Use Hash-Identifier to Determine Hash Types for Password Cracking « Null Byte :: WonderHowTo

Hashes are commonly used to store sensitive information like credentials to avoid storing them in plaintext. With tools likeHashcat, it's possible to crack these hashes, but only if we know the algorithm used to generate the hash. Using a tool called hash-identifier, we can easily fingerprint any hashes to discover the right Hashcat mode to use to retrieve a password.Aside from cracking hashes, hash-identifier is also helpful for identifying which hashing algorithm is being used to provide a checksum value for a download. And it can be used to determine what program a hashed file or value may belong to, such as an SQL database or another vendor-specific format.What Is a Hash & How Do We Crack It?When passwords are lifted from a database or computer, they're usually stored as hashes so that hackers can't read any passwords in plaintext. A hashing function turns the readable passwords into jumbled up messes of letters and numbers that should not be able to be reverse-engineered.Don't Miss:Cracking WPA2 Passwords Using a PMKID Hashcat AttackBut two or more of the same passwords using the same hashing function will have the same hash, so one could determine the hashes for an entire password list using that hashing function, then use that data to determine the matching password. And that's what a lot of password-cracking tools do.While hashes are better than storing a password in plaintext, they can still be cracked if a good rule or password list is used with Hashcat or another cracking program. But you can't just point Hashcat at any hash and expect it to work. Imagine Hashcat as a drill with many different sized bits. For each type of hash we want to crack, we need to attach a different "bit" to Hashcat by setting it to the correct mode to attack the target hash.If you work with hashes a lot, it might be easy to spot the difference between types of hashes that are commonly used.At a glance, can you tell which of these two common hashes is which?8743b52063cd84097a65d1633f5c74f5
b89eaac7e61417341b710b727768294d0e6a277bAlthough you may have seen both before, it may not be immediately obvious which of these hashes is MD5 and which is SHA1. It can get even more confusing with similar hash types that have different mode numbers in Hashcat. In the case of the hashes above, it makes a big difference which is which.When using Hashcat to crack this hash, we have to set the-moption to the correct mode. To crack an MD5 hash, we'd use the mode number0to get the hash.~$ sudo hashcat -m 0 -a 0 8743b52063cd84097a65d1633f5c74f5 example.dict --force

hashcat (v4.0.1) starting...

OpenCL Platform #1: The pocl project
====================================
* Device #1: pthread-Intel(R) Core(TM)2 Duo CPU     E7500  @ 2.93GHz, 1024/3639 MB allocatable, 2MCU

8743b52063cd84097a65d1633f5c74f5:hashcatHere, we found that the hash was made with the word "hashcat" by correctly identifying it as MD5 and using a good wordlist.Recommended on Amazon:"Hash Crack: Password Cracking Manual" by Joshua PicoletWhat Hashes Are Supported?At present, a large amount of the hashes that Hashcat is capable of cracking can be identified. On theGitHub repositoryfor hash-identifier, the list of the hashes supported is quite extensive.Encryption formats supported:

ADLER-32
CRC-16
CRC-16-CCITT
CRC-32
CRC-32B
DES (Unix)
Domain Cached Credentials
FCS-16
GHash-32-3
GHash-32-5
GOST R 34.11-94
Haval-128
Haval-160
Haval-192 110080
Haval-224 114080
Haval-256
Lineage II C4
MD2
MD4
MD5
MD5 ($pass.$salt) - Joomla
MD5 (APR)
MD5 (Half)
MD5 (HMAC(Wordpress))
MD5 (Middle)
MD5 (phpBB3)
MD5 (Unix)
MD5 (Wordpress)
MySQL
MySQL 160bit - SHA-1(SHA-1($pass))
MySQL5 - SHA-1(SHA-1($pass))
NTLM
RAdmin v2.x
RipeMD-128
RipeMD-160
RipeMD-256
RipeMD-320
SAM - (LM_hash:NT_hash)
SHA-1
SHA-1 (Django)
SHA-1 (MaNGOS)
SHA-224
SHA-256
SHA-256 (Django)
SHA-384
SHA-384 (Django)
SHA-512
SNEFRU-128
SNEFRU-256
Tiger-128
Tiger-160
Tiger-192
XOR-32
Whirlpool

And more…What You'll NeedTo follow this guide, you'll needPython3installed on your computer (it's cross-platform), so get that before continuing if you don't already have it. You'll also need Hashcat, which you can download by runningapt install hashcatafter updating your computer withapt updateandapt upgrade.If you want to generate some of your own hashes to try cracking, you can do so with the formatecho -n PLAINTEXT | (HASHTYPE)sum. To create a SHA1 hash of the word "nullbyte, I would use the following command.~$ echo -n nullbyte | sha1sum

32c0ced56f1fe08583bdb079d85a35a81995018c  -Step 1: Download & Install Hash-IdentifierInstalling the Python script is really easy. To start, open a terminal window and run the following command.~$ git clone https://github.com/blackploit/hash-identifier.git

Cloning into 'hash-identifier'...
remote: Enumerating objects: 21, done.
remote: Total 21 (delta 0), reused 0 (delta 0), pack-reused 21
Unpacking objects: 100% (21/21), done.Then, navigate to its directory withcd hash-identifierand list its contents withls.~$ cd hash-identifier
~/hash-identifier$ ls

hash-id.py  README.md  screenshotsYou should see a file calledhash-id.py, which you can run with the command below to start.~/hash-identifier$ python3 hash-id.py

   #########################################################################
   #     __  __                     __           ______    _____           #
   #    /\ \/\ \                   /\ \         /\__  _\  /\  _ `\         #
   #    \ \ \_\ \     __      ____ \ \ \___     \/_/\ \/  \ \ \/\ \        #
   #     \ \  _  \  /'__`\   / ,__\ \ \  _ `\      \ \ \   \ \ \ \ \       #
   #      \ \ \ \ \/\ \_\ \_/\__, `\ \ \ \ \ \      \_\ \__ \ \ \_\ \      #
   #       \ \_\ \_\ \___ \_\/\____/  \ \_\ \_\     /\_____\ \ \____/      #
   #        \/_/\/_/\/__/\/_/\/___/    \/_/\/_/     \/_____/  \/___/  v1.2 #
   #                                                             By Zion3R #
   #                                                    www.Blackploit.com #
   #                                                   Root@Blackploit.com #
   #########################################################################
--------------------------------------------------
 HASH:Step 2: Fingerprint Unknown HashesTo try out hash-identifier, we'll be looking at trying to fingerprint the following five unknown hashes.Hash 1: 7196759210defdc0
Hash 2: 1bbb234c81ef04a1c2f441253952a556276669d7fc9d1ee765bd4b18f796699d (256)
Hash 3: 32c0ced56f1fe08583bdb079d85a35a81995018c (1)
Hash 4: 753b27807b690ef889a259f3b219e024bf5c6c33c8d56116943d9285a0b55b2050981f29e6fafa660428c48d7db3c4bd2e8dd48f87c8e90bde5e0c82ed23be10 (512)
Hash 5: 5f804b61f8dcf70044ad8c1385e946a8 (md5)To get started, let's enter the first into the waiting hash-identifier command prompt. As you can see, it yields a quick ID as a MySQL hash. This is the one we'll try to crack, so we'll return to it later.HASH: 7196759210defdc0

Possible Hashs:
[+] MySQL
[+] MD5(Middle)

Least Possible Hashs:
[+] MD5(Half)Our second hash, seen below, is identified as a SHA256 hash, with Haval256 being another possibility.HASH: 1bbb234c81ef04a1c2f441253952a556276669d7fc9d1ee765bd4b18f796699d

Possible Hashs:
[+] SHA-256
[+] Haval-256

Least Possible Hashs:
[+] GOST R 34.11-94
[+] RipeMD-256
[+] SNEFRU-256
[+] SHA-256(HMAC)
[+] Haval-256(HMAC)
[+] RipeMD-256(HMAC)
[+] SNEFRU-256(HMAC)
[+] SHA-256(md5($pass))
[+] SHA-256(sha1($pass))Our third hash is identified as SHA1:HASH: 32c0ced56f1fe08583bdb079d85a35a81995018c

Possible Hashs:
[+] SHA-1
[+] MySQL5 - SHA-1(SHA-1($pass))

Least Possible Hashs:
[+] Tiger-160
[+] Haval-160
[+] RipeMD-160
[+] SHA-1(HMAC)
[+] Tiger-160(HMAC)
[+] RipeMD-160(HMAC)
[+] Haval-160(HMAC)
[+] SHA-1(MaNGOS)
[+] SHA-1(MaNGOS2)
[+] sha1($pass.$salt)
[+] sha1($salt.$pass)
[+] sha1($salt.md5($pass))
[+] sha1($salt.md5($pass).$salt)
[+] sha1($salt.sha1($pass))
[+] sha1($salt.sha1($salt.sha1($pass)))
[+] sha1($username.$pass)
[+] sha1($username.$pass.$salt)
[+] sha1(md5($pass))
[+] sha1(md5($pass).$salt)
[+] sha1(md5(sha1($pass)))
[+] sha1(sha1($pass))
[+] sha1(sha1($pass).$salt)
[+] sha1(sha1($pass).substr($pass,0,3))
[+] sha1(sha1($salt.$pass))
[+] sha1(sha1(sha1($pass)))
[+] sha1(strtolower($username).$pass)And our fourth hash is identified as SHA512:HASH: 753b27807b690ef889a259f3b219e024bf5c6c33c8d56116943d9285a0b55b2050981f29e6fafa660428c48d7db3c4bd2e8dd48f87c8e90bde5e0c82ed23be10

Possible Hashs:
[+] SHA-512
[+] Whirlpool

Least Possible Hashs:
[+] SHA-512(HMAC)
[+] Whirlpool(HMAC)Finally, our last hash is identified as MD5:HASH: 5f804b61f8dcf70044ad8c1385e946a8

Possible Hashs:
[+] MD5
[+] Domain Cached Credentials - MD4(MD4(($pass)).(strtolower($username)))

Least Possible Hashs:
[+] RAdmin v2.x
[+] NTLM
[+] MD4
[+] MD2
[+] MD5(HMAC)
[+] MD4(HMAC)
[+] MD2(HMAC)
[+] MD5(HMAC(Wordpress))
[+] Haval-128
[+] Haval-128(HMAC)
[+] RipeMD-128
[+] RipeMD-128(HMAC)
[+] SNEFRU-128
[+] SNEFRU-128(HMAC)
[+] Tiger-128
[+] Tiger-128(HMAC)
[+] md5($pass.$salt)
[+] md5($salt.$pass)
[+] md5($salt.$pass.$salt)
[+] md5($salt.$pass.$username)
[+] md5($salt.md5($pass))
[+] md5($salt.md5($pass))
[+] md5($salt.md5($pass.$salt))
[+] md5($salt.md5($pass.$salt))
[+] md5($salt.md5($salt.$pass))
[+] md5($salt.md5(md5($pass).$salt))
[+] md5($username.0.$pass)
[+] md5($username.LF.$pass)
[+] md5($username.md5($pass).$salt)
[+] md5(md5($pass))
[+] md5(md5($pass).$salt)
[+] md5(md5($pass).md5($salt))
[+] md5(md5($salt).$pass)
[+] md5(md5($salt).md5($pass))
[+] md5(md5($username.$pass).$salt)
[+] md5(md5(md5($pass)))
[+] md5(md5(md5(md5($pass))))
[+] md5(md5(md5(md5(md5($pass)))))
[+] md5(sha1($pass))
[+] md5(sha1(md5($pass)))
[+] md5(sha1(md5(sha1($pass))))
[+] md5(strtoupper(md5($pass)))That was easy, but the next step is actually attacking these hashes by converting the identified hash type into a Hashcat mode number.Step 3: Look Up Hashcat Hash ModesTo look up a hash mode, we can take a look at the exhaustive list of Hashcat supported hash typeson the Hashcat examples page. An abbreviated list of some of the most popular hashes is below.Don't Miss:Crack Shadow Hashes After Getting Root on a Linux SystemHash-Mode   Hash-Name                   Example
0           MD5                         8743b52063cd84097a65d1633f5c74f5
10          md5($pass.$salt)            01dfae6e5d4d90d9892622325959afbe:7050461
20          md5($salt.$pass)            f0fda58630310a6dd91a7d8f0a4ceda2:4225637426
30          md5(utf16le($pass).$salt)   b31d032cfdcf47a399990a71e43c5d2a:144816
40          md5($salt.utf16le($pass))   d63d0e21fdc05f618d55ef306c54af82:13288442151473
50          HMAC-MD5 (key = $pass)      fc741db0a2968c39d9c2a5cc75b05370:1234
60          HMAC-MD5 (key = $salt)      bfd280436f45fa38eaacac3b00518f29:1234
100         SHA1                        b89eaac7e61417341b710b727768294d0e6a277b
110         sha1($pass.$salt)           2fc5a684737ce1bf7b3b239df432416e0dd07357:2014
120         sha1($salt.$pass)           cac35ec206d868b7d7cb0b55f31d9425b075082b:5363620024
130         sha1(utf16le($pass).$salt)  c57f6ac1b71f45a07dbd91a59fa47c23abcd87c2:631225
140         sha1($salt.utf16le($pass))  5db61e4cd8776c7969cfd62456da639a4c87683a:8763434884872
150         HMAC-SHA1 (key = $pass)     c898896f3f70f61bc3fb19bef222aa860e5ea717:1234
160         HMAC-SHA1 (key = $salt)     d89c92b4400b15c39e462a8caa939ab40c3aeeea:1234
200         MySQL323                    1EAFFED54F552AA5
300         MySQL4.1/MySQL5             fcf7c1b8749cf99d88e5f34271d636178fb5d130Above, we can see two examples that might be a match for our first hash (7196759210defdc0) from the previous step. At a glance, the mode 200 "MySQL323" seems like the best match, but we can confirm it by running the example hash through hash-identifier.HASH: 1EAFFED54F552AA5

Possible Hashs:
[+] MySQL
[+] MD5(Middle)

Least Possible Hashs:
[+] MD5(Half)It's an exact match to our sample hash:HASH: 7196759210defdc0

Possible Hashs:
[+] MySQL
[+] MD5(Middle)

Least Possible Hashs:
[+] MD5(Half)If we run the other possibly-matching MySQL hash type, mode 300, we can see it doesn't match the fingerprint of our unknown sample.HASH: fcf7c1b8749cf99d88e5f34271d636178fb5d130

Possible Hashs:
[+] SHA-1
[+] MySQL5 - SHA-1(SHA-1($pass))

Least Possible Hashs:
[+] Tiger-160
[+] Haval-160
[+] RipeMD-160
[+] SHA-1(HMAC)
[+] Tiger-160(HMAC)
[+] RipeMD-160(HMAC)
[+] Haval-160(HMAC)
[+] SHA-1(MaNGOS)
[+] SHA-1(MaNGOS2)
[+] sha1($pass.$salt)
[+] sha1($salt.$pass)
[+] sha1($salt.md5($pass))
[+] sha1($salt.md5($pass).$salt)
[+] sha1($salt.sha1($pass))
[+] sha1($salt.sha1($salt.sha1($pass)))
[+] sha1($username.$pass)
[+] sha1($username.$pass.$salt)
[+] sha1(md5($pass))
[+] sha1(md5($pass).$salt)
[+] sha1(md5(sha1($pass)))
[+] sha1(sha1($pass))
[+] sha1(sha1($pass).$salt)
[+] sha1(sha1($pass).substr($pass,0,3))
[+] sha1(sha1($salt.$pass))
[+] sha1(sha1(sha1($pass)))
[+] sha1(strtolower($username).$pass)That proves that we've identified the correct Hashcat mode number,200, to use in our Hashcat attack.Step 4: Attack the Hash with HashcatOnce we know the mode to use by identifying the hash, we can attack it using Hashcat. For it to work, we'll need to create a dictionary file with passwords on it, which Hashcat will then use to attack the hash. There are many available lists online like RockYou but, in this case, we'll be creating one called example.dict to put some password guesses in.If you're still in the hash-identifier tool, hitControl-Con your keyboard first. Then, create and open a file in nano by typing the following.~/hash-identifier$ nano example.dictAfter adding some password guesses that include the word "hashcat" for this example, hitControl-Xto exit, thenY, and confirm the filename. We can now use this file as our list of plaintext guesses, along with the mode we discovered, to crack the hash. The basic formula we will use will look like this:sudo hashcat -m MODE_NUMBER -a 0 HASH_VALUE example.dictWhen we run it with our hash of7196759210defdc0(the "HASH_VALUE") with our mode of200(the "MODE_NUMBER"), the results should look like below. If you have an older system like the example one I'm using, you may need to use the--forcecommand with it.~/hash-identifier$ sudo hashcat -m 200 -a 0 7196759210defdc0 example.dict --force

hashcat (v5.1.0) starting...

OpenCL Platform #1: The pocl project
====================================
* Device #1: pthread-Intel(R) Core(TM)2 Duo CPU     E7500  @ 2.93GHz, 1024/3639 MB allocatable, 2MCU

/usr/share/hashcat/OpenCL/m00200_a0-optimized.cl: Pure OpenCL kernel not found, falling back to optimized OpenCL kernel
Hashes: 1 digests; 1 unique digests, 1 unique salts
Bitmaps: 16 bits, 65536 entries, 0x0000ffff mask, 262144 bytes, 5/13 rotates
Rules: 1

Applicable optimizers:
* Optimized-Kernel
* Zero-Byte
* Not-Iterated
* Single-Hash
* Single-Salt

Password length minimum: 0
Password length maximum: 31

Watchdog: Hardware monitoring interface not found on your system.
Watchdog: Temperature abort trigger disabled.
Watchdog: Temperature retain trigger disabled.

* Device #1: build_opts '-I /usr/share/hashcat/OpenCL -D VENDOR_ID=64 -D CUDA_ARCH=0 -D AMD_ROCM=0 -D VECT_SIZE=4 -D DEVICE_TYPE=2 -D DGST_R0=0 -D DGST_R1=1 -D DGST_R2=2 -D DGST_R3=3 -D DGST_ELEM=4 -D KERN_TYPE=200 -D _unroll'
* Device #1: Kernel m00200_a0-optimized.44d10a8c.kernel not found in cache! Building may take a while...
Dictionary cache hit:
* Filename..: example.dict
* Passwords.: 17
* Bytes.....: 76
* Keyspace..: 17

- Device #1: autotuned kernel-accel to 1024
- Device #1: autotuned kernel-loops to 1
[s]tatus [p]ause [r]esume [b]ypass [c]heckpoint [q]uit => The wordlist or mask that you are using is too small.
This means that hashcat cannot use the full parallel power of your device(s).
Unless you supply more work, your cracking speed will drop.
For tips on supplying more work, see: https://hashcat.net/faq/morework

Approaching final keyspace - workload adjusted.

7196759210defdc0:hashcat

Session..........: hashcat
Status...........: Cracked
Hash.Type........: MySQL323
Hash.Target......: 7196759210defdc0
Time.Started.....: Mon Dec  9 17:00:25 2019 (0 secs)
Time.Estimated...: Mon Dec  9 17:00:25 2019 (0 secs)
Guess.Base.......: File (example.dict)
Guess.Queue......: 1/1 (100.00%)
Speed.Dev.#1.....:        0 H/s (0.03ms)
Recovered........: 1/1 (100.00%) Digests, 1/1 (100.00%) Salts
Progress.........: 17/17 (100.00%)
Rejected.........: 0/17 (0.00%)
Restore.Point....: 0/17 (0.00%)
Candidates.#1....: wow -> again
HWMon.Dev.#1.....: N/A

Started: Mon Dec  9 17:00:17 2019
Stopped: Mon Dec  9 17:00:27 2019There we go! We get the output of7196759210defdc0:hashcat, meaning we found the value of the MySQL323 hash to be the word "hashcat" by comparing it through all the words in the example.dict file.Hash-Identifier Makes Fingerprinting Hashes EasyWhenever you're dealing with an unknown type of hash, the first step to making it useful is identifying it correctly. While hash-identifier isn't a perfect tool, it's an easy way of spotting most hashes and distinguishing between several types of common and similar-looking hashes that have a different mode in Hashcat. Even if hash-identifier isn't sure what kind of hash you're dealing with, comparing the response of example hashes from the Hashcat website can help you verify that you've found the right hash.I hope you enjoyed this guide to fingerprinting unknown hashes! If you have any questions about this tutorial on hash cracking and identification or you have a comment, ask below or feel free to reach me on Twitter@KodyKinzie.Don't Miss:Detect When a Device Is Nearby with the ESP8266 Friend DetectorWant to start making money as a white hat hacker?Jump-start your hacking career with our2020 Premium Ethical Hacking Certification Training Bundlefrom the newNull Byte Shopand get over 60 hours of training from cybersecurity professionals.Buy Now (90% off) >Other worthwhile deals to check out:97% off The Ultimate 2021 White Hat Hacker Certification Bundle99% off The 2021 All-in-One Data Scientist Mega Bundle98% off The 2021 Premium Learn To Code Certification Bundle62% off MindMaster Mind Mapping Software: Perpetual LicenseCover image by Kody/Null ByteRelatedHack Like a Pro:How to Crack Passwords, Part 3 (Using Hashcat)Hack Like a Pro:Metasploit for the Aspiring Hacker, Part 8 (Setting Up a Fake SMB Server to Capture Domain Passwords)How To:Crack Shadow Hashes After Getting Root on a Linux SystemHow To:Crack MD5 Hashes with All of Kali Linux's Default WordlistsHow to Hack Wi-Fi:Cracking WPA2-PSK Passwords with CowpattyHow To:Use John the Ripper in Metasploit to Quickly Crack Windows HashesHow To:Crack Password-Protected Microsoft Office Files, Including Word Docs & Excel SpreadsheetsHow To:Use Beginner Python to Build a Brute-Force Tool for SHA-1 HashesHow To:Perform a Pass-the-Hash Attack & Get System Access on WindowsHack Like a Pro:How to Grab & Crack Encrypted Windows PasswordsLocking Down Linux:Harden Sudo Passwords to Defend Against Hashcat AttacksHow To:Creating Unique and Safe Passwords, Part 1 Using WordlistsHacking Windows 10:How to Intercept & Decrypt Windows Passwords on a Local NetworkHow To:Hack 200 Online User Accounts in Less Than 2 Hours (From Sites Like Twitter, Reddit & Microsoft)Hack Like a Pro:How to Crack Passwords, Part 2 (Cracking Strategy)Hack Like a Pro:How to Crack Passwords, Part 1 (Principles & Technologies)Hacking macOS:How to Hack a Mac Password Without Changing ItNews:'Beast' Cracks Billions of Passwords in SecondsHow To:C++ Hash CrackerHack Like a Pro:How to Crack User Passwords in a Linux SystemHack Like a Pro:How to Remotely Grab Encrypted Passwords from a Compromised ComputerHow To:Hack MD5 passwords with Cain and AbelHow To:How Hackers Take Your Encrypted Passwords & Crack ThemRainbow Tables:How to Create & Use Them to Crack PasswordsHow To:GPU Accelerate Cracking Passwords with HashcatHow To:Hack Mac OS X Lion PasswordsHow To:Make an Unbreakable Linux Password Using a SHA-2 Hash AlgorithmHow To:Mine Bitcoin and Make MoneyNews:Advanced Cracking Techniques, Part 1: Custom DictionariesNews:Advanced Cracking Techniques, Part 2: Intelligent BruteforcingSecure Your Computer, Part 2:Password-Protect the GRUB Bootloader on Dual-Booted PCsHow To:Recover a Windows Password with OphcrackGoodnight Byte:HackThisSite, Realistic 5 - Real Hacking SimulationsHow To:Remove a Windows Password with a Linux Live CDMastering Security, Part 1:How to Manage and Create Strong Passwords