[TUT] Identifying Hashes

This is how to identify different types of hashes.


















Remember to check for salts! That's it for now, bye bye!

Helpdesk:https://hackforums.net/showthread.php?tid=4642939

(Jan 18, 2015 12:36 PM)Legion. Wrote:  -snip-

I hate the be that guy but some of this is wrong or only partially right. For one, MySQL 5 hashes do start with an asterisk upon generation, but a lot of times that asterisk is stripped off before the hash is passed around or cracked(programs like hashcat do not accept the asterisk when loading). Generally the only way you can tell a MySQL 4.1/5 hash from any other 40 character hash(like SHA-1) is that they are stored in all uppercase so unless someone has toggled case on a 40 character hash, it can be somewhat safe to assume its MySQL 4.1/5 if it's all uppercase.

Also for the MD5(Wordpress), MD5(phpBB3) hashes, they are encoded upon generation so the output actually includes Upper, Lower, Digits(numbers), and symbols(specifically periods "." and forward slashes "/"), not just alpha numeric.

And lastly, only two of the hash types you listed can have separated salts, MD5 and SHA-1. MySQL(all versions) are not salted(to my knownledge). PHPass(Wordpress/phpBB3) have the salt included right after the round number in the hash. The beginning of the hash is the identifier($H$ or $P$), then the round number comes after the second $(usually 9 but it's not decimal so the 9 really represents 11 rounds), then the next 8 characters are the salt. The remainder is the actual hashed password.

MyBB - 8 Character Salt
IPB - 5 Character Salt
vBulletin (Old) - 3 Character Salt
vBulletin (New) - 30 Character Salt

well there are simpler ways to do this that does not involve any manual work :P

there are tools out there that can do all the work for you,
https://hackforums.net/showthread.php?tid=4642896

or if you want a website then,
http://www.dfcode.org/onlinehashidentifier.php

...
Shawn W.

Best way to identify a hash is to just look here.

http://hashcat.net/wiki/doku.php?id=example_hashes

(Jan 18, 2015 02:15 PM)‏Saint Wrote:  Best way to identify a hash is to just look here.

http://hashcat.net/wiki/doku.php?id=example_hashes

Yup, That's one of the most visited pages on my browser :P

EDIT: Checked my visit stats, seems it's no where near as many times as i visited the cryptography section in here. I may need to go outside for a while after seeing those numbers.

(Jan 18, 2015 02:16 PM)chick3nman Wrote:  Yup, That's one of the most visited pages on my browser :P

EDIT: Checked my visit stats, seems it's no where near as many times as i visited the cryptography section in here. I may need to go outside for a while after seeing those numbers.

Oh, lol. Wrote tutorial for nothing. 😭 😏