Last active 1560306087

Wrote this to check AD hashes against haveibeenpwned's sha1 password list

hibp-sha1-check.py Raw
1#!/usr/bin/env python
2# input files:
3# - hashlist.txt, a file containing the user hashes to check, in format username:hash, one per line.
4# (or change the input to whatever you need it as)
5# - pwned-passwords-sha1-ordered-by-count-v4.txt, get this from https://haveibeenpwned.com/Passwords
6# any format is fine, just update the file name below
7# the script will output percentage of the password file completed to stdout. compare this against your
8# original password list, or modify the block at the end to further process the data
9import os.path
10inp_users = "hashlist.txt"
11inp_passwords = "pwned-passwords-sha1-ordered-by-count-v4.txt"
12with open(inp_users) as f:
13 d = {hash:user for user,hash in (l.strip().split(":") for l in f.readlines())}
14
15out = []
16filesize = os.path.getsize(inp_passwords)
17with open(inp_passwords) as f:
18 t=0
19 for line in f:
20 if line.split(":")[0] in d:
21 out.append(line)
22 t+=len(line)
23 print((t/filesize)*100,end="\r")
24
25print("\n".join(out))