CycloneSep 29

Since Wordpress v6.8, the default hash func produces a custom bcrypt hash: $wp$2y$10$...

More info on this custom algo, how it uses hmac-sha384, and how to crack them with hashcat.

https://forum.hashpwn.net/post/4205

#wordpress #bcrypt #wpbcrypt #hashcracking #hashpwn #hashgen #hashcat

Wordpress v6.8 Bcrypt - hmac-sha384

As announced on February 17, 2025, Wordpress is switching their hash function to their own rolled version of bcrypt: bcrypt(base64(hmac-sha384(key="wp-sha384...

hashpwn