hashpals / name-that-hash Goto Github PK

🔗 Don't know what type of hash it is? Name That Hash will name that hash type! 🤖 Identify MD5, SHA256 and 300+ other hashes ☄ Comes with a neat web app 🔥

Home Page: https://nth.skerritt.blog

License: GNU General Public License v3.0

Python 100.00%

hash infosec cyber security hacking tool tryhackme hacktoberfest hackthebox ctf

name-that-hash's People

Contributors

Stargazers

Watchers

Forkers

orielorieloriel sinw0lf faelana fawadahmad111 digitalsleuth gunnard saraiva 11developer devzero2000 djlol0 hacker-steroids timb-machine-mirrors iamnormaluser cybermonitor dhinagaran-s chanpu9 antichown witchfindertr gh0st0ne tomyang9 silentsoul04 zonzekyo y0d4a nashnsulthan jgmoss baohuiking ckrielle iuliagudovan nusiloot sashka3076 rasimakgun sysdba tropical-smootie swanandx uniqueitmail 0xsaltyhash rishabhdeepsingh 5l1v3r1 mjeanroy roycewilliams skiyet kaulanab l1kw1d suryatmodulus sunrong1027 mytfx str0wberry crytech7 hackinfinity asim06 kvant6ubl moasiri takester mkdirlove abmnyuiwari ellygaytor deliasmysis hartl3y94 darkoneiroi sgustavsen barsides alic4fer ohrenmann mikelolasagasti csql2 logic232 sala2000 fz3r0 jorianwoltjer excloudx6 johnng007 olalkeith erencar brainhub24 data-gami zha0 totoro2205 th3blackst0rk infosecstreams puzzithinker gg-big-org jesusgavancho icodein matrixsociety denji rup-royofficial iq-scm aeybelv jimba86 deltared1a fuad00 ramanveerji scove zahidsqldba kadalis brainrape23 wint3rmuted sebdufourcq cpu900 user-sspmynxdvb

name-that-hash's Issues

Domain Cached Credential - JtR format Typo

> I was cracking some hashes, and I found a type in the JtR format for Domain Cached Credentials. It should be mscash instead of mscach.

'base64' in self.kwargs is always True

Name-That-Hash/name_that_hash/check_hashes.py

Line 27 in 5290d8c

if "base64" in self.kwargs:

'base64' in self.kwargs is always True, no matter that the value of the 'base64' key in self.kwargs dictionary is False or True.

Update descriptions for shadow file

Well I know the shadow file can have MD5, blowfish, SHA-256 and SHA-512

can only concatenate str

[CRASH] greppable (macOS 11.2.1)

Tried the -g greppable option on macOS 11.2.1 (Big Sur, Intel, nth installed with Homebrew), but getting a crash. Below is the stderr when trying to detect an IPFS multihash. Crash also happens with "regular" hashes like MD5.

nth -t 'QmPikdNwuAATbEM7adqBhy5sLGiVk19x7gUbY6LDioACHY' -g
Traceback (most recent call last):
  File "/usr/local/bin/nth", line 8, in <module>
    sys.exit(main())
  File "/usr/local/Cellar/name-that-hash/1.1.0/libexec/lib/python3.9/site-packages/click/core.py", line 829, in __call__
    return self.main(*args, **kwargs)
  File "/usr/local/Cellar/name-that-hash/1.1.0/libexec/lib/python3.9/site-packages/click/core.py", line 782, in main
    rv = self.invoke(ctx)
  File "/usr/local/Cellar/name-that-hash/1.1.0/libexec/lib/python3.9/site-packages/click/core.py", line 1066, in invoke
    return ctx.invoke(self.callback, **ctx.params)
  File "/usr/local/Cellar/name-that-hash/1.1.0/libexec/lib/python3.9/site-packages/click/core.py", line 610, in invoke
    return callback(*args, **kwargs)
  File "/usr/local/Cellar/name-that-hash/1.1.0/libexec/lib/python3.9/site-packages/name_that_hash/runner.py", line 124, in main
    print(pretty_printer.greppable_output(output))
  File "/usr/local/Cellar/name-that-hash/1.1.0/libexec/lib/python3.9/site-packages/name_that_hash/prettifier.py", line 36, in greppable_output
    outputs_as_dict.update(i[0].hash_obj)
TypeError: 'HashType' object is not subscriptable

Build an automated test matrix across John/Hashcat/name-that-hash

It would be nice to automatically test sample hashes against name-that-hash, and then verify that the same hashes work against both John and Hashcat using the modes we have in our DB.

Similarly, in #59 we discovered that John and Hashcat don't always accept the same formats for what seems to be the same hash type. If any of our regexes in name-that-hash are permissive enough (e.g. optional values) some hashes will not work against both John and Hashcat even though we claim it should. We should break these out to separate hash types in name-that-hash if they do exist.

It would be really nice if there's an existing DB anywhere mapping John modes to Hashcat, but to my knowledge name-that-hash is the only example of it.

We have a few hashes in test_main.py.. but it would be awesome if we could test every hash. Actual code coverage measurements won't work, our DB is a python object, not code. But we should use something similar to ensure every value is tested.

Data

We could add sample hashes to each entry in our hashes DB perhaps? And use them for automated testing?

We should pull in sample hashes from both John and Hashcat and use them for our tests

Hashcat example hashes, this may actually be comprehensive, I'm not sure. But this only includes one hash per mode, if any hashcat modes have any parts of the hash as optional, more than one test is needed per hash
John sample hashes Unlike hashcat, this list is far from comprehensive
John unit tests. I think --test on john might use these, but I can't see any way to print them all automatically. There are individual tests inside each John mode's source file though.
- TODO: see if there's a nice way to automatically extract all these test hashes
- John is GPL2+, we are GPL3. Which means we can pull things from their source.

Automated testing

John's --show=formats allows easily testing what modes it matched against the hashes. We could probably test every mode at the same time?

./john   --show=formats /tmp/hashes.txt
[{"lineNo":1,"ciphertext":"$krb5pa$17$hashcat$HASHCATDOMAIN.COM$a17776abe5383236c58582f515843e029ecbff43706d177651b7b6cdb2713b17597ddb35b1c9c470c281589fd1d51cca125414d19e40e333","rowFormats":[]},
{"lineNo":2,"ciphertext":"$krb5pa$17$user1$EXAMPLE.COM$$c5461873dc13665771b98ba80be53939e906d90ae1ba79cf2e21f0395e50ee56379fbef4d0298cfccfd6cf8f907329120048fd05e8ae5df4","rowFormats":[{"label":"krb5pa-sha1","prepareEqCiphertext":true,"canonHash":["$krb5pa$17$user1$EXAMPLE.COM$EXAMPLE.COMuser1$c5461873dc13665771b98ba80be53939e906d90ae1ba79cf2e21f0395e50ee56379fbef4d0298cfccfd6cf8f907329120048fd05e8ae5df4"]}]}]

Hashcat appears to have nothing similar. Hashcat has no "dry run, parse hashes only" mode that I know of, but it will log something like this if it can't parse a hash. Also, this would likely require running hashcat once per each mode we would want to test, unlike john's --show=formats that would allow testing everything at once.

Hashfile '/tmp/hashes.txt' on line 2 ($krb5p...cfd6cf8f907329120048fd05e8ae5df4): Token length exception

Then of course, test all of them against name-that-hash and see if they are correctly detected. We should also have some kind of coverage to see if we have any hash regexes that never matched any of the test hashes.

Add Argon2 hash

https://en.wikipedia.org/wiki/Argon2

Our wiki for how to do this:
https://github.com/HashPals/Name-That-Hash/wiki/Contributing

Our discord:
http://discord.skerritt.blog

[Feature] please add base58 as well

Add base58 as well to be recognized for hashes. I would like to work on this one.

test

Spelling error

| DEBUG | name_that_hash.prettifier:greppable_output:25 - Grepable output

Write a script to turn DataClass into JSON

Turn all the DataClass's in this file:
https://github.com/HashPals/Name-That-Hash/blob/main/name_that_hash/hashes.py

Into JSON with this format:
https://github.com/psypanda/hashID/blob/master/prototypes.json

Please submit a PR to the repo with your script :)

Make API return popular hashes only

The API currently returns all matched hashes. We should add a mode which would only return popular hashes.

Problem identifying windows xp ntlm hashes

cat cracking4.txt
21259DD63B980471AAD3B435B51404EE:1E43E37B818AB5EDB066EB58CCDC1823
11CB3F697332AE4C4A3B108F3FA6CB6D:13B29964CC2480B4EF454C59562E675C
65711C079DC4CD3CC2265B23734E0DAC:47F747C5190DC0F0B921AA4A07F06285
FBBDA33FC12E83FB0C240E84A183686E:DDE9DC6E34E2E6E11EF9E51C6B27ED96
21C4E7C2EFE8E8D1C00B70065ED76AA7:A7A0F9AFD4A78F531A1CF4C42E531BBF
E85B4B634711A266AAD3B435B51404EE:FD134459FE4D3A6DB4034C4E52403F16
BA756FB317B622DBAAD3B435B51404EE:C8405270B10B13AE8A24612BB853567A
199C926FA387EAB7AAD3B435B51404EE:F196F77BF8BB15781BA8364C649C5FD4
FE4AACAAAD7D986AAAD3B435B51404EE:3928E16F614E2316CA51C336FA5B3011
3613F7EC15407F56AAD3B435B51404EE:C82E164316183AA3AF3EA6BAA642A237

nth -f cracking4.txt
# Truncated for readiblilty 
21259DD63B980471AAD3B435B51404EE:1E43E37B818AB5EDB066EB58CCDC1823

Most Likely
Skype, HC: 23
ZipMonster,
md5(md5(md5($pass))), HC: 3500
md5(uppercase(md5($pass))), HC: 4300

Least Likely
md5(sha1($pass)), HC: 4400  md5($pass.$salt), HC: 10  md5($salt.$pass), HC: 20  md5(unicode($pass).$salt), HC: 30  md5($salt.unicode($pass)), HC: 40  HMAC-MD5 (key = $pass), HC: 50 JtR: hmac-md5 HMAC-MD5
(key = $salt), HC: 60 JtR: hmac-md5 md5(md5($salt).$pass), HC: 3610 Summary: Hashcat mode is only supported in hashcat-legacy. md5($salt.md5($pass)), HC: 3710  md5($pass.md5($salt)), HC: 3720 Summary:
Hashcat mode is only supported in hashcat-legacy. WebEdition CMS, HC: 3721 Summary: Hashcat mode is only supported in hashcat-legacy. md5($username.0.$pass), HC: 4210 Summary: Hashcat mode is only
supported in hashcat-legacy. md5($salt.$pass.$salt), HC: 3800  md5(md5($pass).md5($salt)), HC: 3910  md5($salt.md5($salt.$pass)), HC: 4010  md5($salt.md5($pass.$salt)), HC: 4110  md4($salt.$pass), JtR:
dynamic_31 md4($pass.$salt), JtR: dynamic_32 md5($salt.pad16($pass)), JtR: dynamic_39 Joomla < v2.5.18, HC: 11  SAM(LM_Hash:NT_Hash),  MD5(Chap), HC: 4800 JtR: chap iSCSI CHAP Authentication, HC: 4800
JtR: chap

11CB3F697332AE4C4A3B108F3FA6CB6D:13B29964CC2480B4EF454C59562E675C

Most Likely
Skype, HC: 23
ZipMonster,
md5(md5(md5($pass))), HC: 3500
md5(uppercase(md5($pass))), HC: 4300

Least Likely
md5(sha1($pass)), HC: 4400  md5($pass.$salt), HC: 10  md5($salt.$pass), HC: 20  md5(unicode($pass).$salt), HC: 30  md5($salt.unicode($pass)), HC: 40  HMAC-MD5 (key = $pass), HC: 50 JtR: hmac-md5 HMAC-MD5
(key = $salt), HC: 60 JtR: hmac-md5 md5(md5($salt).$pass), HC: 3610 Summary: Hashcat mode is only supported in hashcat-legacy. md5($salt.md5($pass)), HC: 3710  md5($pass.md5($salt)), HC: 3720 Summary:
Hashcat mode is only supported in hashcat-legacy. WebEdition CMS, HC: 3721 Summary: Hashcat mode is only supported in hashcat-legacy. md5($username.0.$pass), HC: 4210 Summary: Hashcat mode is only
supported in hashcat-legacy. md5($salt.$pass.$salt), HC: 3800  md5(md5($pass).md5($salt)), HC: 3910  md5($salt.md5($salt.$pass)), HC: 4010  md5($salt.md5($pass.$salt)), HC: 4110  md4($salt.$pass), JtR:
dynamic_31 md4($pass.$salt), JtR: dynamic_32 md5($salt.pad16($pass)), JtR: dynamic_39 Joomla < v2.5.18, HC: 11  SAM(LM_Hash:NT_Hash),  MD5(Chap), HC: 4800 JtR: chap iSCSI CHAP Authentication, HC: 4800
JtR: chap

65711C079DC4CD3CC2265B23734E0DAC:47F747C5190DC0F0B921AA4A07F06285

Most Likely
Skype, HC: 23
ZipMonster,
md5(md5(md5($pass))), HC: 3500
md5(uppercase(md5($pass))), HC: 4300

Least Likely
md5(sha1($pass)), HC: 4400  md5($pass.$salt), HC: 10  md5($salt.$pass), HC: 20  md5(unicode($pass).$salt), HC: 30  md5($salt.unicode($pass)), HC: 40  HMAC-MD5 (key = $pass), HC: 50 JtR: hmac-md5 HMAC-MD5
(key = $salt), HC: 60 JtR: hmac-md5 md5(md5($salt).$pass), HC: 3610 Summary: Hashcat mode is only supported in hashcat-legacy. md5($salt.md5($pass)), HC: 3710  md5($pass.md5($salt)), HC: 3720 Summary:
Hashcat mode is only supported in hashcat-legacy. WebEdition CMS, HC: 3721 Summary: Hashcat mode is only supported in hashcat-legacy. md5($username.0.$pass), HC: 4210 Summary: Hashcat mode is only
supported in hashcat-legacy. md5($salt.$pass.$salt), HC: 3800  md5(md5($pass).md5($salt)), HC: 3910  md5($salt.md5($salt.$pass)), HC: 4010  md5($salt.md5($pass.$salt)), HC: 4110  md4($salt.$pass), JtR:
dynamic_31 md4($pass.$salt), JtR: dynamic_32 md5($salt.pad16($pass)), JtR: dynamic_39 Joomla < v2.5.18, HC: 11  SAM(LM_Hash:NT_Hash),  MD5(Chap), HC: 4800 JtR: chap iSCSI CHAP Authentication, HC: 4800
JtR: chap

However, these can be cracked using 1000 mode in hashcat (after truncating the first part of the string with delimiter as :)

Add new hash types

Hello! 👋 This issue is perfect for beginners. What you need:

Regex knowledge (in Python)
Ability to Google 🤓

We provide support in Discord http://discord.skerritt.blog

What we want

Each of these is a hash, and for each hash I want you to:

Create a Regex which matches that hash (try not to be broad, try to make it specific)
Find the John the Ripper mode
Insert it into our Database
Write a test for that hash, see https://github.com/HashPals/Name-That-Hash/blob/main/tests/test_main.py#L13-L17

Example

Our database is located here:
https://github.com/HashPals/Name-That-Hash/blob/main/name_that_hash/hashes.py

Some regex's match multiple hashes, in that case insert them into the list. Otherwise look here:

https://github.com/HashPals/Name-That-Hash/blob/main/name_that_hash/hashes.py#L112-L121

We have our Regex, and a list of hashes:

    Prototype(
        regex=re.compile(r"^[a-f0-9]{32}(:.+)?$", re.IGNORECASE),
        modes=[
            HashInfo(
                name="MD5",
                hashcat=0,
                john="raw-md5",
                extended=False,
                description="Used for Linux Shadow files.",
            ),
),

You do not need to write a description.

Create a prototype with the Regex you created earlier, or find one which already works for the hash.

Take the name of the hash, the hashcat mode, the john the ripper mode you found earlier and insert it into the DB.

The List

Take some hashes from here and do em! <3

Add Kerberos Hashes

We're missing a lot of Kerberos hashes from this page:
https://hashcat.net/wiki/doku.php?id=example_hashes

Ctrl+F "Kerberos".

It's important we add them :)

See https://github.com/HashPals/Name-That-Hash/blob/main/name_that_hash/hashes.py for our DB of hashes.

Greppable & API file input only return first hash

Running NTH with any file input only returns / prints the first one, for example :

a981b9a2fff3d75a6b3b8683c263f993
5f4dcc3b5aa765d61d8327deb882cf99
NWY0ZGNjM2I1YWE3NjVkNjFkODMyN2RlYjg4MmNmOTk=
password

With the API:

Hashes going in --> ['a981b9a2fff3d75a6b3b8683c263f993', '5f4dcc3b5aa765d61d8327deb882cf99', 'NWY0ZGNjM2I1YWE3NjVkNjFkODMyN2RlYjg4MmNmOTk=', 'password']
Hashes coming out --> dict_keys(['a981b9a2fff3d75a6b3b8683c263f993'])

Code:

def create_hash_config(hashes):
    print(f"Hashes going in --> {hashes}")
    # Gets the results from name-that-hash
    logging.debug("Called NTH to get hash types")
    nth_result_types = json.loads(nth.api_return_hashes_as_json(hashes))
    print(f"Hashes coming out --> {nth_result_types.keys()}")
    exit(0)
    return nth_result_types

And for greppable,

jayy@pop-os:~/Documents/Contributing/Search-That-Hash$ nth -f test.txt --greppable
{
  "a981b9a2fff3d75a6b3b8683c263f993": [
    {
      "name": "MD5",
      "hashcat": 0,
      "john": "raw-md5",
      "extended": false,
      "description": "Used for Linux Shadow files."
    },
    {
      "name": "MD4",
      "hashcat": 900,
      "john": "raw-md4",
      "extended": false,
      "description": null
    },
    {
      "name": "NTLM",
      "hashcat": 1000,
      "john": "nt",
      "extended": false,
      "description": "Often used in Windows Active Directory."
    },
    {
      "name": "Double MD5",
      "hashcat": 2600,
      "john": null,
      "extended": false,
      "description": null
    },
    {
      "name": "LM",
      "hashcat": 3000,
      "john": "lm",
      "extended": false,
      "description": null
    },
    {
      "name": "RIPEMD-128",
      "hashcat": null,
      "john": "ripemd-128",
      "extended": false,
      "description": null
    },
    {
      "name": "Haval-128",
      "hashcat": null,
      "john": "haval-128-4",
      "extended": false,
      "description": null
    },
    {
      "name": "Tiger-128",
      "hashcat": null,
      "john": null,
      "extended": false,
      "description": null
    },
    {
      "name": "Skein-256(128)",
      "hashcat": null,
      "john": null,
      "extended": false,
      "description": null
    },
    {
      "name": "Skein-512(128)",
      "hashcat": null,
      "john": null,
      "extended": false,
      "description": null
    },
    {
      "name": "Lotus Notes/Domino 5",
      "hashcat": 8600,
      "john": "lotus5",
      "extended": false,
      "description": null
    },
    {
      "name": "Skype",
      "hashcat": 23,
      "john": null,
      "extended": false,
      "description": null
    },
    {
      "name": "ZipMonster",
      "hashcat": null,
      "john": null,
      "extended": true,
      "description": null
    },
    {
      "name": "PrestaShop",
      "hashcat": 11000,
      "john": null,
      "extended": true,
      "description": null
    },
    {
      "name": "md5(md5(md5($pass)))",
      "hashcat": 3500,
      "john": null,
      "extended": true,
      "description": null
    },
    {
      "name": "md5(uppercase(md5($pass)))",
      "hashcat": 4300,
      "john": null,
      "extended": true,
      "description": null
    },
    {
      "name": "md5(sha1($pass))",
      "hashcat": 4400,
      "john": null,
      "extended": true,
      "description": null
    },
    {
      "name": "md5($pass.$salt)",
      "hashcat": 10,
      "john": null,
      "extended": true,
      "description": null
    },
    {
      "name": "md5($salt.$pass)",
      "hashcat": 20,
      "john": null,
      "extended": true,
      "description": null
    },
    {
      "name": "md5(unicode($pass).$salt)",
      "hashcat": 30,
      "john": null,
      "extended": true,
      "description": null
    },
    {
      "name": "md5($salt.unicode($pass))",
      "hashcat": 40,
      "john": null,
      "extended": true,
      "description": null
    },
    {
      "name": "HMAC-MD5 (key = $pass)",
      "hashcat": 50,
      "john": "hmac-md5",
      "extended": true,
      "description": null
    },
    {
      "name": "HMAC-MD5 (key = $salt)",
      "hashcat": 60,
      "john": "hmac-md5",
      "extended": true,
      "description": null
    },
    {
      "name": "md5(md5($salt).$pass)",
      "hashcat": 3610,
      "john": null,
      "extended": true,
      "description": null
    },
    {
      "name": "md5($salt.md5($pass))",
      "hashcat": 3710,
      "john": null,
      "extended": true,
      "description": null
    },
    {
      "name": "md5($pass.md5($salt))",
      "hashcat": 3720,
      "john": null,
      "extended": true,
      "description": null
    },
    {
      "name": "md5($salt.$pass.$salt)",
      "hashcat": 3810,
      "john": null,
      "extended": true,
      "description": null
    },
    {
      "name": "md5(md5($pass).md5($salt))",
      "hashcat": 3910,
      "john": null,
      "extended": true,
      "description": null
    },
    {
      "name": "md5($salt.md5($salt.$pass))",
      "hashcat": 4010,
      "john": null,
      "extended": true,
      "description": null
    },
    {
      "name": "md5($salt.md5($pass.$salt))",
      "hashcat": 4110,
      "john": null,
      "extended": true,
      "description": null
    },
    {
      "name": "md5($username.0.$pass)",
      "hashcat": 4210,
      "john": null,
      "extended": true,
      "description": null
    },
    {
      "name": "md5(utf16($pass))",
      "hashcat": null,
      "john": "dynamic_29",
      "extended": true,
      "description": null
    },
    {
      "name": "md4($salt.$pass)",
      "hashcat": null,
      "john": "dynamic_31",
      "extended": true,
      "description": null
    },
    {
      "name": "md4($pass.$salt)",
      "hashcat": null,
      "john": "dynamic_32",
      "extended": true,
      "description": null
    },
    {
      "name": "md4(utf16($pass))",
      "hashcat": null,
      "john": "dynamic_33",
      "extended": true,
      "description": null
    },
    {
      "name": "md5(md4($pass))",
      "hashcat": null,
      "john": "dynamic_34",
      "extended": true,
      "description": null
    },
    {
      "name": "net-md5",
      "hashcat": null,
      "john": "dynamic_39",
      "extended": true,
      "description": null
    },
    {
      "name": "md5($salt.pad16($pass))",
      "hashcat": null,
      "john": "dynamic_39",
      "extended": true,
      "description": null
    },
    {
      "name": "MD2",
      "hashcat": null,
      "john": "md2",
      "extended": false,
      "description": null
    },
    {
      "name": "Snefru-128",
      "hashcat": null,
      "john": "snefru-128",
      "extended": false,
      "description": null
    },
    {
      "name": "Domain Cached Credentials",
      "hashcat": 1100,
      "john": "mscach",
      "extended": false,
      "description": null
    },
    {
      "name": "Domain Cached Credentials 2",
      "hashcat": 2100,
      "john": "mscach2",
      "extended": false,
      "description": null
    },
    {
      "name": "DNSSEC(NSEC3)",
      "hashcat": 8300,
      "john": null,
      "extended": false,
      "description": null
    },
    {
      "name": "RAdmin v2.x",
      "hashcat": 9900,
      "john": "radmin",
      "extended": false,
      "description": null
    },
    {
      "name": "Cisco Type 7",
      "hashcat": null,
      "john": null,
      "extended": true,
      "description": null
    },
    {
      "name": "BigCrypt",
      "hashcat": null,
      "john": "bigcrypt",
      "extended": true,
      "description": null
    }
  ]
}

Make an Arch User Repository AUR package

Hey 👋

We're looking for someone to submit this project as an AUR package :D

See:
https://wiki.archlinux.org/index.php/Python_package_guidelines

Logging does not follow best practises

When calling the API, the caller's logging module will be disabled :-(

I don't know how to fix this.

Cant find Kerberos 5 TGS-REP etype 23

My hash is from a Kerberosting session.. it looks like this:

$krb5tgs$23$Administrator$domain$Svc/host.local:$krb5tgs$23$1433$13371337133713371337133713371337$xxxxxxxxx-892chars-after-the-$-xxxxxx

Why cant Name-That-Hash not tell me it is a Kerberos 5 TGS-REP etype 23 ( hashcat number 13100 ) type of hash ?

root@gateway:~/Redteam/4.Hash# name-that-hash --text --no-banner '$krb5tgs$23$Administrator$domain$Svc/host.local:$krb5tgs$23$1433$13371337133713371337133713371337$xxxxxxxxx-$here-is-892-chars-letters-and-numbers'

$krb5tgs$23$Administrator$domain$Svc/host.local:$krb5tgs$23$1433$13371337133713371337133713371337$..REDACTEC..
No hashes found.

[Bug?] Auto-decodes Base64 without being told to via the args

Shorten Hashcat and John in Output

Original format:

MD5, Hashcat Mode: 0, John Name: raw-md5, Summary: Used for Linux Shadow files.

Proposed format:

MD5, HC: 0, JtR: raw-md5, Summary: Used for Linux Shadow files.

Additionally, make each different colors to better differentiate between the two
This will save space in the output.

Add discord & web links

Kind words from haiti project friends

Hi I saw you released Name-That-Hash a few days ago and opened an issue on psypanda/hashID#50.

Congratz 👏🏻 there are some nice features like Popularity Ratings, Hash Summaries, Accessibility and the API + web app.

Just so you know I started a similar project in 2019: https://github.com/noraj/haiti. I coded haiti in ruby and added a few new features and improvements to hashID (see here).

I saw you moved hashID prototypes.json database in pure python (name_that_hash/hashes.py).
I added a few more hashes when I started the project (haiti) so you can diff hashID prototypes.json and mine to see what I added if you want to add them too in NTH.

You can also check the activity on my database because I'm adding new JtR references right now.

It's nice that you made your tool in python 🐍 and me did mine in ruby 💎 as we both made it a library first (before a CLI tool) so as it's not the same language it's helps having a nice lib in different languages.

Let me know if I can help with NTH or if you want to help me add features like Popularity Ratings in haiti. ❤️

Not accessible in Windows CMD

That yellow colour is not accessible at all.

I think this is due to CMD having 256 colours and Rich auto "rounding" it to the nearest value.

Future request: support base64 encoded hashes

Many systems either store hashes as base64 encoded strings, or use it in user-interfaces to prevent data entry errors. Name-That-Hash currently does not recognize a hash that's base64 encoded, instead suggesting an unrelated format (example screenshot). I can think of some scenario's to support this:

when the common hash regexes fail, fall back to a regex for base64 (example). If it matches then decode, then retry the flow using the decoded string. This risks a RAM usage spike when the input string is huge.
add a --base64 or similar flag to let the user manually signal a decode of which the result will then be used in the flow
combine 1. and 2. trying the base64 regex when the others fail, then suggest the --base64 flag to the user

Package Managers Submissions

https://bugs.kali.org/view.php?id=7019 Package here: https://gitlab.com/nth-kali/name-that-hash_kali by @amadejpapez ❤️
https://community.parrotsec.org/t/tool-request-name-that-hash/17617
Macports by @harens
Homebrew by @harens
Arch User Repository

[Easy] Added MS Office <= 2003, Blake2b-512, Telegram Mobile App Passcode

#69 (comment)

^^ That PR already contains the stuff. Make a new PR (or fix the merge conflicts + tests) to contribute && finish this issue :)

Kerberos Fixes

It looks like there are actually a couple different hash formats for Kerberos. Hashcat appears to call this one "Kerberos 5 TGS-REP etype 23".
https://hashcat.net/wiki/doku.php?id=example_hashes

Usually, these regexes are more strictly defined, we avoided .* in the past usually.

I looked at hashcat's source code and figured out how they're parsing this:
https://github.com/hashcat/hashcat/blob/master/src/modules/module_13100.c#L115-L116
(and apparently there's another compatible format $krb5tgs$23$checksum$edata2)

Here's a stricter regex that should match $krb5tgs$23$ hashes with account info.

            r"\$krb5tgs\$23\$\*[^*]*\*\$[a-f0-9]{32}\$[a-f0-9]{64,40960}",

Originally posted by @bburky in #54 (comment)

Have a "likely" section

Alright great. Also, a suggestion for NTH, is that I feel there should be at least another category. It feels jarring to have a few common hashes and then a bunch of "least likely" hashes. I think there should be "Most likely", "Likely", and "Least likely" in my opinion.

@SkeletalDemise

Correct hashing algorithm in "less likely"

$ nth -t "c5a60cc6bbba781c601c5402755ae1044bbf45b78d1183cbf2ca1c865b6c792cf3c6b87791344986c8a832a0f9ca8d0b4afd3d9421a149d57075e1b4e93f90bf"

while hashid (or haiti) are correctly showing the hash as "most likely"

The hash can be cracked with john + rockyou.txt, it was a question in a room on TryHackMe.

Scrape Hashcat website to find out what hashes we are missing

We are missing some hashes from the Hashcat example hashes page:
https://hashcat.net/wiki/doku.php?id=example_hashes

I propose we:

Scrape that page for every Hash-Name
Check to see if Hash-Name is in this file https://github.com/HashPals/Name-That-Hash/blob/main/name_that_hash/hashes.py
If it's not in the file, append it to a new file.

Post the file here so we know what we need to add.

This is issue is suitable for beginners :)

Note: You do not have to create the Regex. Just find out what hashes are not in the database

If you need support, come to the Discord

Debug logs appear in STH from NTH

Reading a sha-512 from a text file fails in Kali Linux

This is the file content:

└─$ cat hash6_8.txt     
9f7376709d3fe09b389a27876834a13c6f275ed9a806d4c8df78f0ce1aad8fb343316133e810096e0999eaf1d2bca37c336e1b7726b213e001333d636e896617
                                                                                                                                                                                                                                              
┌──(kali㉿kali2020)-[~/thm/crackthehash2]
└─$ file hash6_8.txt    
hash6_8.txt: ASCII text

If I try with the hash itself, it works:

┌──(kali㉿kali2020)-[~/thm/crackthehash2]
└─$ nth -t 9f7376709d3fe09b389a27876834a13c6f275ed9a806d4c8df78f0ce1aad8fb343316133e810096e0999eaf1d2bca37c336e1b7726b213e001333d636e896617

  _   _                           _____ _           _          _   _           _     
 | \ | |                         |_   _| |         | |        | | | |         | |    
 |  \| | __ _ _ __ ___   ___ ______| | | |__   __ _| |_ ______| |_| | __ _ ___| |__  
 | . ` |/ _` | '_ ` _ \ / _ \______| | | '_ \ / _` | __|______|  _  |/ _` / __| '_ \ 
 | |\  | (_| | | | | | |  __/      | | | | | | (_| | |_       | | | | (_| \__ \ | | |
 \_| \_/\__,_|_| |_| |_|\___|      \_/ |_| |_|\__,_|\__|      \_| |_/\__,_|___/_| |_|

https://twitter.com/bee_sec_san
https://github.com/HashPals/Name-That-Hash 
    

9f7376709d3fe09b389a27876834a13c6f275ed9a806d4c8df78f0ce1aad8fb343316133e810096e0999eaf1d2bca37c336e1b7726b213e001333d636e896617

Most Likely 
Keccak-512, HC: 1800
Blake2, HC: 600 JtR: raw-blake2 Summary: Used in Wireguard, Zcash, IPFS and more.
Keccak-256, HC: 17800
SHA-512, HC: 1700 JtR: raw-sha512 Summary: Used in Bitcoin Blockchain and Shadow Files.

Least Likely
Whirlpool, HC: 6100 JtR: whirlpool Salsa10, Summary: Not considered a hash function. Salsa20, Summary: Not considered a hash function. SHA3-512, HC: 17600 JtR: raw-sha3 Skein-512, JtR: skein-512 Skein-1024(512),  sha512($pass.$salt), HC: 
1710 sha512($salt.$pass), HC: 1720 sha512(unicode($pass).$salt), HC: 1730 sha512($salt.unicode($pass)), HC: 1740 HMAC-SHA512 (key = $pass), HC: 1750 JtR: hmac-sha512 Keccak-384, HC: 17900 Keccak-224, HC: 17700 HMAC-SHA512 (key = $salt), 
HC: 1760 JtR: hmac-sha512 Cisco Type 7,  BigCrypt, JtR: bigcrypt

But if I try reading the file directly:

┌──(kali㉿kali2020)-[~/thm/crackthehash2]
└─$ nth -f hash6_8.txt                                                                                                                     

  _   _                           _____ _           _          _   _           _     
 | \ | |                         |_   _| |         | |        | | | |         | |    
 |  \| | __ _ _ __ ___   ___ ______| | | |__   __ _| |_ ______| |_| | __ _ ___| |__  
 | . ` |/ _` | '_ ` _ \ / _ \______| | | '_ \ / _` | __|______|  _  |/ _` / __| '_ \ 
 | |\  | (_| | | | | | |  __/      | | | | | | (_| | |_       | | | | (_| \__ \ | | |
 \_| \_/\__,_|_| |_| |_|\___|      \_/ |_| |_|\__,_|\__|      \_| |_/\__,_|___/_| |_|

https://twitter.com/bee_sec_san
https://github.com/HashPals/Name-That-Hash 
    
TypeError. I think your hash input is base64, but you're not using the --base64 flag.

This is the kali version I'm using:

┌──(kali㉿kali2020)-[~/thm/crackthehash2]
└─$ uname -a       
Linux kali2020 5.9.0-kali5-amd64 #1 SMP Debian 5.9.15-1kali1 (2020-12-18) x86_64 GNU/Linux

Add regex search all mode

Given a string such as fjjadjaj{actual hash}daksdoasdo the regex should match.

Currently we use regex to match the exact string. By altering our regexes and the way we search, we can add a mode which matches all parts. of the string.

So for example:

£ nth -t "adadsadasd{hash}lijjiijji"
No type found.

£ nth -t "dasdasda{hash}juthehdh" --hyper
Type MD5

We can do this using re.findall(hash_regex, text).

We should also add an API for this :)

TL;DR

We currently use regex.match for our hash searching.
We should use regex.findall which searches within strings to find all matches.
We should make both a command line argument && an API for this.

todo 0.1.0

HashInfo(name="SHA-512" hashcat=1700 john="RAW-SHA-512" extended=False, description="This is used in the the bitcoin blockchain").
HashInfo(name="SHA-256" Hashcat=1400 John="Raw-SHA256" extended=False description="256-bit key and is a good partner-function for AES")
With NTLM you could add to the description that it uses md4/md5 hashing algos

Fix visual bug

^^ fixed
We support $6$

^^ fixed

Turn hashinfo into dicts instead of classes

Add blake2b-256

Follow documentation :D https://github.com/HashPals/Name-That-Hash/wiki/Contributing

Recommend Projects

React

A declarative, efficient, and flexible JavaScript library for building user interfaces.
Vue.js

🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
Typescript

TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
TensorFlow

An Open Source Machine Learning Framework for Everyone
Django

The Web framework for perfectionists with deadlines.
Laravel

A PHP framework for web artisans
D3

Bring data to life with SVG, Canvas and HTML. 📊📈🎉

Recommend Topics

javascript

JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
web

Some thing interesting about web. New door for the world.
server

A server is a program made to process requests and deliver data to clients.
Machine learning

Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
Visualization

Some thing interesting about visualization, use data art
Game

Some thing interesting about game, make everyone happy.

Recommend Org

Facebook

We are working to build community through open source technology. NB: members must have two-factor auth.
Microsoft

Open source projects and samples from Microsoft.
Google

Google ❤️ Open Source for everyone.
Alibaba

Alibaba Open Source for everyone
D3

Data-Driven Documents codes.
Tencent

China tencent open source team.