|
| 1 | +#!/usr/bin/python |
| 2 | +""" |
| 3 | +Name: HashTag: Parse and Identify Password Hashes |
| 4 | +Version: 0.41 |
| 5 | +Date: 11/05/2013 |
| 6 | +Author: Smeege |
| 7 | +Contact: SmeegeSec@gmail.com |
| 8 | +
|
| 9 | +Description: HashTag.py is a python script written to parse and identify password hashes. It has three main arguments |
| 10 | + which consist of identifying a single hash type (-sh), parsing and identifying multiple hashes from a |
| 11 | + file (-f), and traversing subdirectories to locate files which contain hashes and parse/identify them (-d). |
| 12 | + Many common hash types are supported by the CPU and GPU cracking tool Hashcat. Using an additional |
| 13 | + argument (-hc) hashcat modes will be included in the output file(s). |
| 14 | +
|
| 15 | +Copyright (c) 2013, Smeege Sec (http://www.smeegesec.com) |
| 16 | +All rights reserved. |
| 17 | +Please see the attached LICENSE file for additional licensing information. |
| 18 | +""" |
| 19 | +import string |
| 20 | + |
| 21 | +hashDict = dict() |
| 22 | + |
| 23 | +hashcatDict = { \ |
| 24 | +'MD5': '0', 'md5($pass.$salt)': '10', 'Joomla': '11', 'md5($salt.$pass)': '20', 'osCommerce, xt:Commerce': '21', 'm\ |
| 25 | +d5(unicode($pass).$salt)': '30', 'md5($salt.unicode($pass))': '40', 'HMAC-MD5 (key = $pass)': '50', 'HMAC-MD5 (key\ |
| 26 | += $salt)': '60', 'SHA1': '100', 'nsldap, SHA-1(Base64), Netscape LDAP SHA': '101', 'sha1($pass.$salt)': '110', 'nsl\ |
| 27 | +daps, SSHA-1(Base64), Netscape LDAP SSHA': '111', 'Oracle 11g': '112', 'Oracle 11g, SHA-1(Oracle)': '112', 'sha1($s\ |
| 28 | +alt.$pass)': '120', 'sha1(strtolower($username).$pass), SMF >= v1.1': '121', 'OSX v10.4, v10.5, v10.6': '122', 's\ |
| 29 | +ha1(unicode($pass).$salt)': '130', 'MSSQL(2000)': '131', 'MSSQL(2005)': '132', 'sha1($salt.unicode($pass))': '140',\ |
| 30 | + 'EPiServer 6.x < v4': '141', 'HMAC-SHA1 (key = $pass)': '150', 'HMAC-SHA1 (key = $salt)': '160', 'sha1(LinkedIn)':\ |
| 31 | + '190', 'MySQL': '200', 'MySQL4.1/MySQL5': '300', 'phpass, MD5(Wordpress), MD5(phpBB3)': '400', 'md5crypt, MD5(Unix\ |
| 32 | +), FreeBSD MD5, Cisco-IOS MD5': '500', 'SHA-1(Django)': '800', 'MD4': '900', 'md4($pass.$salt)': '910', 'NTLM': '10\ |
| 33 | +00', 'Domain Cached Credentials, mscash': '1100', 'SHA256': '1400', 'sha256($pass.$salt)': '1410', 'sha256($salt.$p\ |
| 34 | +ass)': '1420', 'sha256(unicode($pass).$salt)': '1430', 'sha256($salt.unicode($pass))': '1440', 'EPiServer 6.x > v4'\ |
| 35 | +: '1441', 'HMAC-SHA256 (key = $pass)': '1450', 'HMAC-SHA256 (key = $salt)': '1460', 'descrypt, DES(Unix), Tradition\ |
| 36 | +al DES': '1500', 'md5apr1, MD5(APR), Apache MD5': '1600', 'SHA512': '1700', 'sha512($pass.$salt)': '1710', 'SSHA-51\ |
| 37 | +2(Base64), LDAP {SSHA512}': '1711', 'sha512($salt.$pass)': '1720', 'OSX v10.7': '1722', 'sha512(unicode($pass).$sal\ |
| 38 | +t)': '1730', 'MSSQL(2012)': '1731', 'sha512($salt.unicode($pass))': '1740', 'HMAC-SHA512 (key = $pass)': '1750', 'H\ |
| 39 | +MAC-SHA512 (key = $salt)': '1760', 'sha512crypt, SHA512(Unix)': '1800', 'Domain Cached Credentials2, mscash2': '210\ |
| 40 | +0', 'Cisco-PIX MD5': '2400', 'WPA/WPA2': '2500', 'Double MD5': '2600', 'md5(md5($pass))': '2600', 'vBulletin < v3.8\ |
| 41 | +.5': '2611', 'vBulletin > v3.8.5': '2711', 'IPB2+, MyBB1.2+': '2811', 'LM': '3000', 'Oracle 7-10g, DES(Oracle)': '3\ |
| 42 | +100', 'bcrypt, Blowfish(OpenBSD)': '3200', 'MD5(Sun)': '3300', 'md5(md5(md5($pass)))': '3500', 'md5(md5($salt).$pas\ |
| 43 | +s)': '3610', 'md5($salt.md5($pass))': '3710', 'md5($pass.md5($salt))': '3720', 'WebEdition CMS': '3721', 'md5($salt\ |
| 44 | +.$pass.$salt)': '3810', 'md5(md5($pass).md5($salt))': '3910', 'md5($salt.md5($salt.$pass))': '4010', 'md5($salt.md5\ |
| 45 | +($pass.$salt))': '4110', 'md5($username.0.$pass)': '4210', 'md5(strtoupper(md5($pass)))': '4300', 'md5(sha1($pass))\ |
| 46 | +': '4400', 'sha1(sha1($pass))': '4500', 'sha1(sha1(sha1($pass)))': '4600', 'sha1(md5($pass))': '4700', 'MD5(Chap)':\ |
| 47 | + '4800', 'SHA-3(Keccak)': '5000', 'Half MD5': '5100', 'Password Safe SHA-256': '5200', 'IKE-PSK MD5': '5300', 'IKE-\ |
| 48 | +PSK SHA1': '5400', 'NetNTLMv1-VANILLA / NetNTLMv1+ESS': '5500', 'NetNTLMv2': '5600', 'Cisco-IOS SHA256': '5700', 'S\ |
| 49 | +amsung Android Password/PIN': '5800', 'RipeMD160': '6000', 'Whirlpool': '6100', 'TrueCrypt 5.0+ PBKDF2-HMAC-RipeMD1\ |
| 50 | +60': '621Y', 'TrueCrypt 5.0+ PBKDF2-HMAC-SHA512': '622Y', 'TrueCrypt 5.0+ PBKDF2-HMAC-Whirlpool': '623Y', 'TrueCryp\ |
| 51 | +t 5.0+ PBKDF2-HMAC-RipeMD160 boot-mode': '624Y', 'TrueCrypt 5.0+': '62XY', 'AIX {smd5}': '6300', 'AIX {ssha256}': '\ |
| 52 | +6400', 'AIX {ssha512}': '6500', '1Password': '6600', 'AIX {ssha1}': '6700', 'Lastpass': '6800', 'GOST R 34.11-94':\ |
| 53 | +'6900', 'Fortigate (FortiOS)': '7000', 'OSX v10.8': '7100', 'GRUB 2': '7200', 'IPMI2 RAKP HMAC-SHA1': '7300', 'sha2\ |
| 54 | +56crypt, SHA256(Unix)': '7400'} |
| 55 | + |
| 56 | + |
| 57 | +# Check whether a string consists of only hexadecimal characters. |
| 58 | +def isHex(singleString): |
| 59 | + for c in singleString: |
| 60 | + if not c in string.hexdigits: return False |
| 61 | + return True |
| 62 | + |
| 63 | + |
| 64 | +# Check whether a string consists of hexadecimal characters or '.' or '/' |
| 65 | +def isAlphaDotSlash(singleString): |
| 66 | + for c in singleString: |
| 67 | + if not c in string.ascii_letters and not c in string.digits and not c in '.' and not c in '/': return False |
| 68 | + return True |
| 69 | + |
| 70 | + |
| 71 | +# Identifies a single hash string based on attributes such as character length, character type (hex, alphanum, etc.), and specific substring identifiers. |
| 72 | +# These conditional statements are ordered specifically to address efficiency when dealing with large inputs |
| 73 | +def identifyHash(singleHash): |
| 74 | + if len(singleHash) == 32 and isHex(singleHash): |
| 75 | + hashDict[singleHash] = ['MD5', 'NTLM', 'MD4', 'LM', 'RAdmin v2.x', 'Haval-128', 'MD2', 'RipeMD-128', 'Tiger-128', 'Snefru-128', 'MD5(HMAC)', 'MD4(HMAC)', 'Haval-128(HMAC)', 'RipeMD-128(HMAC)', 'Tiger-128(HMAC)', \ |
| 76 | + 'Snefru-128(HMAC)', 'MD2(HMAC)', 'MD5(ZipMonster)', 'MD5(HMAC(Wordpress))', 'Skein-256(128)', 'Skein-512(128)', 'md5($pass.$salt)', 'md5($pass.$salt.$pass)', 'md5($pass.md5($pass))', 'md5($salt.$pass)', 'md5($salt.$pass.$salt)', \ |
| 77 | + 'md5($salt.$pass.$username)', 'md5($salt.\'-\'.md5($pass))', 'md5($salt.md5($pass))', 'md5($salt.md5($pass).$salt)', 'md5($salt.MD5($pass).$username)', 'md5($salt.md5($pass.$salt))', 'md5($salt.md5($salt.$pass))', 'md5($salt.md5(md5($pass).$salt))', \ |
| 78 | + 'md5($username.0.$pass)', 'md5($username.LF.$pass)', 'md5($username.md5($pass).$salt)', 'md5(1.$pass.$salt)', 'md5(3 x strtoupper(md5($pass)))', 'md5(md5($pass)), Double MD5', 'md5(md5($pass).$pass)', 'md5(md5($pass).$salt), vBulletin < v3.8.5', 'md4($salt.$pass)', 'md4($pass.$salt)' \ |
| 79 | + 'md5(md5($pass).md5($pass))', 'md5(md5($pass).md5($salt))', 'md5(md5($salt).$pass)', 'md5(md5($salt).md5($pass))', 'md5(md5($username.$pass).$salt)', 'md5(md5(base64_encode($pass)))', 'md5(md5(md5($pass)))', 'md5(md5(md5(md5($pass))))', \ |
| 80 | + 'md5(md5(md5(md5(md5($pass)))))', 'md5(sha1($pass))', 'md5(sha1(base64_encode($pass)))', 'md5(sha1(md5($pass)))', 'md5(sha1(md5($pass)).sha1($pass))', 'md5(sha1(md5(sha1($pass))))', 'md5(strrev($pass))', 'md5(strrev(md5($pass)))', \ |
| 81 | + 'md5(strtoupper(md5($pass)))', 'md5(strtoupper(md5(strtoupper(md5(strtoupper(md5($pass)))))))', 'strrev(md5($pass))', 'strrev(md5(strrev(md5($pass))))', '6 x md5($pass)', '7 x md5($pass)', '8 x md5($pass)', '9 x md5($pass)', '10 x md5($pass)', '11 x md5($pass)', '12 x md5($pass)'] |
| 82 | + elif len(singleHash) > 32 and singleHash[32] == ':' and singleHash.count(':') == 1: |
| 83 | + hashDict[singleHash] = ['md5($salt.$pass.$salt)', 'md5($salt.md5($pass))', 'md5($salt.md5($pass.$salt))', 'md5($salt.md5($salt.$pass))', 'md5($username.0.$pass)', 'md5(md5($pass).md5($salt))', 'md5(md5($salt).$pass)', 'HMAC-MD5 (key = $pass)', 'HMAC-MD5 (key = $salt)', 'md5($pass.md5($salt))', \ |
| 84 | + 'WebEdition CMS', 'IPB2+, MyBB1.2+', 'md5(unicode($pass).$salt)', 'Domain Cached Credentials2, mscash2', 'md5($salt.unicode($pass))', 'vBulletin > v3.8.5', 'DCC2', 'md5(md5($pass).$salt), vBulletin < v3.8.5'] |
| 85 | + elif len(singleHash) == 40: |
| 86 | + hashDict[singleHash] = ['SHA1', 'Tiger-160', 'Haval-160', 'RipeMD160', 'HAS-160', 'SHA-1(HMAC)', 'Tiger-160(HMAC)', 'Haval-160(HMAC)', 'RipeMD-160(HMAC)', 'Skein-256(160)', 'Skein-512(160)', 'sha1(LinkedIn)', 'SAPG', 'SHA-1(MaNGOS)', 'SHA-1(MaNGOS2)', \ |
| 87 | + 'sha1($salt.$pass.$salt)', 'sha1(md5($pass.$salt))', 'sha1(md5($pass).$userdate.$salt)', 'sha1($pass.$username.$salt)', 'sha1(md5($pass).$pass)', 'sha1(md5(sha1($pass)))', 'xsha1(strtolower($pass))', 'sha1($pass.$salt)', 'sha1($salt.$pass)', \ |
| 88 | + 'sha1($salt.$username.$pass.$salt)', 'sha1($salt.md5($pass))', 'sha1($salt.md5($pass).$salt)', 'sha1($salt.sha1($pass))', 'sha1($salt.sha1($salt.sha1($pass)))', 'sha1($username.$pass)', 'sha1($username.$pass.$salt)', 'sha1(md5($pass))', \ |
| 89 | + 'sha1(md5($pass).$salt)', 'sha1(md5(sha1(md5($pass))))', 'sha1(sha1($pass))', 'sha1(sha1($pass).$salt)', 'sha1(sha1($pass).substr($pass,0,3))', 'sha1(sha1($salt.$pass))', 'sha1(sha1(sha1($pass)))', 'sha1(strtolower($username).$pass)'] |
| 90 | + elif len(singleHash) > 40 and singleHash[40] == ':' and singleHash.count(':') == 1: |
| 91 | + hashDict[singleHash] = ['sha1($pass.$salt)', 'HMAC-SHA1 (key = $pass)', 'HMAC-SHA1 (key = $salt)', 'sha1(unicode($pass).$salt)', 'sha1($salt.$pass)', 'sha1($salt.unicode($pass))', 'Samsung Android Password/PIN', 'sha1($salt.$pass.$salt)', 'sha1(md5($pass.$salt))', 'sha1(md5($pass).$userdate.$salt)', 'sha1($pass.$username.$salt)'] |
| 92 | + elif len(singleHash) == 64 and isHex(singleHash): |
| 93 | + hashDict[singleHash] = ['Keccak-256', 'sha256(md5($pass).$pass))', 'Skein-256', 'Skein-512(256)', 'Ventrilo', 'WPA-PSK PMK', 'GOST R 34.11-94', 'Haval-256', 'RipeMD-256', 'SHA256', 'sha256(md5($pass))', 'sha256(sha1($pass))', 'Snefru-256', 'HMAC-SHA256 (key = $salt)', 'SHA-3(Keccak)'] |
| 94 | + elif len(singleHash) > 64 and singleHash[64] == ':' and singleHash.count(':') == 1: |
| 95 | + hashDict[singleHash] = ['sha256(md5($pass.$salt))', 'sha256(md5($salt.$pass))', 'SHA-256(RuneScape)', 'sha256(sha256($pass).$salt)', 'Haval-256(HMAC)', 'RipeMD-256(HMAC)', 'sha256($pass.$salt)', 'sha256($salt.$pass)', 'SHA-256(HMAC)', 'Snefru-256(HMAC)', 'HMAC-SHA256 (key = $pass)', 'sha256(unicode($pass).$salt)', 'sha256($salt.unicode($pass))'] |
| 96 | + elif singleHash.startswith('sha1$'): |
| 97 | + hashDict[singleHash] = ['SHA-1(Django)'] |
| 98 | + elif singleHash.startswith('$H$'): |
| 99 | + hashDict[singleHash] = ['phpass, MD5(Wordpress), MD5(phpBB3)'] |
| 100 | + elif singleHash.startswith('$P$'): |
| 101 | + hashDict[singleHash] = ['phpass, MD5(Wordpress), MD5(phpBB3)'] |
| 102 | + elif singleHash.startswith('$1$'): |
| 103 | + hashDict[singleHash] = ['md5crypt, MD5(Unix), FreeBSD MD5, Cisco-IOS MD5'] |
| 104 | + elif singleHash.startswith('$apr1$'): |
| 105 | + hashDict[singleHash] = ['md5apr1, MD5(APR), Apache MD5'] |
| 106 | + elif singleHash.startswith('sha256$'): |
| 107 | + hashDict[singleHash] = ['SHA-256(Django)'] |
| 108 | + elif singleHash.startswith('$SHA$'): |
| 109 | + hashDict[singleHash] = ['SHA-256(AuthMe)'] |
| 110 | + elif singleHash.startswith('sha256$'): |
| 111 | + hashDict[singleHash] = ['SHA-256(Django)'] |
| 112 | + elif singleHash.startswith('sha384$'): |
| 113 | + hashDict[singleHash] = ['SHA-384(Django)'] |
| 114 | + elif singleHash.startswith('$SHA$'): |
| 115 | + hashDict[singleHash] = ['SHA-256(AuthMe)'] |
| 116 | + elif singleHash.startswith('$2$') or singleHash.startswith('$2a$') or singleHash.startswith('$2y'): |
| 117 | + hashDict[singleHash] = ['bcrypt, Blowfish(OpenBSD)'] |
| 118 | + elif singleHash.startswith('$5$'): |
| 119 | + hashDict[singleHash] = ['sha256crypt, SHA256(Unix)'] |
| 120 | + elif singleHash.startswith('$6$'): |
| 121 | + hashDict[singleHash] = ['sha512crypt, SHA512(Unix)'] |
| 122 | + elif singleHash.startswith('$S$'): |
| 123 | + hashDict[singleHash] = ['SHA-512(Drupal)'] |
| 124 | + elif singleHash.startswith('{SHA}'): |
| 125 | + hashDict[singleHash] = ['nsldap, SHA-1(Base64), Netscape LDAP SHA'] |
| 126 | + elif singleHash.startswith('{SSHA}'): |
| 127 | + hashDict[singleHash] = ['nsldaps, SSHA-1(Base64), Netscape LDAP SSHA'] |
| 128 | + elif singleHash.startswith('{smd5}'): |
| 129 | + hashDict[singleHash] = ['AIX {smd5}'] |
| 130 | + elif singleHash.startswith('{ssha1}'): |
| 131 | + hashDict[singleHash] = ['AIX {ssha1}'] |
| 132 | + elif singleHash.startswith('$md5$'): |
| 133 | + hashDict[singleHash] = ['MD5(Sun)'] |
| 134 | + elif singleHash.startswith('$episerver$*0*'): |
| 135 | + hashDict[singleHash] = ['EPiServer 6.x < v4'] |
| 136 | + elif singleHash.startswith('$episerver$*1*'): |
| 137 | + hashDict[singleHash] = ['EPiServer 6.x > v4'] |
| 138 | + elif singleHash.startswith('{ssha256}'): |
| 139 | + hashDict[singleHash] = ['AIX {ssha256}'] |
| 140 | + elif singleHash.startswith('{SSHA512}'): |
| 141 | + hashDict[singleHash] = ['SSHA-512(Base64), LDAP {SSHA512}'] |
| 142 | + elif singleHash.startswith('{ssha512}'): |
| 143 | + hashDict[singleHash] = ['AIX {ssha512}'] |
| 144 | + elif singleHash.startswith('$ml$'): |
| 145 | + hashDict[singleHash] = ['OSX v10.8'] |
| 146 | + elif singleHash.startswith('grub'): |
| 147 | + hashDict[singleHash] = ['GRUB 2'] |
| 148 | + elif singleHash.startswith('sha256$'): |
| 149 | + hashDict[singleHash] = ['SHA-256(Django)'] |
| 150 | + elif singleHash.startswith('sha384$'): |
| 151 | + hashDict[singleHash] = ['SHA-384(Django)'] |
| 152 | + elif singleHash.startswith('0x'): |
| 153 | + if len(singleHash) == 34: |
| 154 | + hashDict[singleHash] = ['Lineage II C4'] |
| 155 | + elif len(singleHash) < 60: |
| 156 | + hashDict[singleHash] = ['MSSQL(2005)'] |
| 157 | + elif len(singleHash) < 100: |
| 158 | + hashDict[singleHash] = ['MSSQL(2000)'] |
| 159 | + else: |
| 160 | + hashDict[singleHash] = ['MSSQL(2012)'] |
| 161 | + elif singleHash.startswith('S:'): |
| 162 | + hashDict[singleHash] = ['Oracle 11g'] |
| 163 | + elif len(singleHash) > 41 and singleHash.count(':') == 1 and singleHash[-41] == ':' and isHex(singleHash[-40:]): |
| 164 | + hashDict[singleHash] = ['sha1(strtolower($username).$pass), SMF >= v1.1'] |
| 165 | + elif singleHash.count(':') > 1: |
| 166 | + if singleHash.count(':') == 5: |
| 167 | + hashDict[singleHash] = ['NetNTLMv2', 'NetNTLMv1-VANILLA / NetNTLMv1+ESS'] |
| 168 | + elif singleHash.count(':') == 2 and '@' not in singleHash: |
| 169 | + hashDict[singleHash] = ['MD5(Chap)'] |
| 170 | + elif singleHash.count(':') == 3 or singleHash.count(':') == 6: |
| 171 | + hashDict[singleHash] = ['Domain Cached Credentials, mscash'] |
| 172 | + try: |
| 173 | + hashDict[singleHash.split(':')[3]] = 'NTLM' |
| 174 | + if not singleHash.split(':')[2] == 'aad3b435b51404eeaad3b435b51404ee' and not singleHash.split(':')[2] == 'aad3b435b51404eeaad3b435b51404ee'.upper(): |
| 175 | + hashDict[singleHash.split(':')[2]] = 'LM' |
| 176 | + except Exception as e: |
| 177 | + pass |
| 178 | + elif singleHash.count(':') == 2 and '@' in singleHash: |
| 179 | + hashDict[singleHash] = ['Lastpass'] |
| 180 | + elif len(singleHash) == 4: |
| 181 | + hashDict[singleHash] = ['CRC-16', 'CRC-16-CCITT', 'FCS-16'] |
| 182 | + elif len(singleHash) == 8: |
| 183 | + hashDict[singleHash] = ['CRC-32', 'CRC-32B', 'FCS-32', 'ELF-32', 'Fletcher-32', 'FNV-32', 'Adler-32', 'GHash-32-3', 'GHash-32-5'] |
| 184 | + elif len(singleHash) == 13: |
| 185 | + if singleHash.startswith('+'): |
| 186 | + hashDict[singleHash] = ['Blowfish(Eggdrop)'] |
| 187 | + else: |
| 188 | + hashDict[singleHash] = ['descrypt, DES(Unix), Traditional DES'] |
| 189 | + elif len(singleHash) == 16: |
| 190 | + if isHex(singleHash): |
| 191 | + hashDict[singleHash] = ['MySQL, MySQL323', 'Oracle 7-10g, DES(Oracle)', 'CRC-64', 'SAPB', 'substr(md5($pass),0,16)', 'substr(md5($pass),16,16)', 'substr(md5($pass),8,16)'] |
| 192 | + else: |
| 193 | + hashDict[singleHash] = ['Cisco-PIX MD5'] |
| 194 | + elif len(singleHash) > 16 and singleHash[-17] == ':' and singleHash.count(':') == 1: |
| 195 | + hashDict[singleHash] = ['DES(Oracle)', 'Oracle 10g'] |
| 196 | + elif len(singleHash) == 20: |
| 197 | + hashDict[singleHash] = ['substr(md5($pass),12,20)'] |
| 198 | + elif len(singleHash) == 24 and isHex(singleHash): |
| 199 | + hashDict[singleHash] = ['CRC-96(ZIP)'] |
| 200 | + elif len(singleHash) == 35: |
| 201 | + hashDict[singleHash] = ['osCommerce, xt:Commerce'] |
| 202 | + elif len(singleHash) > 40 and singleHash[40] == ':' and singleHash.count(':') == 1: |
| 203 | + hashDict[singleHash] = ['sha1($salt.$pass.$salt)', 'sha1(md5($pass.$salt))'] |
| 204 | + elif len(singleHash) > 40 and singleHash.count('-') == 2 and singleHash.count(':') == 2: |
| 205 | + hashDict[singleHash] = ['sha1(md5($pass).$userdate.$salt)'] |
| 206 | + elif len(singleHash) > 40 and singleHash.count(':') == 2 and len(singleHash.split(':')[1]) == 40 : |
| 207 | + hashDict[singleHash] = ['sha1($pass.$username.$salt)'] |
| 208 | + elif len(singleHash) == 41 and singleHash.startswith('*') and isHex(singleHash[1:40]): |
| 209 | + hashDict[singleHash] = ['MySQL4.1/MySQL5'] |
| 210 | + elif len(singleHash) == 43: |
| 211 | + hashDict[singleHash] = ['Cisco-IOS SHA256'] |
| 212 | + elif len(singleHash) == 47: |
| 213 | + hashDict[singleHash] = ['Fortigate (FortiOS)'] |
| 214 | + elif len(singleHash) == 48 and isHex(singleHash): |
| 215 | + hashDict[singleHash] = ['Oracle 11g, SHA-1(Oracle)', 'Haval-192', 'Haval-192(HMAC)' 'Tiger-192', 'Tiger-192(HMAC)', 'OSX v10.4, v10.5, v10.6'] |
| 216 | + elif len(singleHash) == 51 and isHex(singleHash): |
| 217 | + hashDict[singleHash] = ['MD5(Palshop)', 'Palshop'] |
| 218 | + elif len(singleHash) == 56 and isHex(singleHash): |
| 219 | + hashDict[singleHash] = ['SHA-224', 'Haval-224', 'SHA-224(HMAC)', 'Haval-224(HMAC)', 'Keccak-224', 'Skein-256(224)', 'Skein-512(224)'] |
| 220 | + elif len(singleHash) == 65: |
| 221 | + hashDict[singleHash] = ['Joomla'] |
| 222 | + elif len(singleHash) > 64 and singleHash[64] == ':': |
| 223 | + hashDict[singleHash] = ['SHA-256(PasswordSafe)', 'sha256(md5($salt.$pass))', 'sha256(md5($pass.$salt))', 'SHA-256(HMAC)', 'SHA-256(RuneScape)', 'sha256($salt.$pass)', 'sha256($pass.$salt)', 'Haval-256(HMAC)', 'RipeMD-256(HMAC)', 'Snefru-256(HMAC)', 'sha256(sha256($pass).$salt)'] |
| 224 | + elif len(singleHash) == 80 and isHex(singleHash): |
| 225 | + hashDict[singleHash] = ['RipeMD-320', 'RipeMD-320(HMAC)'] |
| 226 | + elif len(singleHash) == 96 and isHex(singleHash): |
| 227 | + hashDict[singleHash] = ['SHA-384', 'Keccak-384', 'SHA-384(HMAC)', 'sha384($salt.$pass)', 'sha384($pass.$salt)', 'Skein-512(384)', 'Skein-1024(384)'] |
| 228 | + elif len(singleHash) == 128 and isHex(singleHash): |
| 229 | + hashDict[singleHash] = ['Keccak-512', 'Skein-1024(512)', 'Skein-512', 'SHA512', 'sha512($pass.$salt)', 'sha512($salt.$pass)', 'SHA-512(HMAC)', 'Whirlpool', 'Whirlpool(HMAC)', 'sha512(unicode($pass).$salt)', 'sha512($salt.unicode($pass))', 'HMAC-SHA512 (key = $pass)'] |
| 230 | + elif len(singleHash) > 128 and singleHash[128] == ':': |
| 231 | + hashDict[singleHash] = ['HMAC-SHA512 (key = $salt)'] |
| 232 | + elif len(singleHash) == 130 and isHex(singleHash): |
| 233 | + hashDict[singleHash] = ['IPMI2 RAKP HMAC-SHA1'] |
| 234 | + elif len(singleHash) == 136 and isHex(singleHash): |
| 235 | + hashDict[singleHash] = ['OSX v10.7'] |
| 236 | + elif len(singleHash) == 177: |
| 237 | + hashDict[singleHash] = ['Whirlpool(Double)'] |
| 238 | + elif len(singleHash) == 256 and isHex(singleHash): |
| 239 | + hashDict[singleHash] = ['Skein-1024'] |
| 240 | + else: |
| 241 | + hashDict[singleHash] = [] |
| 242 | + |
| 243 | + |
| 244 | +def identify_hash(hash_string): |
| 245 | + identifyHash(hash_string) |
| 246 | + results = [] |
| 247 | + if len(hashDict[hash_string]): |
| 248 | + for value in hashDict[hash_string]: |
| 249 | + results.append(value) |
| 250 | + return results or None |
0 commit comments