> For the complete documentation index, see [llms.txt](https://cajac.gitbook.io/ctf-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cajac.gitbook.io/ctf-notes/creds/offline-attacks/hash-identification.md). # Hash identification ## HAITI HAITI is a CLI tool (and library) to identify hash types (hash type identifier). ### Installation If needed install HAITI with the following command ```bash sudo gem install haiti-hash ``` ### Sample usage ```bash ┌──(kali㉿kali)-[~] └─$ haiti 48bb6e862e54f2a795ffc4e541caed4d MD5 [HC: 0] [JtR: raw-md5] LM [HC: 3000] [JtR: lm] NTLM [HC: 1000] [JtR: nt] Domain Cached Credentials (DCC), MS Cache [HC: 1100] [JtR: mscash] Domain Cached Credentials 2 (DCC2), MS Cache 2 [HC: 2100] [JtR: mscash2] MD2 [JtR: md2] MD4 [HC: 900] [JtR: raw-md4] Haval-128 (4 rounds) [JtR: haval-128-4] Lotus Notes/Domino 5 [HC: 8600] [JtR: lotus5] Skype [HC: 23] IPB 2.x (Invision Power Board) [HC: 2810] Keyed MD5: RIPv2, OSPF, BGP, SNMPv2 [JtR: net-md5] RIPEMD-128 [JtR: ripemd-128] Snefru-128 [JtR: snefru-128] IPMI 2.0 RAKP HMAC-MD5 [HC: 7350] DNSSEC (NSEC3) [HC: 8300] RAdmin v2.x [HC: 9900] [JtR: radmin] Umbraco HMAC-SHA1 [HC: 24800] Bitcoin WIF private key (P2PKH), compressed [HC: 28501] Bitcoin WIF private key (P2PKH), uncompressed [HC: 28502] ``` ### Usage information
haiti -h ```bash ┌──(kali㉿kali)-[~] └─$ haiti -h HAITI (HAsh IdenTifIer) v2.1.0 Usage: haiti [options] list haiti samples ( | ) haiti [options] haiti --ascii-art haiti -h | --help haiti --version Commands: samples Display hash samples for the given type list Display a list of all the available hash types Parameters: Hash string to identify, read from STDIN if equal to "-" hashcat or john the ripper reference Hash type name Options: --no-color Disable colorized output (NO_COLOR environment variable is respected too) -e, --extended List all possible hash algorithms including ones using salt --short Display in a short format: do not display hashcat and john the ripper references --hashcat-only Show only hashcat references --john-only Show only john the ripper references --ascii-art Display the logo in colored ascii-art --debug Display arguments -h, --help Show this screen --version Show version Examples: haiti -e d41d8cd98f00b204e9800998ecf8427e haiti --no-color --short d41d8cd98f00b204e9800998ecf8427e b2sum /etc/os-release | awk '{print $1}' | haiti - haiti samples crc32 Project: author (https://pwn.by/noraj / https://twitter.com/noraj_rawsec) source (https://github.com/noraj/haiti) documentation (https://noraj.github.io/haiti) ```
## Hashcat Later versions of `hashcat` can try to identify hashes with the `--identify` parameter ```bash hashcat --identify hashes.txt ```
Example run ```bash ┌──(kali㉿kali)-[~/OffSec_Courses/PEN-200] └─$ hashcat --identify asrep_hashes.txt The following hash-mode match the structure of your input hash: # | Name | Category ======+============================================================+====================================== 18200 | Kerberos 5, etype 23, AS-REP | Network Protocol ```
## Hashid `hashid` can identify hashes with their corresponding Hashcat mode (`-m` parameter) and/or John the Ripper format (`-j` parameter) ```bash ┌──(kali㉿kali)-[~] └─$ hashid -m -j 48bb6e862e54f2a795ffc4e541caed4d Analyzing '48bb6e862e54f2a795ffc4e541caed4d' [+] MD2 [JtR Format: md2] [+] MD5 [Hashcat Mode: 0][JtR Format: raw-md5] [+] MD4 [Hashcat Mode: 900][JtR Format: raw-md4] [+] Double MD5 [Hashcat Mode: 2600] [+] LM [Hashcat Mode: 3000][JtR Format: lm] [+] RIPEMD-128 [JtR Format: ripemd-128] [+] Haval-128 [JtR Format: haval-128-4] [+] Tiger-128 [+] Skein-256(128) [+] Skein-512(128) [+] Lotus Notes/Domino 5 [Hashcat Mode: 8600][JtR Format: lotus5] [+] Skype [Hashcat Mode: 23] [+] Snefru-128 [JtR Format: snefru-128] [+] NTLM [Hashcat Mode: 1000][JtR Format: nt] [+] Domain Cached Credentials [Hashcat Mode: 1100][JtR Format: mscach] [+] Domain Cached Credentials 2 [Hashcat Mode: 2100][JtR Format: mscach2] [+] DNSSEC(NSEC3) [Hashcat Mode: 8300] [+] RAdmin v2.x [Hashcat Mode: 9900][JtR Format: radmin] ``` ### Usage information
hashid -h ```bash ┌──(kali㉿kali)-[~] └─$ hashid -h usage: hashid.py [-h] [-e] [-m] [-j] [-o FILE] [--version] INPUT Identify the different types of hashes used to encrypt data positional arguments: INPUT input to analyze (default: STDIN) options: -e, --extended list all possible hash algorithms including salted passwords -m, --mode show corresponding Hashcat mode in output -j, --john show corresponding JohnTheRipper format in output -o FILE, --outfile FILE write output to file -h, --help show this help message and exit --version show program's version number and exit License GPLv3+: GNU GPL version 3 or later ```
## Hash-identifier Run `hash-identifier` with or without the hash supplied as a parameter ```bash ┌──(kali㉿kali)-[~] └─$ hash-identifier 48bb6e862e54f2a795ffc4e541caed4d ######################################################################### # __ __ __ ______ _____ # # /\ \/\ \ /\ \ /\__ _\ /\ _ `\ # # \ \ \_\ \ __ ____ \ \ \___ \/_/\ \/ \ \ \/\ \ # # \ \ _ \ /'__`\ / ,__\ \ \ _ `\ \ \ \ \ \ \ \ \ # # \ \ \ \ \/\ \_\ \_/\__, `\ \ \ \ \ \ \_\ \__ \ \ \_\ \ # # \ \_\ \_\ \___ \_\/\____/ \ \_\ \_\ /\_____\ \ \____/ # # \/_/\/_/\/__/\/_/\/___/ \/_/\/_/ \/_____/ \/___/ v1.2 # # By Zion3R # # www.Blackploit.com # # Root@Blackploit.com # ######################################################################### -------------------------------------------------- Possible Hashs: [+] MD5 [+] Domain Cached Credentials - MD4(MD4(($pass)).(strtolower($username))) Least Possible Hashs: [+] RAdmin v2.x [+] NTLM [+] MD4 [+] MD2 [+] MD5(HMAC) [+] MD4(HMAC) [+] MD2(HMAC) [+] MD5(HMAC(Wordpress)) [+] Haval-128 [+] Haval-128(HMAC) [+] RipeMD-128 [+] RipeMD-128(HMAC) [+] SNEFRU-128 [+] SNEFRU-128(HMAC) [+] Tiger-128 [+] Tiger-128(HMAC) [+] md5($pass.$salt) [+] md5($salt.$pass) [+] md5($salt.$pass.$salt) [+] md5($salt.$pass.$username) [+] md5($salt.md5($pass)) [+] md5($salt.md5($pass)) [+] md5($salt.md5($pass.$salt)) [+] md5($salt.md5($pass.$salt)) [+] md5($salt.md5($salt.$pass)) [+] md5($salt.md5(md5($pass).$salt)) [+] md5($username.0.$pass) [+] md5($username.LF.$pass) [+] md5($username.md5($pass).$salt) [+] md5(md5($pass)) [+] md5(md5($pass).$salt) [+] md5(md5($pass).md5($salt)) [+] md5(md5($salt).$pass) [+] md5(md5($salt).md5($pass)) [+] md5(md5($username.$pass).$salt) [+] md5(md5(md5($pass))) [+] md5(md5(md5(md5($pass)))) [+] md5(md5(md5(md5(md5($pass))))) [+] md5(sha1($pass)) [+] md5(sha1(md5($pass))) [+] md5(sha1(md5(sha1($pass)))) [+] md5(strtoupper(md5($pass))) -------------------------------------------------- HASH: ^C Bye! ``` ## Online services You can also use online services to help with hash identification: dcode.fr: hashes.pro: tunnelsup.com: ## Resources Cryptographic hash function - Wikipedia: HAITI - Homepage: HAITI - GitHub: HashID - GitHub: HashID - Homepage: HashID - Kali Tools: hash-identifier - GitHub: hash-identifier - Kali Tools: