psypanda / hashid Goto Github PK
View Code? Open in Web Editor NEWSoftware to identify the different types of hashes -
Home Page: http://psypanda.github.io/hashID
Software to identify the different types of hashes -
Home Page: http://psypanda.github.io/hashID
Instead of forcing people to clone the repository, hashID should be able to be installed using pip
with a single command: pip install hashid
.
Therefore hashID needs to be uploaded to PyPi.
Resource: https://packaging.python.org/en/latest/distributing.html
Add Cisco Type 7 "hash"
Example: 044B0A151C36435C0D
= password
Documentation on the format from PassLib here.
Add PDF hashes (Acrobat 2-11)
The hashes can be extracted from a protected pdf using pdf2john.
hashid doesn't appear to recognise bcrypt however I used an online tool to identify.
The sample below is from the https://tryhackme.com/r/room/dailybugle room and I was able to crack it with John (after sometime) using bcrypt as the format.
Sample: $2y$10$0veO/JSFh4389Lluc4Xya.dfy2MF.bZhz0jVMw.V.d3p12kBtZutm
Can you please add bcrypt to hashid?
Hashcat example hash: {x-issha, 1024}C0624EvGSdAMCtuWnBBYBGA0chvqAflKY74oEpw/rpY=
Hashcat Mode: 10300
Taken from hashcat wiki.
works perfect with single hashes, but I get an error when using the script against a hashfile. errormessage:
Traceback (most recent call last):
File "hashid.py", line 233, in
with open(args.output, "w", encoding="utf-8") as outfile:
TypeError: 'encoding' is an invalid keyword argument for this function
As requested on the hashcat forum hashID should also support the corresponding JohnTheRipper format/mode.
I already added some JTR formats to hashinfo.xlsx but I'm still missing a lot more.
Hello when I try to install this command : sudo install -g 0 -o 0 -m 0644 doc/man/hashid.7 /usr/share/man/man7/
its giving me this message : bash: sudo: command not found
can anyone help me ?
File "./hashID/hashid.py", line 177
HashInfo(name=u'Wordpress ≥ v2.6.2', hashcat=400, john='phpass', extended=False),
^
SyntaxError: invalid syntax
Improvement for your webpage: https://psypanda.github.io/hashID/
Double clicking any command to copy it, copies also the dollar sign, instead of being excluded. This can be fixed easily:
To $ or Not to $: Displaying Terminal Code Snippets
Similar issues
This is the pip which I have installed:
$ sudo pacman -S python-pip
resolving dependencies...
looking for conflicting packages...
Packages (7) python-attrs-22.2.0-3 python-cffi-1.15.1-3 python-cryptography-41.0.2-1 python-ply-3.11-12
python-pycparser-2.21-5 python-wheel-0.40.0-3 python-pip-23.1.2-1
Total Download Size: 4.82 MiB
Total Installed Size: 29.61 MiB
Why do I get this error:
$ pip install hashid
error: externally-managed-environment
× This environment is externally managed
?-> To install Python packages system-wide, try 'pacman -S
python-xyz', where xyz is the package you are trying to
install.
If you wish to install a non-Arch-packaged Python package,
create a virtual environment using 'python -m venv path/to/venv'.
Then use path/to/venv/bin/python and path/to/venv/bin/pip.
If you wish to install a non-Arch packaged Python application,
it may be easiest to use 'pipx install xyz', which will manage a
virtual environment for you. Make sure you have python-pipx
installed via pacman.
note: If you believe this is a mistake, please contact your Python installation or OS distribution provider. You can override this, at the risk of breaking your Python installation or OS, by passing --break-system-packages.
hint: See PEP 668 for the detailed specification.
See indygreg/PyOxidizer#69 for more info about why, but the tl;dr version is __file__
is an optional attribute and should not be relied upon.
After installing hashID via pip and running it using hashid
, I can insert hashes from the clipboard (using CRTL+V).
However if I try this with the following hash, the hash gets cropped (to the first 510 characters) on the command line:
W1t7ImlkIjoiUHJheGlzRELCpygwOjAtMzMwODI0IzAsIDI3NSlfUHJheGlzRELCpygwOjAtMzAwMzk4IzAsIDQyMSkiLCJleElkIjoiUHJheGlzRELCpygwOjAtMzMwODI0IzAsIDI3NSkiLCJuYW1lIjoiVGVybWluZSBmw7xyIE5ldXBhdGllbnRlbiBEci4gUGlvY2giLCJ2aWRlb0FwcG9pbnRtZW50IjpmYWxzZSwiaW5zdGl0dXRpb25JZCI6IjZhMzQwODgwLTU4OGEtNGZlMC1hMDY0LWM5NjIyMmJmOTM5NiIsInBoeXNpY2lhbklkIjoiUHJheGlzRELCpygwOjAtMzAwMzk4IzAsIDQyMSkiLCJwaHlzaWNpYW5FeElkIjoiUHJheGlzRELCpygwOjAtMzAwMzk4IzAsIDQyMSkiLCJwaHlzaWNpYW5OYW1lIjoiRHIuIFBpb2NoIiwicHJvcG9zYWxzUGVySG91ciI6MCwicHJvcGVydGllcyI6e319XSwiMjAyMi0wOC0xMyIsMjkse30sIjIwMjItMDktMTEiLG51bGwsbnVsbCxudWxsXQ==
hashID then returns
Analyzing 'W1t7ImlkIjoiUHJheGlzRELCpygwOjAtMzMwODI0IzAsIDI3NSlfUHJheGlzRELCpygwOjAtMzAwMzk4IzAsIDQyMSkiLCJleElkIjoiUHJheGlzRELCpygwOjAtMzMwODI0IzAsIDI3NSkiLCJuYW1lIjoiVGVybWluZSBmw7xyIE5ldXBhdGllbnRlbiBEci4gUGlvY2giLCJ2aWRlb0FwcG9pbnRtZW50IjpmYWxzZSwiaW5zdGl0dXRpb25JZCI6IjZhMzQwODgwLTU4OGEtNGZlMC1hMDY0LWM5NjIyMmJmOTM5NiIsInBoeXNpY2lhbklkIjoiUHJheGlzRELCpygwOjAtMzAwMzk4IzAsIDQyMSkiLCJwaHlzaWNpYW5FeElkIjoiUHJheGlzRELCpygwOjAtMzAwMzk4IzAsIDQyMSkiLCJwaHlzaWNpYW5OYW1lIjoiRHIuIFBpb2NoIiwicHJvcG9zYWxzUGVySG91ciI6MCwicHJvcG'
[+] Unknown hash
With the hashes from the readme everything works fine.
I found that the string limit for pasted clipboard content seems to be a windows restriction.
Thanks to hashes.com I found that the encryption method seems to be base64.
However using hashID like this, also doesn't find the correct encryption type:
hashid W1t7ImlkIjoiUHJheGlzRELCpygwOjAtMzMwODI0IzAsIDI3NSlfUHJheGlzRELCpygwOjAtMzAwMzk4IzAsIDQyMSkiLCJleElkIjoiUHJheGlzRELCpygwOjAtMzMwODI0IzAsIDI3NSkiLCJuYW1lIjoiVGVybWluZSBmw7xyIE5ldXBhdGllbnRlbiBEci4gUGlvY2giLCJ2aWRlb0FwcG9pbnRtZW50IjpmYWxzZSwiaW5zdGl0dXRpb25JZCI6IjZhMzQwODgwLTU4OGEtNGZlMC1hMDY0LWM5NjIyMmJmOTM5NiIsInBoeXNpY2lhbklkIjoiUHJheGlzRELCpygwOjAtMzAwMzk4IzAsIDQyMSkiLCJwaHlzaWNpYW5FeElkIjoiUHJheGlzRELCpygwOjAtMzAwMzk4IzAsIDQyMSkiLCJwaHlzaWNpYW5OYW1lIjoiRHIuIFBpb2NoIiwicHJvcG9zYWxzUGVySG91ciI6MCwicHJvcGVydGllcyI6e319XSwiMjAyMi0wOC0xMyIsMjkse30sIjIwMjItMDktMTEiLG51bGwsbnVsbCxudWxsXQ==
It seems to look up the correct hash but doesn't find a fitting encryption type:
Analyzing 'W1t7ImlkIjoiUHJheGlzRELCpygwOjAtMzMwODI0IzAsIDI3NSlfUHJheGlzRELCpygwOjAtMzAwMzk4IzAsIDQyMSkiLCJleElkIjoiUHJheGlzRELCpygwOjAtMzMwODI0IzAsIDI3NSkiLCJuYW1lIjoiVGVybWluZSBmw7xyIE5ldXBhdGllbnRlbiBEci4gUGlvY2giLCJ2aWRlb0FwcG9pbnRtZW50IjpmYWxzZSwiaW5zdGl0dXRpb25JZCI6IjZhMzQwODgwLTU4OGEtNGZlMC1hMDY0LWM5NjIyMmJmOTM5NiIsInBoeXNpY2lhbklkIjoiUHJheGlzRELCpygwOjAtMzAwMzk4IzAsIDQyMSkiLCJwaHlzaWNpYW5FeElkIjoiUHJheGlzRELCpygwOjAtMzAwMzk4IzAsIDQyMSkiLCJwaHlzaWNpYW5OYW1lIjoiRHIuIFBpb2NoIiwicHJvcG9zYWxzUGVySG91ciI6MCwicHJvcGVydGllcyI6e319XSwiMjAyMi0wOC0xMyIsMjkse30sIjIwMjItMDktMTEiLG51bGwsbnVsbCxudWxsXQ=='
[+] Unknown hash
Hashcat example hash: ad61d78c06037cd9:2:4:81533218127174468417660201434054
Hashcat Mode: 10100
Taken from hashcat wiki.
Check whether HashTag (https://github.com/SmeegeSec/HashTag/) knows something that hashID doesn't. :)
Hello,
Bcrypt hashes can be prefixed by $2b$
. Source: wikipedia
For example hashes like $2b$10$Ty6z.p2lAZjVZU/wFG3YT.B0R8rTak4YkSEECD2gupfSFKjvQwc16
are not recognized as bcrypt hash by hashid.
Regex can be fixed by adding the b
inside.
Hashcat example hash:
3u+UR6n8AgABAAAAHxxdXKmiOmUoqKnZlf8lTOhlPYy93EAkbPfs5+49YLFd/B1+omSKbW7DoqNM40/EeVnwJ8kYoXv9zy9D5C5m5A==
Hashcat Mode: 501
Taken from hashcat wiki.
Hey!
This repo hasn't been updated since 2015. I've used your database of hashes in a newer hash-identification tool:
https://github.com/HashPals/Name-That-Hash.
I just wanted to say, thank you so much for all the work you've put in over the years. If you ever come back and want to work on Name-That-Hash feel free to 💖
For everyone else I fully intend to maintain my version and continue with this lovely idea!
The new version has some amazing improvements:
And much much more :)
Update: One of the core maintainers of this repo has approved of my fork 🥳 Thank you so much BBurky ❤️
Just a small change to the regex's, where applicable, ala:
Prototype(
regex=re.compile(r'^$1$[a-z0-9/.]{0,8}$[a-z0-9/.]{22}(:.*)?$', re.IGNORECASE),
...note the "(:.*)?" before the EOL terminator? that lets me use raw passwd+shadow files, without any preprocessing.
Add BigCrypt hash
Example: S/8NbAAlzbYO66hAa9XZyWy2
= passphrase
Documentation on the format from PassLib here.
Hashcat example hash:
$cram_md5$PG5vLXJlcGx5QGhhc2hjYXQubmV0Pg==$dXNlciA0NGVhZmQyMmZlNzY2NzBmNmIyODc5MDgxYTdmNWY3MQ==
Hashcat Mode: 10200
Taken from hashcat wiki.
Your tool/software has been inventoried on Rawsec's CyberSecurity Inventory.
https://inventory.rawsec.ml/tools.html#hashID
An inventory of tools and resources about CyberSecurity. This inventory aims to help people to find everything related to CyberSecurity.
More details about features here.
Note: the inventory is a FLOSS (Free, Libre and Open-Source Software) project.
Mainly because this is giving visibility to your tool and improve its referencing.
The badge shows to your community that your are inventoried. It looks good but also shows you care about your project, that your tool is referenced.
Feel free to claim your badge here: http://inventory.rawsec.ml/features.html#badges, it looks like that , but there are several styles available.
If you want to thank us, you can help make our open project better known by tweeting about it! For example:
That's all, this message is just to notify you if you care. Else you can close this issue.
hashID is unable to automatically detect the hash which is a result of the generate_password_hash function in the common werkzeug library \ module used by flask based apps,
As defined here:
https://github.com/pallets/werkzeug/blob/d2625f545f53252314aee0c36818f52a52f7d321/src/werkzeug/security.py#L172
Example result:
In [1]: from werkzeug.security import check_password_hash, generate_password_hash
In [2]: generate_password_hash('demo')
Out[2]: 'pbkdf2:sha256:150000$GeDI5o4S$79f2079efda1d5b3953f062cb14a404a30e9c0458992f44a109a2cad0916b2d7'In [4]: check_password_hash('pbkdf2:sha256:150000$GeDI5o4S$79f2079efda1d5b3953f062cb14a404a30e9c0458992f44a109a2cad0916b2d7','demo')
Out[4]: TrueIn [8]: list(myhash.identifyHash('pbkdf2:sha256:150000$GeDI5o4S$79f2079efda1d5b3953f062cb14a404a30e9c0458992f44a109a2cad0916b2d7'))
Out[8]: []
Note that for the example I used it hash id as an import, but the shell registered command returns same results but more human readable: '[+] Unknown hash'
I have been trying to identify this type of hash for some time, luckily I was able to find the correct function following the app code import stack. app -> flask app builder --> werkzeug/security.py
I came across hashID recommended in various sources (mainly stack overflow questions) but it was unable to help this case..
A declarative, efficient, and flexible JavaScript library for building user interfaces.
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
An Open Source Machine Learning Framework for Everyone
The Web framework for perfectionists with deadlines.
A PHP framework for web artisans
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
Some thing interesting about web. New door for the world.
A server is a program made to process requests and deliver data to clients.
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
Some thing interesting about visualization, use data art
Some thing interesting about game, make everyone happy.
We are working to build community through open source technology. NB: members must have two-factor auth.
Open source projects and samples from Microsoft.
Google ❤️ Open Source for everyone.
Alibaba Open Source for everyone
Data-Driven Documents codes.
China tencent open source team.