Sometimes there are hashes that we run across that we don't necessarily know what they got hashed with in terms of the algorithm.
Now there are tidbits and indicators out there of different hash types that we are familiar with based on some of the key identifiers that we've learned about up to this point.
But I want to give you an example here real quick and show you some.
On your Kali desktop there is a file called hash examples and I want you to take close attention to line number one and three.
Line one, I'm going to zoom in for you real quick, you can see is a standard hash of something.
We can't just look at it and know. We can't feel it. It's not communicating to us.
Much like line number three is because we see that dollar sign, two alpha, dollar sign, and et cetera, et cetera.
This looks like it's a form of POSIX based system hashing with bcrypt if I'm off top my memory real quick.
And that's identified based on the two alpha in the beginning and since it has that standard flow of what looks like it's in a shadow file,
we can assume with relative success that this is bcrypt and the salt is 12 and then the rest of it's the actual password.
Well, what about the others? They don't look hashy. They do look hashy, but they don't look like hash that we've identified.
Well, that's where we have a tool called hash identifier inside of Kali.
And you'll find yourself using this more often than not to be able to identify certain hashes.
For example, line number one.
We're going to walk through a couple of examples and then I'm going to show you how I generated my examples for practice.
Now, getting into hash identifier is relatively easy.
Pseudo space hash dash identifier.
And when you start this up, it comes to a prompt that just says hash.
So what now? Well, this one's pretty easy and probably one of the easiest tools that we'll use in the entirety of our PIN 200 course together.
What we want to do is copy one of the hashes from our text file and paste it inside of the hash identifier.
So I'm going to copy here that first line that we didn't really know what it was.
And then I'm going to paste inside of the hash identifier.
And I want to zoom in so you can see that there's nothing up my sleeve here, that there's the hash right, right up there.
And I'm going to click out and press enter.
Now you can see here that there's a lot of different pieces of information, but what we are paying close attention to is this right here.
And you can see that it says possible hashes.
There's two of them that pop up.
Now, is this a hundred percent every time?
No, this is, this is one of those cases of 60% of the time it works every time.
So the possibilities are MD5 or domain cache credentials in MD4 and gives you an example of how it works out.
So, you know, they're kind of in the ballpark of where to start playing this instead of saying, you know what, this is MTLM and I'm going to go attack it.
And it turns out that you spend hours and hours doing absolutely nothing because it's the wrong one.
And why do I say hours and hours?
Well, we've seen in some of the previous skills, the cracking some of these hashes specifically with that MD5 we did.
I think it was the last skill that took 18 hours to do.
And that is a lot of wasted time as a pen tester.
When you could actually start off pretty quick by at least possibly identifying one or two possibilities.
What's right below it is least possible hashes.
And I can tell you from my work as a pen tester and working with hash identifier, the least possible hashes is more accurate.
So at least that way you have an idea of what it's not.
And sometimes we have to learn what something isn't in order to know what it is, if that makes sense.
So you see that all these different ones like MD4, MD2, MD5, HMAC, et cetera, et cetera.
That gives you an idea of where to not test that.
But better safe than sorry and trust but verified.
But this is just one possible way to be able to go through and identify a hash.
But there are times where it can't spit an answer out.
What do you mean? I hear you say it.
Well, that second one that we were looking at right here, I'm going to copy it.
And you notice that it starts with that two alpha.
And like I said, if I remember correctly, that's bcrypt.
I could be wrong. We'll double check here in a second.
I'm going to press enter to start my next line and press paste.
And then inside of there, you can see right there, it's not found.
I wanted to show you this specifically because with a salt involved, it cannot properly identify a hash.
So what does that mean for us?
Well, if you see over here in our text file, you see other hashes there that are just hashed algorithm.
And that gives you an idea of what you can and cannot put in hash identifier.
My experience with hash identifier has been that if it involves a salt, it doesn't work.
But for all the other ones like you see in the rest of our example file.
Guess what? It does work in there.
Now, I've also posted this up inside of the actual skill itself.
Just in case you want to be able to work this on your own, on your own system.
And you don't want to have to hand jam all this stuff in there outside of our lab.
Now, I told you I'd show you where I got these from.
And I wanted to show you this basically full disclosure type thing.
I did go to the AI.
No, I don't like using it because it's a Skynet and Ryzen machines and all that stuff.
Pigeons aren't for you.
But inside of here, you can actually go to things like Gemini, chat, GPT and say, give me some hash examples.
And it not come back and say, unethical computer use.
So inside of here, you can see that it's generating some different examples.
And I wanted to show you one real quick.
And the first one that we have is the MD5.
Well, if I zoom in for you real quick, you can see right here that it gave me not only the example,
but also what it actually means in plain text.
So that way you can kind of tune your trust of hash identifier as you're starting to go through and use it.
I was getting scared there for a second.
And I will show you why.
So I pasted it in there.
And this is what happened.
So as I was pasting it in there, I was one character short in my copy.
And when I press enter, it said not found.
I was like, what?
But I was trying to, and then I was trying to backspace and paste again and all that stuff.
But what you see there right below, right there, I'm going to have it at the top screen up there.
You could see that that's the hash that Gemini gave us.
And right below it, it says possible hashes, MD5.
And if you remember earlier back in this video, guess what?
That was an MD5 hash.
I just wanted to show you that and get it out of the way first, because like I said, as a pen tester, time is money and we are bound by the rules of engagement.
Once that ROE expires, can't really go back to it.
And depending on the NDA that we signed, because some pen tests that I do, all pen tests that I do, I issue an NDA to the organization.
And sometimes I get an NDA back from them.
And inside of that NDA, I've seen examples of not being able to use information pertaining to that organization in future cases or work.
And not being able to continue to work on it past the ROE time expiration, meaning once time has expired, time has expired.
So being able to save time by doing simple things like possibly identify a hash a little bit better for some of the tools we have later on.
Saves a lot of time and effort and can also cut down on the number of systems that you're required to have.
Just in case money and budgeting is an issue and you can't afford all the fancy dancy equipment.
Remember, virtualization is your friend.