Cracking iSCSI CHAP authentication hashes with long challenges (64+ bytes), which Hashcat's native mode 4800 cannot handle.

Hashcat's native mode 4800 (iSCSI CHAP authentication, MD5) only supports 16-byte CHAP challenges. However, many modern Linux iSCSI targets (TGT, LIO/TCMU, ESXi, etc.) generate longer challenges — typically 64 bytes or more.

When you try to crack these with Hashcat mode 4800, you get:

Token length exception

This happens because:

• RFC 3720 allows CHAP challenges up to 1024 bytes
• Hashcat mode 4800 was hardcoded for the legacy 16-byte challenge length
• Windows iSCSI Initiator happily accepts and uses these long challenges
• Your captured handshake is valid — Hashcat just can't ingest it

This tool converts the iSCSI CHAP capture into Hashcat mode 10 format:

MD5(password || salt)

Where:

• password = CHAP_I (1-byte identifier) + your candidate password
• salt = full CHAP_C challenge (can be 64, 128, 256+ bytes)

By hex-encoding the wordlist and prepending CHAP_I to every candidate, Hashcat mode 10 computes the exact same hash as the iSCSI CHAP response — without the 16-byte limitation.

• Windows with PowerShell 5.1 or later
• Hashcat (tested with 6.2.x+)
• A wordlist (e.g., rockyou.txt, custom lists)
• iSCSI CHAP capture data (see Getting CHAP Hashes)

• GPU with OpenCL/CUDA support (Hashcat will use CPU otherwise)
• Large wordlists for complex passwords

1. Download iSCSI_CHAP_Cracker.ps1
2. Install Hashcat and ensure hashcat.exe is in your PATH, or configure the full path in the tool
3. Right-click → Run with PowerShell, or execute:

   .\iSCSI_CHAP_Cracker.ps1

⚠️ Note: If execution policy blocks the script, run:

Set-ExecutionPolicy -ExecutionPolicy Bypass -Scope Process

1. Start a capture on the network interface connected to your iSCSI target

2. Filter for iSCSI protocol: iscsi.keyvalue

3. Look for the CHAP Authentication sequence:

   • CHAP_C — Challenge from target (long hex string, 128+ chars)
   • CHAP_R — Response from initiator (32 hex chars = 16-byte MD5)
   • CHAP_I — Identifier (usually 0x01, 0x02, etc.)

4. Right-click each field → Copy → Value (as hex string)

Example Wireshark fields:
  iscsi.chap.c    → CHAP_C (Challenge)
  iscsi.chap.r    → CHAP_R (Response)
  iscsi.chap.i    → CHAP_I (Identifier)

# Capture iSCSI traffic
sudo tcpdump -i eth0 -w iscsi.pcap port 3260

# Extract CHAP fields
tshark -r iscsi.pcap -Y "iscsi.opcode == 0x03" -T fields -e iscsi.chap.i -e iscsi.chap.c -e iscsi.chap.r

Some iSCSI initiators log authentication details. Check:

• Event Viewer → Applications and Services Logs → Microsoft → Windows → iSCSI
• Initiator debug logs (if enabled)

💡 Tip: The tool accepts 0x prefix, spaces, colons — it auto-cleans everything.

1. Paste CHAP_I, CHAP_C, CHAP_R into the fields
2. Select wordlist via Browse button
3. Choose encoding:
   • ASCII — Standard text wordlists
   • UTF8 — Unicode wordlists
   • UTF16LE — Windows-style UTF-16 (auto-converted to ASCII hex)
4. Check Null-pad if your target pads passwords to 16 bytes with 0x00
5. Click GENERATE FILES — creates hash.txt + wordlist_hex.txt
6. Click RUN HASHCAT — launches Hashcat mode 10
7. Click DECODE — converts $HEX[...] output to readable plaintext

View, export, and clear previously cracked passwords from:

• cracked.txt (output directory)
• hashcat.potfile (output directory + Hashcat directory)

Long salts (>16 bytes) require Hashcat's pure kernel. The tool generates the command without -O. If you run Hashcat manually, omit -O:

# ✅ CORRECT
hashcat.exe -m 10 -a 0 --hex-wordlist --hex-salt hash.txt wordlist_hex.txt -o cracked.txt --force

# ❌ WRONG — will fail with long challenges
hashcat.exe -m 10 -a 0 -O --hex-wordlist --hex-salt hash.txt wordlist_hex.txt

• Add -w 3 for maximum GPU workload
• Add -d 1 to specify a specific GPU device
• Use --potfile-disable if you don't want to save to hashcat.potfile

Initiator                          Target
─────────                          ──────
   │ ─────── CHAP_I (identifier) ──────> │
   │ <──── CHAP_C (random challenge) ──── │
   │                                     │
   │  response = MD5(CHAP_I || password || CHAP_C)
   │ ─────── CHAP_R (response) ─────────> │
   │                                     │
   │  Target verifies: MD5(CHAP_I || password || CHAP_C) == CHAP_R

Hashcat mode 10: md5($pass.$salt)

By hex-encoding the wordlist and prepending CHAP_I, each candidate becomes the correct iSCSI CHAP password format.

This tool is provided for authorized security testing and research only. Always ensure you have permission to test target systems.

• Hashcat team for the excellent cracking engine
• GitHub issue #1773 contributors for the mode 10 workaround concept