noraj / haiti

:key: Hash type identifier (CLI & lib)

HAITI

HAsh IdenTifIer

What is it?

A CLI tool (and library) to identify hash types (hash type identifier).

CLI

library

Features

• 632+ hash types detected
• Modern algorithms supported (SHA3, Keccak, Blake2, etc.)
• Hashcat and John the Ripper references
• CLI tool & library
• Hackable

Installation

$ gem install haiti-hash

Check the installation page on the documentation to discover more methods (Docker, Debian, openSUSE, etc.).

Documentation

Homepage / Documentation: https://noraj.github.io/haiti/

Comparison

See the reasons why Haiti was created and a detailed comparison with other existing tools on the documentation page.

Author

Made by Alexandre ZANNI (@noraj). Forked from Orange-Cyberdefense/haiti.

haiti's Issues

Mozilla key.db

• Mozilla key3.db
  • https://github.com/openwall/john/blob/a19784d685ea6dde598d3519f641844df47bd211/src/mozilla_ng_fmt_plug.c
  • https://github.com/hashcat/hashcat/blob/master/src/modules/module_26000.c
• Mozilla key4.db https://github.com/hashcat/hashcat/blob/master/src/modules/module_26100.c

fix crc32

• https://github.com/openwall/john/blob/bleeding-jumbo/src/crc32_fmt_plug.c
• https://github.com/hashcat/hashcat/blob/master/src/modules/module_11500.c

Legacy hash types

• https://hashcat.net/wiki/doku.php?id=example_hashes#legacy_hash_types

bcrypt

• bcrypt(md5($pass)) https://github.com/hashcat/hashcat/blob/master/src/modules/module_25600.c
• bcrypt(sha1($pass)) https://github.com/hashcat/hashcat/blob/master/src/modules/module_25800.c

add FortiGate256

• https://github.com/hashcat/hashcat/blob/master/src/modules/module_26300.c
• https://github.com/openwall/john/blob/bleeding-jumbo/src/FG2_fmt_plug.c

Create more engaging README

Inspiration https://github.com/HashPals/Name-That-Hash

fix mysql-sha1

• https://github.com/openwall/john/blob/bleeding-jumbo/src/mysqlSHA1_fmt_plug.c
• https://github.com/hashcat/hashcat/blob/master/src/modules/module_00300.c

Telegram Desktop

• https://github.com/hashcat/hashcat/blob/master/src/modules/module_24500.c
• https://github.com/openwall/john/blob/a19784d685ea6dde598d3519f641844df47bd211/src/telegram_fmt_plug.c

RAR5

• https://github.com/hashcat/hashcat/blob/master/src/modules/module_13000.c
• https://github.com/openwall/john/blob/bleeding-jumbo/src/rar5_fmt_plug.c
• https://github.com/openwall/john/blob/bleeding-jumbo/src/rar5_common.h

OS packages

• ArchLinux AUR https://aur.archlinux.org/packages/haiti
• BlackArch Linux https://github.com/BlackArch/blackarch/blob/master/packages/haiti/PKGBUILD
• FreeBSD https://www.freshports.org/security/rubygem-haiti-hash
• Kali Bug Tracker: ID 0006797 (guide, guide 2)
• Parrot Bug Tracker ID 17290 - ID 24783
• Pentoo pentoo#701
• Homebrew packaging guide -> https://formulae.brew.sh/formula/haiti
• NixOS (packages example, guide)
• openSUSE (guide)
• Fedora (guide)
• Void Linux #37804 (example gem, example gemspec) - VUR #4
• Exegol (list)
• Remux (guide, sls)
• AppImage
• Flatpak (flatpak-builder)
• paketo buildpacks (guide)
• Snap / Snapcraft (guide)
• pkgsrc (guide)
• Ravenports (guide)

Enhance comparison table

• New tool to add to comparison https://github.com/HashPals/Name-That-Hash
• Add creation date
• Add death date ?

add argon2

• https://github.com/openwall/john/blob/bleeding-jumbo/src/argon2_fmt_plug.c

Dahua

• https://github.com/openwall/john/blob/a19784d685ea6dde598d3519f641844df47bd211/src/dahua_fmt_plug.c
• https://github.com/hashcat/hashcat/blob/master/src/modules/module_24900.c

PDF

• https://github.com/hashcat/hashcat/blob/master/src/modules/module_25400.c
• https://github.com/hashcat/hashcat/blob/master/src/modules/module_10500.c

Add samples

• bfegg https://github.com/openwall/john/blob/2431d2562ed799deb9b19812a8a55f39bf2f6d71/src/BFEgg_fmt_plug.c#L46-L56
• DEScrypt
  • https://github.com/openwall/john/blob/bleeding-jumbo/src/DES_fmt.c
  • https://github.com/hashcat/hashcat/blob/master/src/modules/module_01500.c

add BestCrypt

• Jetico BestCrypt v3 Volume Encryption https://github.com/hashcat/hashcat/blob/master/src/modules/module_23900.c
• Jetico BestCrypt Container Encryption (.jbc) https://github.com/openwall/john/blob/8f07e10649bdd298126c608d9fc9c1ee5e9fc6ff/src/bestcrypt_fmt_plug.c

add new hash format

• "office" https://github.com/openwall/john/blob/bleeding-jumbo/src/office_fmt_plug.c
  • add JtR support for Microsoft Office 2007 & 2010
  • add JtR support for Microsoft Office 2019 (same as 2013)
  • add HC support for Microsoft Office 2016 - SheetProtection https://hashcat.net/wiki/doku.php?id=example_hashes
• "oldoffice" https://github.com/openwall/john/blob/bleeding-jumbo/src/oldoffice_fmt_plug.c, https://github.com/openwall/john/blob/bleeding-jumbo/src/oldoffice_common.h
  • add JtR support for Microsoft Office ≤ 2003 (SHA1+RC4)
• Telegram
  • add JtR support for Telegram Desktop 1.3.9 https://github.com/openwall/john/blob/a19784d685ea6dde598d3519f641844df47bd211/src/telegram_fmt_plug.c
  • add JtR support for Telegram Desktop ≥ 2.1.14 beta / 2.2.0
  • add HC support for Telegram Mobile App Passcode (SHA256) https://hashcat.net/wiki/doku.php?id=example_hashes
• Blake2
  • add JtR support for Blake2 hash using $BLAKE2$ format https://github.com/openwall/john/blob/bleeding-jumbo/src/rawBLAKE2_512_fmt_plug.c
  • remove HC support for Blake2 hash using the normal format https://github.com/hashcat/hashcat/blob/master/src/modules/module_00600.c
• PDF https://www.adobe.com/devnet-docs/acrobatetk/tools/DigSigDC/standards.html
  • PDF 1.1 - 1.3 (Acrobat 2 - 4)
    • JtR https://github.com/openwall/john/blob/bleeding-jumbo/src/pdf_fmt_plug.c
    • HC https://github.com/hashcat/hashcat/blob/master/src/modules/module_10400.c
  • PDF 1.1 - 1.3 (Acrobat 2 - 4), collider #1
    • HC https://github.com/hashcat/hashcat/blob/master/src/modules/module_10410.c
  • PDF 1.1 - 1.3 (Acrobat 2 - 4), collider #2
    • HC https://github.com/hashcat/hashcat/blob/master/src/modules/module_10420.c
  • PDF 1.4 - 1.6 (Acrobat 5 - 8)
    • HC https://github.com/hashcat/hashcat/blob/master/src/modules/module_10500.c
  • PDF 1.7 Level 3 (Acrobat 9)
    • HC https://github.com/hashcat/hashcat/blob/master/src/modules/module_10600.c
  • PDF 1.7 Level 8 (Acrobat 10 - 11)
    • HC https://github.com/hashcat/hashcat/blob/master/src/modules/module_10700.c
• 7-zip
  • JtR https://github.com/openwall/john/blob/bleeding-jumbo/src/7z_fmt_plug.c, https://github.com/openwall/john/blob/bleeding-jumbo/src/7z_common_plug.c
  • HC https://github.com/hashcat/hashcat/blob/master/src/modules/module_11600.c
• SecureZIP
  • JtR https://github.com/openwall/john/blob/bleeding-jumbo/src/securezip_fmt_plug.c, https://github.com/openwall/john/blob/bleeding-jumbo/src/securezip_common_plug.c
  • HC
    • SecureZIP AES-128 https://github.com/hashcat/hashcat/blob/master/src/modules/module_23001.c
    • SecureZIP AES-192 https://github.com/hashcat/hashcat/blob/master/src/modules/module_23002.c
    • SecureZIP AES-256 https://github.com/hashcat/hashcat/blob/master/src/modules/module_23003.c
• PKZIP
  • PKZIP Master Key
    • HC https://github.com/hashcat/hashcat/blob/master/src/modules/module_20500.c
  • PKZIP Master Key (6 byte optimization)
    • HC https://github.com/hashcat/hashcat/blob/master/src/modules/module_20510.c
  • PKZIP
    • JtR https://github.com/openwall/john/blob/bleeding-jumbo/src/pkzip_fmt_plug.c

fix DCC JtR hash name

Wrongly displayed as

Domain Cached Credentials [HC: 1100] [JtR: mscach]                                                                                                                                                                                          
Domain Cached Credentials 2 [HC: 2100] [JtR: mscach2]

Replace the c with a s

• https://github.com/openwall/john/blob/a19784d685ea6dde598d3519f641844df47bd211/src/mscash1_fmt_plug.c
• https://github.com/openwall/john/blob/a19784d685ea6dde598d3519f641844df47bd211/src/mscash2_fmt_plug.c

Hexadecimal IP encoder/decoder

Hexadecimal IP encoder/decoder

irb(main):016:0> '0100007F'.scan(/.{2}/).map(&:hex2dec).reverse.join('.')
=> "127.0.0.1"

Often use in network (eg. on linux /proc/net/tcp)

AxCrypt

AxCrypt 1 + 2

• https://github.com/hashcat/hashcat/blob/master/src/modules/module_23500.c
• https://github.com/openwall/john/blob/bleeding-jumbo/src/axcrypt_common.h
• https://github.com/openwall/john/blob/bleeding-jumbo/src/axcrypt_fmt_plug.c
• https://github.com/openwall/john/blob/bleeding-jumbo/src/axcrypt_variable_code.h

complete bsdicrypt

• JtR: https://github.com/openwall/john/blob/bleeding-jumbo/src/BSDI_fmt.c
• HC: https://github.com/hashcat/hashcat/blob/master/src/modules/module_12400.c

fix net-md5

• https://github.com/openwall/john/blob/bleeding-jumbo/src/net_md5_fmt_plug.c

Stuffit5

• https://github.com/hashcat/hashcat/blob/master/src/modules/module_24700.c

KNX IP Secure - Device Authentication Code

• https://github.com/hashcat/hashcat/blob/master/src/modules/module_25900.c

RAR3

RAR3 *

• https://github.com/openwall/john/blob/bleeding-jumbo/src/rar_fmt_plug.c
• https://github.com/openwall/john/blob/bleeding-jumbo/src/rar_common.c

RAR3-p (Uncompressed)

• https://github.com/hashcat/hashcat/blob/master/src/modules/module_23700.c

RAR3-hp

• https://github.com/hashcat/hashcat/blob/master/src/modules/module_12500.c

RAR3-p (Compressed)

• https://github.com/hashcat/hashcat/blob/master/src/modules/module_23800.c

fix HC 3100

• format: https://github.com/hashcat/hashcat/blob/2c48bba62d795ce8db7c1c253f4334ecbe1e61d6/src/modules/module_03100.c#L77-L87
• sample: https://github.com/hashcat/hashcat/blob/2c48bba62d795ce8db7c1c253f4334ecbe1e61d6/src/modules/module_03100.c#L28

add MongoDB

• MongoDB (system / network) https://github.com/openwall/john/blob/a19784d685ea6dde598d3519f641844df47bd211/src/mongodb_fmt_plug.c
• MongoDB SCRAM PBKDF2-SHA1 https://github.com/openwall/john/blob/a19784d685ea6dde598d3519f641844df47bd211/src/mongodb_scram_fmt_plug.c
• MongoDB ServerKey SCRAM-SHA-1 https://github.com/hashcat/hashcat/blob/master/src/modules/module_24100.c
• MongoDB ServerKey SCRAM-SHA-256 https://github.com/hashcat/hashcat/blob/master/src/modules/module_24200.c

fix MSSQL

• https://github.com/openwall/john/blob/bleeding-jumbo/src/mssql12_fmt_plug.c
• https://github.com/hashcat/hashcat/blob/master/src/modules/module_01731.c

OpenEdge Progress Encode

• https://github.com/hashcat/hashcat/blob/master/src/modules/module_26200.c

Resources:

• https://knowledgebase.progress.com/articles/Article/21685
• https://knowledgebase.progress.com/articles/Knowledge/P111508
• https://docs.progress.com/bundle/openedge-abl-reference-117/page/ENCODE-function.html
• https://github.com/pvginkel/ProgressEncode
• https://github.com/pvginkel/ProgressEncode/blob/master/Java/src/test/resources/com/github/pvginkel/progressEncode/TestCases.txt

Sort hashes by popularity

eg. https://github.com/HashPals/Name-That-Hash/blob/main/name_that_hash/hash_info.py

Apple iWork

• https://github.com/hashcat/hashcat/blob/master/src/modules/module_23300.c
• https://github.com/openwall/john/blob/a19784d685ea6dde598d3519f641844df47bd211/src/iwork_common_plug.c
• https://github.com/openwall/john/blob/a19784d685ea6dde598d3519f641844df47bd211/src/iwork_fmt_plug.c

enhance bitcoin

• https://github.com/hashcat/hashcat/blob/master/src/modules/module_11300.c
• https://github.com/openwall/john/blob/bleeding-jumbo/src/bitcoin_fmt_plug.c

DCC: add samples + accept more formats

• https://github.com/openwall/john/blob/a19784d685ea6dde598d3519f641844df47bd211/src/mscash_common_plug.c
• https://github.com/hashcat/hashcat/blob/master/src/modules/module_01100.c
• https://github.com/hashcat/hashcat/blob/master/src/modules/module_02100.c

enhance PKZIP

• PKZIP Master Key https://github.com/hashcat/hashcat/blob/master/src/modules/module_20500.c
• PKZIP Master Key (6 byte optimization) https://github.com/hashcat/hashcat/blob/master/src/modules/module_20510.c

fix AuthMe

• https://github.com/hashcat/hashcat/blob/master/src/modules/module_20711.c

fix Redmine

• https://github.com/hashcat/hashcat/blob/master/src/modules/module_04521.c

sha1($salt.sha1($pass.$salt))

• https://github.com/hashcat/hashcat/blob/master/src/modules/module_24300.c

add Umbraco HMAC-SHA1

• https://github.com/hashcat/hashcat/blob/master/src/modules/module_24800.c

enhance PBKDF2-SHA256

• https://github.com/openwall/john/blob/d718689c853936b38821195fcdd6cfec3045eb1b/src/pbkdf2_hmac_common_plug.c#L546
• https://github.com/hashcat/hashcat/blob/master/src/modules/module_20300.c

add new extended types from JtR

• dynamic_{1..10} f50c0a3
• dynamic_{11..20} 219f011
• dynamic_{21..30} f55e843
• dynamic_{31..40} 641ceec
• dynamic_{80..88} 01093de
• dynamic_{50..58} 112efb8
• dynamic_{60..68} cb8bd3b
• dynamic_{70..78} 3eb0bba
• complete other hashes 2a8cd00
  • RIPEMD-XXX
  • HAVAL-XXX
  • PANAMA
  • SKEIN-XXX
  • SHA3_XXX
  • KECCAK_XXX

https://github.com/openwall/john/blob/ae2371dff05ec4ff1439ffc953146da6b8668c82/src/dynamic_preloads.c#L141
https://github.com/openwall/john/blob/ae2371dff05ec4ff1439ffc953146da6b8668c82/src/dynamic_preloads.c#L1303

MurmurHash

• https://github.com/hashcat/hashcat/blob/master/src/modules/module_25700.c

SQLCipher

• https://github.com/hashcat/hashcat/blob/master/src/modules/module_24600.c

hashcat v6.2.3

• https://github.com/hashcat/hashcat/releases/tag/v6.2.3

• https://github.com/hashcat/hashcat/blob/edab99cdfa11ba8520d10aa0d3d82b00f2e1f88c/docs/changes.txt#L38-L49

• iPhone passcode: https://github.com/hashcat/hashcat/blob/master/src/modules/module_26500.c (3b035e0)

• MetaMask Wallet: https://github.com/hashcat/hashcat/blob/master/src/modules/module_26600.c (e036169)

complete md5

• JtR https://github.com/openwall/john/blob/bleeding-jumbo/src/rawMD5_fmt_plug.c
• HC https://github.com/hashcat/hashcat/blob/master/src/modules/module_00000.c

fix PrestaShop

• https://github.com/hashcat/hashcat/blob/2c48bba62d795ce8db7c1c253f4334ecbe1e61d6/src/modules/module_11000.c#L67-L77

enhance sha1crypt

• https://github.com/openwall/john/blob/bleeding-jumbo/src/sha1crypt_fmt_plug.c
• https://github.com/openwall/john/blob/bleeding-jumbo/src/sha1crypt_common_plug.c
• https://github.com/hashcat/hashcat/blob/master/src/modules/module_15100.c

Microsoft Office 2016 - SheetProtection

• https://github.com/hashcat/hashcat/blob/master/src/modules/module_25300.c

Stargazer Stellar Wallet XLM

• https://github.com/hashcat/hashcat/blob/master/src/modules/module_25500.c

fix RIPEMD

• https://github.com/openwall/john/blob/bleeding-jumbo/src/ripemd_fmt_plug.c
• https://github.com/hashcat/hashcat/blob/master/src/modules/module_06000.c

enhance PBKDF2-SHA1

• https://github.com/openwall/john/blob/bleeding-jumbo/src/pbkdf2-hmac-sha1_fmt_plug.c
• https://github.com/openwall/john/blob/d718689c853936b38821195fcdd6cfec3045eb1b/src/pbkdf2_hmac_common_plug.c#L339
• https://github.com/hashcat/hashcat/blob/master/src/modules/module_20400.c