | cut -f2



                4. Securely remove the files you've created:



                  shred --remove hashes.txt matches.txt passwords.txt passwords-with-hashes.txt







                share|improve this answer













                Prerequisites





                • 7z, which should be in the "p7zip" package.


                • sha1sum and shred, which should be in the "coreutils" package.


                • grep from the "grep" package.


                Process





                1. Create a file with unique upper case password hashes, and a file with passwords and their corresponding hashes:



                  sort -u passwords.txt | while read -r password
                  
do
                  
    hash="$(printf '%s' "$password" | 
                  
        sha1sum | 
                  
        cut -d' ' -f1 | 
                  
        tr 'a-f' 'A-F')"
                  
    printf '%sn' "$hash" >> hashes.txt
                  
    printf '%st%sn' "$hash" "$password" >> passwords-with-hashes.txt
                  
done



                2. Match your hashes to all the entries in the downloaded file:



                  7z e -so pwned-passwords-sha1-ordered-by-hash-v*.7z | 
                  
cut -c 1-40 | 
                  
grep -Fxf hashes.txt | 
                  
tee matches.txt


                  Be patient - this took nearly 20 minutes on a desktop machine with an SSD!




                3. Show the passwords related to the matches:



                  grep -Ff matches.txt passwords-with-hashes.txt | cut -f2



                4. Securely remove the files you've created:



                  shred --remove hashes.txt matches.txt passwords.txt passwords-with-hashes.txt








                share|improve this answer












                share|improve this answer



                share|improve this answer










                answered 21 hours ago









                l0b0l0b0

                27.9k17118246




                27.9k17118246






























                    draft saved

                    draft discarded




















































                    Thanks for contributing an answer to Unix & Linux Stack Exchange!


                    • Please be sure to answer the question. Provide details and share your research!

                    But avoid …



                    • Asking for help, clarification, or responding to other answers.

                    • Making statements based on opinion; back them up with references or personal experience.


                    To learn more, see our tips on writing great answers.




                    draft saved


                    draft discarded














                    StackExchange.ready(
                    function () {
                    StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2funix.stackexchange.com%2fquestions%2f495398%2fhow-can-i-match-my-passwords-against-have-i-been-pwned%23new-answer', 'question_page');
                    }
                    );

                    Post as a guest















                    Required, but never shown





















































                    Required, but never shown














                    Required, but never shown












                    Required, but never shown







                    Required, but never shown

































                    Required, but never shown














                    Required, but never shown












                    Required, but never shown







                    Required, but never shown







                    -

                    Popular posts from this blog

                    サソリ

                    Image
                    この記事は検証可能な参考文献や出典が全く示されていないか、不十分です。 出典を追加して記事の信頼性向上にご協力ください。 （ 2019年1月 ） 「 サソリ 」のその他の用法については「サソリ (曖昧さ回避)」をご覧ください。 「 スコーピオン 」と「 スコルピオン 」はこの項目へ転送されています。その他の用法については「スコーピオン」をご覧ください。 サソリ目 生息年代: 430–0 Ma PreЄ Є O S D C P T J K Pg N シルル紀前期-現世 ダイオウサソリ（ Pandinus Imperator ） 分類 界 : 動物界 Animalia 門 : 節足動物門 Arthropoda 亜門 : 鋏角亜門 Chelicerata 綱 : クモガタ綱 Arachnida 目 : サソリ目 Scorpiones 学名 Scorpiones C. L. Koch, 1837 英名 Scorpion 上科 Pseudochactoidea キョクトウサソリ上科 Buthoidea Chaeriloidea Chactoidea Iuroidea Scorpionoidea サソリ （ サソリ類 、 蠍 、 蝎 、 scorpion ）は、鋏角亜門・クモガタ綱の サソリ目 （ Scorpiones ）に属する節足動物の総称である。体の前端に鋏型の触肢、後端に毒針を有する捕食者である。 1700種以上を含め、最古の化石記録は4億3千万年前のシルル紀まで遡る。有毒生物として広く知られるが、人間の命にかかわる毒を持つものはごく一部の種類に過ぎない。 目次 1 形態 1.1 前体 1.2 後体 1.2.1 中体 1.2.2 終体 2 雌雄 3 生態 3.1 天敵 3.2 生殖 4 分布 5 毒 6 蛍光現象 7 分類
                    Read more

                    広島県道265号伴広島線

                    Image
                    一般県道 広島県道265号伴広島線 路線延長 km 起点 広島県広島市安佐南区伴東7丁目 終点 広島県広島市中区榎町 接続する 主な道路 （記法） 広島県道38号広島豊平線 広島県道71号広島湯来線 山陽自動車道五日市IC 国道183号（ 国道261号重複） ■テンプレート（■ノート ■使い方） ■PJ道路 広島県道265号伴広島線 （ひろしまけんどう265ごう ともひろしません）は広島県広島市安佐南区から広島県広島市中区を結ぶ一般県道である。 目次 1 路線データ 2 通過する自治体 3 見どころ 4 接続道路 4.1 本線 4.2 旧道 5 別名 6 関連項目 路線データ 本線 起点：広島市安佐南区伴東7丁目・大原下橋南詰交差点（広島県道38号広島豊平線（本線・旧道）交点） 終点：広島市中区榎町・十日市交差点（国道183号（国道261号重用）交点） 総延長： 旧道 起点：広島市安佐南区伴東4丁目・新細坂交差点（広島県道38号広島豊平線交点） 終点：広島市安佐南区伴中央4丁目・寺組橋(南)交差点（広島県道265号伴広島線（本線）交点） 総延長： 通過する自治体 広島県 広島市（安佐南区、佐伯区、西区、中区） 見どころ 広島高速交通広島新交通1号線（アストラムライン） 広島広域公園 広島広域公園陸上競技場（広島ビッグアーチ） 己斐峠 己斐橋（太田川放水路） 天満橋（天満川） 接続道路 本線 広島県道38号広島豊平線（本線・旧道）（広島市安佐南区伴東7丁目・大原下橋南詰交差点〔起点〕） 広島県道71号広島湯来線（本線）（広島市安佐南区伴中央2丁目・伴交番入口交差点 - 広島市安佐南区伴中央4丁目・寺組橋(南)交差点間で重用） 広島県道71号広島湯来線（旧道）（広島県道265号伴広島線（旧道）重用）（広島市安佐南区伴中央4丁目・寺組橋(南)交差点） 広島県道71号広島湯来線（広島市安佐南区伴中央4丁目・寺組橋(南)交差点 - 広島市佐伯区五日市町石内・五月が丘(南)交差点間で重用）
                    Read more

                    Accessing regular linux commands in Huawei's Dopra Linux

                    Image
                    4 Backstory: I have a Huawei HG8245 router in my house and I want to change the default username/password. I've tried following this guide but the config file always gets reset. My ISP isn't helping either so I'm looking for other ways to accomplish this. The router has telnet access so this seems like a way to change the credentials. The first shell I gain access to looks like this: WAP> Pressing "?" gives me a list of available commands which I've pasted here, the two interesting ones are "su" and "shell". I can't seem to get su access, even after logging in as root (challenge password prompt, and then nothing happens), but shell gives me a proper linux shell. WAP>shell BusyBox v1.18.4 (2017-12-26 17:06:34 CST) built-in shell (ash) Enter 'hel
                    Read more