It uses a kind of challenge&#x2F;response, where the device provides a salt that is used with a hardcoded password for that account. It seems to look like &#x27;AK1&#x27; + base64(salt|SHA1(salt|password|Fortinet magic)) according to <a href="http:&#x2F;&#x2F;fossies.org&#x2F;linux&#x2F;john&#x2F;src&#x2F;FGT_fmt_plug.c" rel="nofollow">http:&#x2F;&#x2F;fossies.org&#x2F;linux&#x2F;john&#x2F;src&#x2F;FGT_fmt_plug.c</a>, a cracker for Fortigate passwords.