How to Identify an Unknown Hash

Hash Identifier logoContinuing the theme of hashes lets look at how we can use the “Hash Identifier” tool to determine which algorithm was used to generate a hash.

You can download the tool from here, you’ll also need Python which you can get from here.

Test Hashes:

The plan is to pass the following four hashes through HashID to see how accurate its suggestions are. The test hashes have been generated using four separate algorithms which are revealed in the results.

62163b3694fff97209c48ccc195e04f9e40fff1893fad83275739ba394003dfc
e0734de7a4e8bdb219f3d4935a1c64cc
0ed43e25f742ee0c49d33f9c519fb164ce14866497c3e414c8d95b5ac23525dd54566565bd77f7c3dcf22ad19020092
e209583a1dba302441c9abe5ea6eac6b8
$H$9x8cOSfMfr202yHvWuU/oKdJcBSrLM1

Running Hash Identifier:

Running HashID gives the following prompt:

Hash ID

Let’s paste in the hashes and see what suggestions we get:

-------------------------------------------------------------------------
 HASH: 62163b3694fff97209c48ccc195e04f9e40fff1893fad83275739ba394003dfc

Possible Hashs:
[+] SHA-256
[+] Haval-256
-------------------------------------------------------------------------
HASH: e0734de7a4e8bdb219f3d4935a1c64cc

Possible Hashs:
[+] MD5
[+] Domain Cached Credentials - MD4(MD4(($pass)).(strtolower($username)))
-------------------------------------------------------------------------
HASH: 0ed43e25f742ee0c49d33f9c519fb164ce14866497c3e414c8d95b5ac23525dd54566565b
d77f7c3dcf22ad19020092e209583a1dba302441c9abe5ea6eac6b8

Possible Hashs:
[+] SHA-512
[+] Whirlpool
------------------------------------------------------------------------- 
HASH: $H$9x8cOSfMfr202yHvWuU/oKdJcBSrLM1 

Possible Hashs: 
[+] MD5(phpBB3)

Results:

Hash: 62163b3694fff97209c48ccc195e04f9e40fff1893fad83275739ba394003dfc
HashID Suggestions: SHA-256 or Haval-256
Algoritum Used: SHA-256

Hash: e0734de7a4e8bdb219f3d4935a1c64cc
HashID SuggestionsMD5 or Domain Cached Credentials – MD4(MD4(($pass)).(strtolower($username)))
Algoritum Used: MD5

Hash: 0ed43e25f742ee0c49d33f9c519fb164ce14866497c3e414c8d95b5ac23525dd54566565bd77f7c3dcf22ad19020092
e209583a1dba302441c9abe5ea6eac6b8
HashID Suggestions: SHA-512 or Whirlpool
Algoritum Used: Whirlpool

Hash: $H$9x8cOSfMfr202yHvWuU/oKdJcBSrLM1
HashID Suggestion: MD5(phpBB3)
Algoritum Used: MD5(phpBB3)

As you can see HashID successfully guessed all 4 hashes!

Unfortunately its guesses do get a little more wild when given more exotic hashes but in general it’s a great starting point.

-Cheers

Leave a Reply

Your email address will not be published. Required fields are marked *