Giter Club home page Giter Club logo

hashid's Introduction

hashID | hash-identifier

Identify the different types of hashes used to encrypt data and especially passwords.

This replaces hash-identifier, which is outdated!

hashID is a tool written in Python 3 which supports the identification of over 220 unique hash types using regular expressions. A detailed list of supported hashes can be found here.

It is able to identify a single hash, parse a file or read multiple files in a directory and identify the hashes within them. hashID is also capable of including the corresponding hashcat mode and/or JohnTheRipper format in its output.

hashID works out of the box with Python 2 ≥ 2.7.x or Python 3 ≥ 3.3 on any platform.

Note: When identifying a hash on *nix operating systems use single quotes to prevent interpolation.

Installation

You can install, upgrade, uninstall hashID with these commands:

$ pip install hashid
$ pip install --upgrade hashid
$ pip uninstall hashid

Or you can install by cloning the repository:

$ sudo apt-get install python3 git
$ git clone https://github.com/psypanda/hashid.git
$ cd hashid
$ sudo install -g 0 -o 0 -m 0644 doc/man/hashid.7 /usr/share/man/man7/
$ sudo gzip /usr/share/man/man7/hashid.7

Alternatively you can grab the latest release here.

Usage

$ ./hashid.py [-h] [-e] [-m] [-j] [-o FILE] [--version] INPUT
Parameter Description
INPUT input to analyze (default: STDIN)
-e, --extended list all hash algorithms including salted passwords
-m, --mode show corresponding hashcat mode in output
-j, --john show corresponding JohnTheRipper format in output
-o FILE, --outfile FILE write output to file (default: STDOUT)
--help show help message and exit
--version show program's version number and exit

Screenshot

$ ./hashid.py '$P$8ohUJ.1sdFw09/bMaAQPTGDNi2BIUt1'
Analyzing '$P$8ohUJ.1sdFw09/bMaAQPTGDNi2BIUt1'
[+] Wordpress ≥ v2.6.2
[+] Joomla ≥ v2.5.18
[+] PHPass' Portable Hash

$ ./hashid.py -mj '$racf$*AAAAAAAA*3c44ee7f409c9a9b'
Analyzing '$racf$*AAAAAAAA*3c44ee7f409c9a9b'
[+] RACF [Hashcat Mode: 8500][JtR Format: racf]

$ ./hashid.py hashes.txt
--File 'hashes.txt'--
Analyzing '*85ADE5DDF71E348162894C71D73324C043838751'
[+] MySQL5.x
[+] MySQL4.1
Analyzing '$2a$08$VPzNKPAY60FsAbnq.c.h5.XTCZtC1z.j3hnlDFGImN9FcpfR1QnLq'
[+] Blowfish(OpenBSD)
[+] Woltlab Burning Board 4.x
[+] bcrypt
--End of file 'hashes.txt'--

Resources

hashid's People

Contributors

bburky avatar doomguy avatar kmulvey avatar liske avatar psypanda avatar

Stargazers

 avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar

Watchers

 avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar

hashid's Issues

Feature request: passwd/shadow raw file support

Just a small change to the regex's, where applicable, ala:
Prototype(
regex=re.compile(r'^$1$[a-z0-9/.]{0,8}$[a-z0-9/.]{22}(:.*)?$', re.IGNORECASE),

...note the "(:.*)?" before the EOL terminator? that lets me use raw passwd+shadow files, without any preprocessing.

hashid does not install in Arch linux

This is the pip which I have installed:

$ sudo pacman -S python-pip
resolving dependencies...
looking for conflicting packages...

Packages (7) python-attrs-22.2.0-3  python-cffi-1.15.1-3  python-cryptography-41.0.2-1  python-ply-3.11-12
             python-pycparser-2.21-5  python-wheel-0.40.0-3  python-pip-23.1.2-1

Total Download Size:    4.82 MiB
Total Installed Size:  29.61 MiB

Why do I get this error:

$ pip install hashid
error: externally-managed-environment

× This environment is externally managed
?-> To install Python packages system-wide, try 'pacman -S
    python-xyz', where xyz is the package you are trying to
    install.
    
    If you wish to install a non-Arch-packaged Python package,
    create a virtual environment using 'python -m venv path/to/venv'.
    Then use path/to/venv/bin/python and path/to/venv/bin/pip.
    
    If you wish to install a non-Arch packaged Python application,
    it may be easiest to use 'pipx install xyz', which will manage a
    virtual environment for you. Make sure you have python-pipx
    installed via pacman.

note: If you believe this is a mistake, please contact your Python installation or OS distribution provider. You can override this, at the risk of breaking your Python installation or OS, by passing --break-system-packages.
hint: See PEP 668 for the detailed specification.

error message when using hashfiles

works perfect with single hashes, but I get an error when using the script against a hashfile. errormessage:

Traceback (most recent call last):
File "hashid.py", line 233, in
with open(args.output, "w", encoding="utf-8") as outfile:
TypeError: 'encoding' is an invalid keyword argument for this function

Add SipHash

Hashcat example hash: ad61d78c06037cd9:2:4:81533218127174468417660201434054
Hashcat Mode: 10100

Taken from hashcat wiki.

Add Cisco Type 7

Add Cisco Type 7 "hash"
Example: 044B0A151C36435C0D = password
Documentation on the format from PassLib here.

Add CRAM-MD5

Hashcat example hash:

$cram_md5$PG5vLXJlcGx5QGhhc2hjYXQubmV0Pg==$dXNlciA0NGVhZmQyMmZlNzY2NzBmNmIyODc5MDgxYTdmNWY3MQ==

Hashcat Mode: 10200
Taken from hashcat wiki.

Inventory notification

Your tool/software has been inventoried on Rawsec's CyberSecurity Inventory.

https://inventory.rawsec.ml/tools.html#hashID

What is Rawsec's CyberSecurity Inventory?

An inventory of tools and resources about CyberSecurity. This inventory aims to help people to find everything related to CyberSecurity.

More details about features here.

Note: the inventory is a FLOSS (Free, Libre and Open-Source Software) project.

Why should you care about being inventoried?

Mainly because this is giving visibility to your tool and improve its referencing.

Badges

The badge shows to your community that your are inventoried. It looks good but also shows you care about your project, that your tool is referenced.

Feel free to claim your badge here: http://inventory.rawsec.ml/features.html#badges, it looks like that Rawsec's CyberSecurity Inventory, but there are several styles available.

Want to thank us?

If you want to thank us, you can help make our open project better known by tweeting about it! For example: Twitter URL

So what?

That's all, this message is just to notify you if you care. Else you can close this issue.

hashID does not recognize werkzeug hash results

hashID is unable to automatically detect the hash which is a result of the generate_password_hash function in the common werkzeug library \ module used by flask based apps,

As defined here:
https://github.com/pallets/werkzeug/blob/d2625f545f53252314aee0c36818f52a52f7d321/src/werkzeug/security.py#L172

Example result:

In [1]: from werkzeug.security import check_password_hash, generate_password_hash

In [2]: generate_password_hash('demo')
Out[2]: 'pbkdf2:sha256:150000$GeDI5o4S$79f2079efda1d5b3953f062cb14a404a30e9c0458992f44a109a2cad0916b2d7'

In [4]: check_password_hash('pbkdf2:sha256:150000$GeDI5o4S$79f2079efda1d5b3953f062cb14a404a30e9c0458992f44a109a2cad0916b2d7','demo')
Out[4]: True

In [8]: list(myhash.identifyHash('pbkdf2:sha256:150000$GeDI5o4S$79f2079efda1d5b3953f062cb14a404a30e9c0458992f44a109a2cad0916b2d7'))
Out[8]: []

Note that for the example I used it hash id as an import, but the shell registered command returns same results but more human readable: '[+] Unknown hash'

I have been trying to identify this type of hash for some time, luckily I was able to find the correct function following the app code import stack. app -> flask app builder --> werkzeug/security.py

I came across hashID recommended in various sources (mainly stack overflow questions) but it was unable to help this case..

Support for Python 3.1/3.2

File "./hashID/hashid.py", line 177
HashInfo(name=u'Wordpress ≥ v2.6.2', hashcat=400, john='phpass', extended=False),
^
SyntaxError: invalid syntax

cant install

Hello when I try to install this command : sudo install -g 0 -o 0 -m 0644 doc/man/hashid.7 /usr/share/man/man7/

its giving me this message : bash: sudo: command not found
can anyone help me ?

command line: pasted hash cropped

approach 1

After installing hashID via pip and running it using hashid, I can insert hashes from the clipboard (using CRTL+V).
However if I try this with the following hash, the hash gets cropped (to the first 510 characters) on the command line:

W1t7ImlkIjoiUHJheGlzRELCpygwOjAtMzMwODI0IzAsIDI3NSlfUHJheGlzRELCpygwOjAtMzAwMzk4IzAsIDQyMSkiLCJleElkIjoiUHJheGlzRELCpygwOjAtMzMwODI0IzAsIDI3NSkiLCJuYW1lIjoiVGVybWluZSBmw7xyIE5ldXBhdGllbnRlbiBEci4gUGlvY2giLCJ2aWRlb0FwcG9pbnRtZW50IjpmYWxzZSwiaW5zdGl0dXRpb25JZCI6IjZhMzQwODgwLTU4OGEtNGZlMC1hMDY0LWM5NjIyMmJmOTM5NiIsInBoeXNpY2lhbklkIjoiUHJheGlzRELCpygwOjAtMzAwMzk4IzAsIDQyMSkiLCJwaHlzaWNpYW5FeElkIjoiUHJheGlzRELCpygwOjAtMzAwMzk4IzAsIDQyMSkiLCJwaHlzaWNpYW5OYW1lIjoiRHIuIFBpb2NoIiwicHJvcG9zYWxzUGVySG91ciI6MCwicHJvcGVydGllcyI6e319XSwiMjAyMi0wOC0xMyIsMjkse30sIjIwMjItMDktMTEiLG51bGwsbnVsbCxudWxsXQ==

hashID then returns

Analyzing 'W1t7ImlkIjoiUHJheGlzRELCpygwOjAtMzMwODI0IzAsIDI3NSlfUHJheGlzRELCpygwOjAtMzAwMzk4IzAsIDQyMSkiLCJleElkIjoiUHJheGlzRELCpygwOjAtMzMwODI0IzAsIDI3NSkiLCJuYW1lIjoiVGVybWluZSBmw7xyIE5ldXBhdGllbnRlbiBEci4gUGlvY2giLCJ2aWRlb0FwcG9pbnRtZW50IjpmYWxzZSwiaW5zdGl0dXRpb25JZCI6IjZhMzQwODgwLTU4OGEtNGZlMC1hMDY0LWM5NjIyMmJmOTM5NiIsInBoeXNpY2lhbklkIjoiUHJheGlzRELCpygwOjAtMzAwMzk4IzAsIDQyMSkiLCJwaHlzaWNpYW5FeElkIjoiUHJheGlzRELCpygwOjAtMzAwMzk4IzAsIDQyMSkiLCJwaHlzaWNpYW5OYW1lIjoiRHIuIFBpb2NoIiwicHJvcG9zYWxzUGVySG91ciI6MCwicHJvcG'
[+] Unknown hash
cropped_hash.mp4

With the hashes from the readme everything works fine.

reason for cropping

I found that the string limit for pasted clipboard content seems to be a windows restriction.

approach 2

Thanks to hashes.com I found that the encryption method seems to be base64.

However using hashID like this, also doesn't find the correct encryption type:

hashid W1t7ImlkIjoiUHJheGlzRELCpygwOjAtMzMwODI0IzAsIDI3NSlfUHJheGlzRELCpygwOjAtMzAwMzk4IzAsIDQyMSkiLCJleElkIjoiUHJheGlzRELCpygwOjAtMzMwODI0IzAsIDI3NSkiLCJuYW1lIjoiVGVybWluZSBmw7xyIE5ldXBhdGllbnRlbiBEci4gUGlvY2giLCJ2aWRlb0FwcG9pbnRtZW50IjpmYWxzZSwiaW5zdGl0dXRpb25JZCI6IjZhMzQwODgwLTU4OGEtNGZlMC1hMDY0LWM5NjIyMmJmOTM5NiIsInBoeXNpY2lhbklkIjoiUHJheGlzRELCpygwOjAtMzAwMzk4IzAsIDQyMSkiLCJwaHlzaWNpYW5FeElkIjoiUHJheGlzRELCpygwOjAtMzAwMzk4IzAsIDQyMSkiLCJwaHlzaWNpYW5OYW1lIjoiRHIuIFBpb2NoIiwicHJvcG9zYWxzUGVySG91ciI6MCwicHJvcGVydGllcyI6e319XSwiMjAyMi0wOC0xMyIsMjkse30sIjIwMjItMDktMTEiLG51bGwsbnVsbCxudWxsXQ==

It seems to look up the correct hash but doesn't find a fitting encryption type:

Analyzing 'W1t7ImlkIjoiUHJheGlzRELCpygwOjAtMzMwODI0IzAsIDI3NSlfUHJheGlzRELCpygwOjAtMzAwMzk4IzAsIDQyMSkiLCJleElkIjoiUHJheGlzRELCpygwOjAtMzMwODI0IzAsIDI3NSkiLCJuYW1lIjoiVGVybWluZSBmw7xyIE5ldXBhdGllbnRlbiBEci4gUGlvY2giLCJ2aWRlb0FwcG9pbnRtZW50IjpmYWxzZSwiaW5zdGl0dXRpb25JZCI6IjZhMzQwODgwLTU4OGEtNGZlMC1hMDY0LWM5NjIyMmJmOTM5NiIsInBoeXNpY2lhbklkIjoiUHJheGlzRELCpygwOjAtMzAwMzk4IzAsIDQyMSkiLCJwaHlzaWNpYW5FeElkIjoiUHJheGlzRELCpygwOjAtMzAwMzk4IzAsIDQyMSkiLCJwaHlzaWNpYW5OYW1lIjoiRHIuIFBpb2NoIiwicHJvcG9zYWxzUGVySG91ciI6MCwicHJvcGVydGllcyI6e319XSwiMjAyMi0wOC0xMyIsMjkse30sIjIwMjItMDktMTEiLG51bGwsbnVsbCxudWxsXQ=='
[+] Unknown hash

Do not recognize bcrypt b form

Hello,

Bcrypt hashes can be prefixed by $2b$. Source: wikipedia

For example hashes like $2b$10$Ty6z.p2lAZjVZU/wFG3YT.B0R8rTak4YkSEECD2gupfSFKjvQwc16 are not recognized as bcrypt hash by hashid.

Regex can be fixed by adding the b inside.

Add Juniper IVE

Hashcat example hash:

3u+UR6n8AgABAAAAHxxdXKmiOmUoqKnZlf8lTOhlPYy93EAkbPfs5+49YLFd/B1+omSKbW7DoqNM40/EeVnwJ8kYoXv9zy9D5C5m5A==

Hashcat Mode: 501

Taken from hashcat wiki.

Add PDF (Acrobat 2-11)

Add PDF hashes (Acrobat 2-11)
The hashes can be extracted from a protected pdf using pdf2john.

  • PDF 1.1 - 1.3 (Acrobat 2 - 4) [Hashcat Mode: 10400]
  • PDF 1.4 - 1.6 (Acrobat 5 - 8) [Hashcat Mode: 10500]
  • PDF 1.7 Level 3 (Acrobat 9) [Hashcat Mode: 10600]
  • PDF 1.7 Level 8 (Acrobat 10 - 11) [Hashcat Mode: 10700]

Add BigCrypt

Add BigCrypt hash
Example: S/8NbAAlzbYO66hAa9XZyWy2 = passphrase
Documentation on the format from PassLib here.

I've forked this project due to inactivity.

Hey!

This repo hasn't been updated since 2015. I've used your database of hashes in a newer hash-identification tool:

https://github.com/HashPals/Name-That-Hash.

I just wanted to say, thank you so much for all the work you've put in over the years. If you ever come back and want to work on Name-That-Hash feel free to 💖

For everyone else I fully intend to maintain my version and continue with this lovely idea!

The new version has some amazing improvements:

  • Popularity rankings
  • Accessible modes
  • Better regex systems
  • Descriptions of hashes

And much much more :)

Update: One of the core maintainers of this repo has approved of my fork 🥳 Thank you so much BBurky ❤️

Recommend Projects

  • React photo React

    A declarative, efficient, and flexible JavaScript library for building user interfaces.

  • Vue.js photo Vue.js

    🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.

  • Typescript photo Typescript

    TypeScript is a superset of JavaScript that compiles to clean JavaScript output.

  • TensorFlow photo TensorFlow

    An Open Source Machine Learning Framework for Everyone

  • Django photo Django

    The Web framework for perfectionists with deadlines.

  • D3 photo D3

    Bring data to life with SVG, Canvas and HTML. 📊📈🎉

Recommend Topics

  • javascript

    JavaScript (JS) is a lightweight interpreted programming language with first-class functions.

  • web

    Some thing interesting about web. New door for the world.

  • server

    A server is a program made to process requests and deliver data to clients.

  • Machine learning

    Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.

  • Game

    Some thing interesting about game, make everyone happy.

Recommend Org

  • Facebook photo Facebook

    We are working to build community through open source technology. NB: members must have two-factor auth.

  • Microsoft photo Microsoft

    Open source projects and samples from Microsoft.

  • Google photo Google

    Google ❤️ Open Source for everyone.

  • D3 photo D3

    Data-Driven Documents codes.