[Tut] How to identify the type of hashes [Tut]

[Tut] How to identify the type of hashes [Tut] - Printable Version

+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Blackhat • Red Team • Offensive Security (https://hackforums.net/forumdisplay.php?fid=447)
+---- Forum: Cryptography, Encryption, and Decryption (https://hackforums.net/forumdisplay.php?fid=126)
+---- Thread: [Tut] How to identify the type of hashes [Tut] (/showthread.php?tid=2495136)

Pages: Pages 1 2 3

[Tut] How to identify the type of hashes [Tut] - 0m3r - May 14, 2012

I see alot people here on hf asking what type of this hash is etc etc.. i'll share some things what i know i m not good at decryptying-encoding-etc.. lets start ..

In this tutorial show how to define some basic types of hashes and there examples:

Base64, Megan-35, Feron-74, AER-256, Armon-64, ATOM-128, ESAB-46, EZIP-64, GILA7, OKTO3, Tigo -3FX, Trip-5, ZARA-128, ZONG22, HAZZ-15, MD5 , sha-256(unix) , sha-512(unix)

Base64
Ends with == or = mostly
for example.

Code 
c21hc2hwdW1wa2lucw==

Megan 35
ends with 5
for example.

Code 
mwvXmwXqngvqkw1Vmq55

feron 74
ends with 4
for example.

Code 
CmlxCmxisuliPmygCi44

AER-256
It starts with 2
The second number is never higher than 6
Sequence with a periods and commas etc..
for example.

Code 
2475686.270836455, 2412016.365752809, 33.673757802746564

Armon-64
Usually has a + in the middle
There is a sequence point point point
It starts with 2
Only the numbers except + in the middle
for example.

Code 
25448157090.709496+94249848.213684

ATOM-128
Often contains +
Mainly letters
It starts with the letter
Often ends with CC
for example.

Code 
nIhqLjQ5MiT6Ml63+/CC

ESAB-46
Ends with / /
It contains letters and numbers
for example.

Code 
8mlR8mRg92lg3mVe8g//

EZIP-64
A large sequence of numbers
A common sequence. /. /
It usually starts with a
for example.

Code 
15623.730897750893/14124.447874419286/15213.338713579566/-126.04199709670604

GILA7
It usually ends with the capital letter
It usually ends with the G
It can contain +, =
for example.

Code 
qrF1qr1538F5DrOmq5GG

OKTO3
listing the numbers
for example.

Code 
74806369382479140 

747938510478572200

761035954145620400

696080542373685800

-515497671532164.4

Tigo-3FX
Usually contains =
Mostly end up with 'FXX'
for example.

Code 
7If9=8fpBltnBkHY

TRIPO-5
Mostly ends with 'TT'
It usually contains /
for example.

Code 
Vb9KdExM/zpMWwTT

ZARA-128
It looks like this:

Code 
427 421 409 427 416 424 429 421 424 419 417 422 427

ZONG22
It usually ends with the two
Can keep =, +

Code 
dfNbYvNhoop2

HAZZ-15
It usually ends with the 55
It usually starts with a 'q'
for example.

Code 
qmlGwujeD8JFDoFsEH55

MD5
It contains 32 digits
Includes numbers 1-9 and letters a-f
for example.

Code 
ff1f51cac8e1ad0bf7453e308b237a92

SHA-256(Unix)
has 55 characters in hash
for expamle.

Code 
$5$12345678$5B8vYYiY.CVt1RlTTf8KbXBH3hsxY/GNooZaBBGWEc5

SHA-512(Unix)
has 98 characters in hash
for example.

Code 
$6$FFH2inEE$bDig7qKFq0m3wZY6BahqWjTzmcFma9rAfPPocCvyXKyGqrErw5s1daWDotarbiUk76Sb8NO/ZhJ8WzeM6RW.q0

for decryption use : http://www.crypo.com/
Enjoy if you like it please comment below i would love it

* - binary_strider - May 14, 2012

Shit man.. looks really good..

Bookmarked the page for later use :D

* - 0m3r - May 14, 2012

thank you both of you for appreciating....

* - Kοala - May 14, 2012

Very nice job OP. Very useful guide.

* - Sinofield - May 14, 2012

base64 and half the things on that list aren't hashes. They're encoding schemes. I can decode a base64 message, for example the one in your post is "smashpumpkins". MD5, SHA-256, SHA-512 are hashes. You can't get the original text back unless you bruteforce it. It can't be "decoded".

The real way to figure out what a hash is, is either count the number of bits in the hash, for example, MD5 is usually represented as hex, so count the number of letters in the hash, 32 for MD5, half that, so 16 bytes, and multiply by 8, which gives you 128-bit hash.

http://google.com/search?q=128+bit+hash

And you can see the first result is MD5.

For the UNIX crypt hashes, you just look at what's in the between the first two dollar signs:

$1$
Paul Hennig-Kamp's MD5 scheme.
$2a$
Niels Provos' Blowfish scheme.
$5$
Ulrich Drepper's SHA-256 scheme.
$6$
Ulrich Drepper's SHA-512 scheme.
$apr1$
Identical to $1$.
{SHA}
SHA-1 hash, also used by the Apache Portable Runtime library.
$P$
MD5-based hash used by PHPass
$H$
Same as above, but used by PHPbb because, well, they're PHP developers.
$2x$
"compatibility" option for OpenWall's bcrypt implementation.
$2y$
"force correct algorithm" option for OpenWall's bcrypt implementation.

So $5$12345678$5B8vYYiY.CVt1RlTTf8KbXBH3hsxY/GNooZaBBGWEc5

Is an SHA-256 hash. Note that "regular" SHA-256 hashes look like this:

3f209d3a614607ba72dbcc4f5aee118ca134cce93aba7a87c8c144f1abd03f4

The UNIX crypt hashes are not compatible with the "regular" form, the schemes are different, they're made to be more computationally expensive.

* - Blue_x33 - May 14, 2012

Great thread but there is a Tool for it (idk the name right now because i am on my phone) but it's something like Hash analyzer

* - 0m3r - May 14, 2012

(May 14, 2012 05:46 AM)Sinofield Wrote: base64 and half the things on that list aren't hashes. They're encoding schemes. I can decode a base64 message, for example the one in your post is "smashpumpkins". MD5, SHA-256, SHA-512 are hashes. You can't get the original text back unless you bruteforce it. It can't be "decoded".

The real way to figure out what a hash is, is either count the number of bits in the hash, for example, MD5 is usually represented as hex, so count the number of letters in the hash, 32 for MD5, half that, so 16 bytes, and multiply by 8, which gives you 128-bit hash.
etc etc

i just post the basic which i told you guys in starting of thread and thanx for more information

and thank you to those who like this thread...

* - Kyle FYI™ - May 14, 2012

Its always good to know this shit :)

* - .Pestilence. - May 14, 2012

Thank you for posting this, definitely getting added to my bookmarks.

* - 0m3r - May 14, 2012

thank you boht of you guys :) enjoy

* - PawKy - May 14, 2012

thanks you man! i will learn that soon!

* - kurosakinaruto - May 14, 2012

gr8 stuff man!!
also nice sinofield!!
:D
bookmarked this
:D

* - 0m3r - May 15, 2012

thank you both of you guys i really appreciate your reply's ...

* - Keeper - May 15, 2012

Woo, nice share. Thanks, I actually learnt a few new things!

* - fabiosuper - May 15, 2012

very nice job. it is useful for me thanks