FAIDDS | Forensic Acquisition Information and Drive Data Script

Forensic Acquisition Information and Drive Data Script

The script provides a simple way to gather drive information and acquire a drive from a specified device file to the local directory. For this script to work you must run it as Administrator.

Use the -d argument to specify the device or file path. Using -lh you can get the list of hashes available. These two options are mutually exclusive.

You can get sample reports in the Sample directory.

Get the Script

You can get the script easily by either downloading the project release, extracting the content and then running the script, alternatively clone the project using Git as shown in the image below.

After you have done so, move to the faidds directory and run the script faidds.py. Follow the example usages stated below for better understanding of how to use the script.

See all the available options

python faids.py --help

usage: faidds.py [-h] [-d DRIVE] [-D] [-c CHUNK] [-s SERIAL] [-m HASHES] [-lh]
             [-dcfldd]

Forensic Acquisition Information and Drive Data Script. This script provides a
simple way to gather drive information and acquire a drive from a specified
device file to the local directory. For this script to work you must run it as
Administrator. Use the -d argument to specify the device or file path. Using
-lh you can get the list of hashes available. These two options are mutually
exclusive.

optional arguments:
  -h, --help            show this help message and exit
  -d DRIVE, --drive DRIVE
                        Device file to acquire. Example: /dev/sda
  -D, --DEBUG           Debug mode will be activated. All the system calls are
                        printed
  -c CHUNK, --chunk CHUNK
                        Size to split file in GB (1024*1024*1024)
  -s SERIAL, --serial SERIAL
                        User specified serial number. Default is to find
                        serial number in drive info.
  -m HASHES, --hashes HASHES
                        List of hash algorithms to use. Comma separated with
                        no spaces. (default: md5)
  -lh, --list_hashes    List all the Hashes
  -dcfldd, --dcfldd     Use dcfldd to acquire image. (default: dc3dd)

Example Usage

Acquire a drive image and gather information

python faids.py -d /dev/sdb1 

Acquire a drive image and get multiple hash results

Write the hashes as Comma separated value.

python faids.py -d /dev/sdb1 -m md5,sha256,sha512

Get list of all available hashes

python faids.py -lh

Available hashes: md5, sha1, sha256, sha384 and sha512

Note

This script was adopted from here. I have refactored it and made it more readable with a better documentation and I plan to add some more new features later.

The code is hackable and you can add many more new features to the script. I hope you liked this post. Share this post, and leave a comment.

Thank you,
Sincerely,
Psycho_Coder.

Continue Reading →

Conduit Search Protect Disinfector Tool

ConduitSPKiller v1.0

Description:

Removes Conduit Search Protect (this is not the same as Conduit Toolbar!)

Important! Backup your files and your registry! I take no responsibility if you loose data, because you forget to create backups.

What is Conduit Search Protect?

Conduit Search Protect comes often bundled with installers of other programs, e.g., PowerISO. It is classified as potentially unwanted program (PUP), meaning, no one with a right mind would actually want that on his/her PC.

Conduit Search Protect sets your browser's default home page, new tab settings and search engine to search.conduit.com or http://www.trovi.com.
It is hard to get rid off and blocks any attempts to change the browser settings back. Other symptoms are unwanted pop-up and in-text advertisements.
Conduit Search Protect infected PCs usually have an icon showing a blue shied with a white magnifying class in your taskbar.

Conduit Search Protect can cause severe problems after using the Conduit Uninstaller, it may even render your system unbootable (see link)

Tested on:

This version was only tested for Windows XP so far.
You can use this script for other operating systems as well, however, it is possible that not all remnants can be removed in that case.

Usage:

• Backup important files
• Backup your registry (e.g. using ERUNT)
• Copy & Paste the source into notepad.
• Save as ConduitSPKiller.bat
• Run.
  

Note: A command window will pop up and close again. This is quite normal. The disinfector will selfdestruct, but leave a log.txt in the current working directory. If you encounter any problems, post that log file.
Some error messages in the log file are normal.

Source:

https://github.com/Doubleendedqueue/DisinfectionScripts/blob/master/conduitspkiller.bat

 

Credits for Code and Article: Deque

Continue Reading →

JCA (Java Cryptography Architecture) | Listing all Security Providers

Duke, the Java Mascot(Photo credit: Wikipedia)

The term "Cryptographic Service Provider" (used interchangeably with "provider" in this document) refers to a package or set of packages that supply a concrete implementation of a subset of the JDK Security API cryptography features. The Provider class is the interface to such a package or set of packages. It has methods for accessing the provider name, version number, and other information.

The above paragraph has been taken from Here

If you want to get the list of the all the JCA Security Providers then you can use the following code, and it also prints the information's and  its version : -

Code :-

Related articles

• Recommended Books to become a Java Hero from Java Zero
• A Brief Introduction to Data Structures
• Read Character Files line by line in Java version 6 or less
• Bag Data Structure Implementation in Java
• Lyrister - Song Lyrics Scrapper
• A Gentle Introduction to TextBlob for NLP

Continue Reading →

Introduction to Public Key Cryptography and RSA Encryption

Cryptographically secure pseudorandom number generator (Photo credit: Wikipedia)

Cryptography

The art of protecting information by transforming it (encrypting it) into an unreadable format, called cipher text. Only those who possess a secret key can decipher (or decrypt) the message into plain text. Encrypted messages can sometimes be broken by cryptanalysis, also called code breaking, although modern cryptography techniques are virtually unbreakable.

Cryptography systems can be broadly classified into:-

1. Symmetric-key Cryptography(or Secret Key Cryptography):-systems that use a single key that both the sender and recipient have.

2. Public-key Cryptography:-systems that use two keys, a public key known to everyone and a private key that only the recipient of messages uses.

3. Hash Functions: Uses a mathematical transformation to irreversibly "encrypt" information

See the Picture below :-

Today I will discuss with you Public Key Cryptography by taking RSA Encryption as an example:-

Public-Key Cryptography(PKC)

Public-key cryptography has been said to be the most significant new development in cryptography.Modern PKC was first described publicly by Stanford University professor Martin Hellman and graduate student Whitfield Diffie in 1976. Their paper described a two-key crypto system in which two parties could engage in a secure communication over a non-secure communications channel without having to share a secret key.

PKC depends upon the existence of so-called one-way functions, or mathematical functions that are easy to compute whereas their inverse function is relatively difficult to compute. Let me give you two simple examples:

Multiplication vs. factorization: Suppose I tell you that I have two prime numbers, 3 and 7, and that I want to calculate the product; it should take almost no time to calculate that value, which is 21. Now suppose, instead, that I tell you that I have a number, 21, and I need you tell me which pair of prime numbers I multiplied together to obtain that number. You will eventually come up with the solution but whereas calculating the product took milliseconds, factoring will take longer. The problem becomes much harder if I start with primes that have 400 digits or so, because the product will have ~800 digits.

Exponentiation vs. logarithms: Suppose I tell you that I want to take the number 3 to the 6th power; again, it is relatively easy to calculate 36 = 729. But if I tell you that I have the number 729 and want you to tell me the two integers that I used, x and y so that logx 729 = y, it will take you longer to find the two values.
While the examples above are trivial, they do represent two of the functional pairs that are used with PKC; namely, the ease of multiplication and exponentiation versus the relative difficulty of factoring and calculating logarithms, respectively. The mathematical "trick" in PKC is to find a trap door in the one-way function so that the inverse calculation becomes easy given knowledge of some item of information.

Generic PKC employs two keys that are mathematically related although knowledge of one key does not allow someone to easily determine the other key. One key is used to encrypt the plaintext and the other key is used to decrypt the ciphertext. The important point here is that it does not matter which key is applied first, but that both keys are required for the process to work (Figure 1B). Because a pair of keys are required, this approach is also called asymmetric cryptography.

In PKC, one of the keys is designated the public key and may be advertised as widely as the owner wants. The other key is designated the private key and is never revealed to another party. It is straight forward to send messages under this scheme. Suppose Alice wants to send Bob a message. Alice encrypts some information using Bob's public key; Bob decrypts the ciphertext using his private key. This method could be also used to prove who sent a message; Alice, for example, could encrypt some plaintext with her private key; when Bob decrypts using Alice's public key, he knows that Alice sent the message and Alice cannot deny having sent the message.

Examples of PKC :-

• RSA
• Diffie-Hellman
• Digital Signature Algorithm(DSA)
• Elliptic Curve Cryptography (ECC)
• ElGamal
  

RSA

The first, and still most common, PKC implementation, named for the three MIT mathematicians who developed it — Ronald Rivest, Adi Shamir, and Leonard Adleman. RSA today is used in hundreds of software products and can be used for key exchange, digital signatures, or encryption of small blocks of data. RSA uses a variable size encryption block and a variable size key. The key-pair is derived from a very large number, n, that is the product of two prime numbers chosen according to special rules; these primes may be 100 or more digits in length each, yielding an n with roughly twice as many digits as the prime factors. The public key information includes n and a derivative of one of the factors of n; an attacker cannot determine the prime factors of n (and, therefore, the private key) from this information alone and that is what makes the RSA algorithm so secure.

Algorithm of RSA:-

To generate the encryption and decryption keys, we can

proceed as follows.

1. Generate randomly two “large” primes 'p' and 'q'.

2. Compute 'n' = pq and 'φ' = (p − 1)*(q − 1).

3. Choose a number 'e' so that gcd(e, φ) = 1.

4. Find the multiplicative inverse of 'e' modulo 'φ', i.e., find d so that
    e*d ≡ 1 (mod φ).

This can be done efficiently using Euclid’s Ex-tended Algorithm.

The encryption public key is KE = (n, e) and the decryption private key is KD = (n, d).

The encryption function is :- E(M ) = M^e mod n.
The decryption function is :- D(M ) = M^d mod n.
These functions satisfy D(E(M )) = M and E(D(M )) = M ,for any 0 ≤ M < n. 

Now Let's take an example which will clear the facts :-

P = 61 <- first prime number (destroy this after computing E and D)
Q = 53 <- second prime number (destroy this after computing E and D)
PQ = 3233 <- modulus (give this to others)
E = 17 <- public exponent (give this to others)
D = 2753 <- private exponent (keep this secret!)


Your public key is (E,PQ).
Your private key is D.
The encryption function is:

encrypt(T) = (T^E) mod PQ = (T^17) mod 3233

The decryption function is:

decrypt(C) = (C^D) mod PQ= (C^2753) mod 3233

To encrypt the plaintext value 123, we do this:

encrypt(123) = (123^17) mod 3233 = 337587917446653715596592958817679803 mod 3233 = 855

To decrypt the ciphertext value 855, we do this:

decrypt(855) = (855^2753) mod 3233= 123

One way to compute the value of 855^2753 mod 3233 is like this:

2753 = 101011000001 base 2,
therefore, 2753 = 1 + 2^6 + 2^7 + 2^9 + 2^11= 1 + 64 + 128 + 512 + 2048
Consider this table of powers of 855:

855^1 = 855 (mod 3233)
855^2 = 367 (mod 3233)
855^4 = 367^2 (mod 3233) = 2136 (mod 3233)
855^8 = 2136^2 (mod 3233) = 733 (mod 3233)
855^16 = 733^2 (mod 3233) = 611 (mod 3233)
855^32 = 611^2 (mod 3233) = 1526 (mod 3233)
855^64 = 1526^2 (mod 3233) = 916 (mod 3233)
855^128 = 916^2 (mod 3233) = 1709 (mod 3233)
855^256 = 1709^2 (mod 3233) = 1282 (mod 3233)
855^512 = 1282^2 (mod 3233) = 1160 (mod 3233)
855^1024 = 1160^2 (mod 3233) = 672 (mod 3233)
855^2048 = 672^2 (mod 3233) = 2197 (mod 3233)

Given the above, we can do like this:

855^2753 (mod 3233)
= 855^(1 + 64 + 128 + 512 + 2048) (mod 3233)
= 855^1 * 855^64 * 855^128 * 855^512 * 855^2048 (mod 3233)
= 855 * 916 * 1709 * 1160 * 2197 (mod 3233)
= 794 * 1709 * 1160 * 2197 (mod 3233)
= 2319 * 1160 * 2197 (mod 3233)
= 184 * 2197 (mod 3233)
= 123 (mod 3233)
= 123


References :

http://www.garykessler.net/library/crypto.html
http://plansoft.org/wp-content/uploads/knowledge/inne/RSA.pdf


Thank You. Hope you like this tutorial. Share it among your friends :)

Related articles

• Lightweight Introduction to Cryptography | Terminology, Security Goals and Cryptographic Attacks
• 80+ Best Free Hacking Tutorials | Resources to Become Pro Hacker
• A Gentle Introduction to TextBlob for NLP
• 5 Most Funny Java Videos on Youtube

Continue Reading →

Create and Split drive image into multiple parts using dd

In my previous tutorial here I showed you how to use "dd" to create an image of a drive, but in this post I will discuss how to create multiple parts of the same drive image. That is split it into multiple parts rather than just a single large file. 

So you might be thinking what is the utility of this ?

Well the main reason being that if want to create an image of a drive or partition whose size is huge then you will have a problem when you load the image using any forensic tool or hex editor for analysing it. Therefore, it is convenient to create multiple parts of the same and then analysing each one of them. In this tutorial I will tell you how to do so.

Like in my previous tutorial on "dd" we will first find out the device path for the partition or physical drive. We can simply do so by using fdisk. Have a look at the following image :-



As you can see we have the flash drive mounted already and the device path being /dev/sdb. Now the command format to create multiple parts of the same image is :- 

sudo dd if=<device-path> | split -b <Split-Size> - <Image-File-Name>.

So an example command would look something like :- 

sudo dd if=/dev/sdb | split -b 1000m - usbflash_image.

if = Input file
<device-path> = /dev/sdb
<Split-Size> = Size of Image Parts (either mb or gb etc.)

What we are doing is we read the data and PIPE it to another command that is split which will split the data and create new file with the file name and numbered in a serialized form like aa, ab, ac etc. What split does here is, it takes read the data and when the size is 1000 megabytes (in the command 1000m) it creates a new file with the file name usbflash_image.aa and the next file being named as usbflash_image.ab and so on. The following image will clear it all :-



If you have read this post where I applied similar technique to copy a Very large file to a flash drive in Linux. So I hope you like this short tutorial and if you have any doubts then please comment.

Have a nice day and Keep Coding and Keep Learning. Keep Sharing the posts.

Thank you,
Sincerely,
Psycho_Coder.

Related articles

• How To Mount and Unmount a drive on Linux
• Using dd to create an image of a Physical Drive
• Using Dban to Securely Wipe data from hard disk
• How To copy a Very large file to a flash drive in Linux
• Example of Path class in Java NIO
• Java Code to read Character File using FileReader.

Continue Reading →

Using dd to create an image of a Physical Drive

Tux, the Linux penguin (Photo credit: Wikipedia)

Hello Guys/Gals

Today I will show you how to use "dd" to create a raw image of a Physical drive on Linux. dd is a tool that comes in built with almost all or many well known Linux diastros. I am on kali Linux and will show you how to use here. Before we proceed make sure that you have mounted your Physical Drive. If not and you don't know then watch my other video and blog post on Mounting a drive.

We will use fdisk to get the device path first. To see the device path we write :- 

sudo fdisk -l

As you can see our device path is "/dev/sdb1", in your case most likely it would be something similar. Now we use the dd tool to create the copy.

The Syntax is :-

sudo dd if=<device-path> of=<file-name>

So the complete command is :- 

sudo dd if=/dev/sdb of=usbflash_image.dd

Now let me explain what is happening. Here if means input file and of means output file. input file is the complete drive storage and we just need to give the device path.

The drawback of dd is that we are not able to see the progress or status as this doesn't updates the image creation progress. Also we are unable to create the md5 or sha1 hashes of the image during the process is running. Later we will use another tool which can do all of these properly.

For more clarity watch the video.

Related articles

• How To Mount and Unmount a drive on Linux
• How To copy a Very large file to a flash drive in Linux
• Using Dban to Securely Wipe data from hard disk
• 100 Best Open Source Security Tools
• Generate Wordlists in Backtrack 5 R3 using Crunch

Continue Reading →

Hash Algorithm Identifier | Identify CryptoHash Types

Hash Algorithm Identifier is a tool which can be used to identify almost all types of hashes. This tool can detect the password hash of various forums like MyBB, phpBB3, Drupal, Joomla, wordpress etc.

I wrote a tutorial earlier on how to identify the different types of hashes and you can see that tutorial here. If you don’t know what a Hash Function is then I recommend you to read about it  here

---

Those who have used Kali Linux for different puposes, they might have come across a tool named hash-identifier and the link to the source of the tool :- https://code.google.com/p/hash-identifier/

But the tool is poorly programmed with a huge if-else-if ladder and method construct and some of them are not correct, exceeding 500+ LOC.

---

Here’s my version of HashIdentifier. (# of lines of code : 210 [With New lines and docstrings])

Screenshot

Installing Required Packages using requirements.txt, Starting HashIdentifier Server on localhost, using the webservice

Using Hash Identifier Web Service

Python Code and Demonstration to Use Hash Identifier Web Service

 

The style and design of the code has been kept same as the original hash-identifier in the Google-code project link given above.

How to Use [Instructions for Linux/Mac users] ?

To use this simply run (The app will start):-

python HashIdentifier.py

To give executable permissions, run :-

 

chmod +x HashIdentifier.py

and then starting it by executing (One’s the executable is made you can start it by typing the following text only):-

 

./HashIdentifier.py

If you don’t understand the steps above then don’t worry. I have included a start.sh [for Linux] and a start.bat [for Windows] files to make your life more easier

To execute the start.sh, type the following in the terminal :-

 

sh start.sh

 

Hash-Algorithm-Identifier Web Service

Hash-Algorithm-Identifier is now on Cloud and provides a web service to use it directly in your apps or so and so. The wrapper for web service is provided asweb.py. The Cloud app service is hosted at http://hashid.badwith.computer/

Usage instructions

./web.py or see --help for more options

 

To use the cloud service send a get (for single hash) or post (for multiple hash) request with the hash appended at the end of the url given above. In case you want the result for multiple hashes then in such cases send the hashes as JSON data.

Javascript

var hash = "3da541559918a808c2402bba5012f6c60b27661c";
 cors_request = new XMLHttpRequest();
 cors_request.onreadystatechange = function() {
 if (cors_request.readyState == 4) {
    console.log(cors_request.responseText);
    }
 }
 cors_request.open("GET", "http://hashid.badwith.computer/" + hash);
 cors_request.send();

Python Sample Example

import requests
hsh = "3da541559918a808c2402bba5012f6c60b27661c"
resp = requests.get("http://hashid.badwith.computer/%s" % hsh)
print(resp.text)

Python Example : Multiple hashes

import json
import requests
hashes = {'hashes': [
 "3da541559918a808c2402bba5012f6c60b27661c",
 "912ec803b2ce49e4a541068d495ab570"
 ]}
resp = requests.post("http://hashid.badwith.computer/", data=json.dumps(hashes))
print(resp.text)

The response is received as JSON data. The Demo usage has been already shown above under the screenshots header..

Thanks to moloch for contributing to the cloud app.

About the Code

As it is evident from the code that I have used regular expressions to identify the hashes. The hashes are being identified because they have certain characteristics and when matched properly they will produce the proper results. Using regular expressions to identify the hash makes the code neat and easy to understand. To understand the regex expressions used in the code, VISIT THIS SITE and paste the Regex Expression in its proper place and thereby you get the explanation. 

Suggestion and feedback are welcome. The tool will be updated with more new features and hashes for identification.

Quick Links

1. Github Project Page : https://github.com/AnimeshShaw/Hash-Algorithm-Identifier
2. Project Wiki : https://github.com/AnimeshShaw/Hash-Algorithm-Identifier/wiki
3. Read Changelog : https://github.com/AnimeshShaw/Hash-Algorithm-Identifier/blob/master/CHANGELOG.md

Thank you,
Sincerely,
Psycho_Coder

Related articles

• 100 Best Open Source Security Tools
• Using Dban to Securely Wipe data from hard disk
• Generate Wordlists in Backtrack 5 R3 using Crunch
• 80+ Best Free Hacking Tutorials | Resources to Become Pro Hacker
• How To Mount and Unmount a drive on Linux
• How To copy a Very large file to a flash drive in Linux

Continue Reading →

Cryptography | Identify Different types of Hashes

Cryptographically secure pseudorandom number generator (Photo credit: Wikipedia)

Hello Everyone,

If you are a hacker or a computer Geek or programmer or a general enthusiast regarding computing then you might have come across the term hash or cryptographic hash functions. Many a times even people call hashes as encryption which is absolutely wrong. This is going to be a short tutorial and we will be dealing with how to identify the various types of hashes that we come across. I hope after reading this tutorial you will have some idea that how to identify hashes.

Reader's Note:-

I assume the following while making this tutorial:-

1. You know basics of cryptography. If you don't then read this.
2. You have some experience with programming (though not required much in this tutorial bit its good to know as they will help you understand better).
3. You know basics of PHP [optional].

Let's Begin

---

Identifying MD5

MD5 hash : It is one of the most common type of hash function and it is used in many sites and is applied in different fields. Used in phpBB v2.x, Joomla version below 1.0.13 and many other forums and CMS.

Reasons for a hash to be MD5

Length: 32 characters.
Description: They are always 32 characters in length (16 Bytes).They are always hexadecimal (Only use characters 0-9 and A-F)
Algorithm: Same as the md5() function in PHP.

Example :- f5d1278e8109edd94e1e4197e04873b9

 

MD5 (UNIX) : Used in Linux and other similar OS.

Length: 34 characters.
Description: The hash begins with the $1$ signature, then there goes the salt (up to 8 random characters; in our example the salt is the string "12345678"), then there goes one more $ character, followed by the actual hash.
Algorithm: Actually that is a loop calling the MD5 algorithm 2000 times.

Example:- $1$12345678$XM4P3PrKBgKNnTaqG9P0T/

 

MD5 (APR) : Used in Linux and other similar OS.

Length: 37 characters.
Description: The hash begins with the $apr1$ signature, then there goes the salt (up to 8 random characters; in our example the salt is the string "12345678"), then there goes one more $ character, followed by the actual hash.
Algorithm: Actually that is a loop calling the MD5 algorithm 2000 times.

Example:- $apr1$12345678$auQSX8Mvzt.tdBi4y6Xgj.

 

MD5 (phpBB3) : Used in phpBB 3.x.x.

Length: 34 characters.
Description: The hash begins with the $H$ signature, then there goes one character (most often the number '9'), then there goes the salt (8 random characters; in our example the salt is the string "12345678"), followed by the actual hash.
Algorithm: Actually that is a loop calling the MD5 algorithm 2048 times.

Example: $H$9123456785DAERgALpsri.D9z3ht120

 

MD5(Wordpress) : Used in Wordpress sites.

Length: 34 characters.
Description: The hash begins with the $P$ signature, then there goes one character (most often the number 'B'), then there goes the salt (8 random characters; in our example the salt is the string "12345678"), followed by the actual hash.
Algorithm: Actually that is a loop calling the MD5 algorithm 8192 times.

Example:- $P$B123456780BhGFYSlUqGyE6ErKErL01

Identifying Salted MD5

Salted MD5 - Used in a large amount of applications to increase hash parity and to increase the time it takes to crack.

General Description : They consist of two blocks connected by a colon, the first is the hash the second is the salt. The first part of the salted hash is hexadecimal, the second is variable case alphanumeric. They first part will always be 32 characters long. The second part can be any length.

md5($pass.$salt) :Used in WB News, Joomla version 1.0.13 and higher.
Length: 16 bytes.

Example:- 6f04f0d75f6870858bae14ac0b6d9f73:1234

 

md5($salt.$pass) : Used in osCommerce, AEF, Gallery and other CMS.
Length: 16 bytes.

Example:- f190ce9ac8445d249747cab7be43f7d5:12

 

md5(md5($pass)) : Used in e107, DLE , AVE, Diferior, Koobi and other CMS.
Length: 16 bytes.

Example:- 28c8edde3d61a0411511d3b1866f0636

 

md5(md5($pass).$salt) :Used in vBulletin, IceBB.
Length: 16 bytes.

Example:- 6011527690eddca23580955c216b1fd2:wQ6

 

md5(md5($salt).md5($pass)) : Used in IPB.
Length: 16 bytes. 

 

Example:- 81f87275dd805aa018df8befe09fe9f8:wH6_S

md5(md5($salt).$pass) : Used in MyBB.
Length: 16 bytes. 

 

Example:- 816a14db44578f516cbaef25bd8d8296:1234

 

md5($salt.$pass.$salt) : Used in TBDev.
Length: 16 bytes.

Example:- a3bc9e11fddf4fef4deea11e33668eab:1234

 

md5($salt.md5($salt.$pass)) : Used in DLP (More info. :- Here).
Length: 16 bytes. 

 

Example:- 1d715e52285e5a6b546e442792652c8a:1234

Identifying SHA

SHA-1 : Used frequently on the internet and is one of a large family of Secure Hash Algorithms.Used in many forums and CMS.
Length: 20 bytes.
Description :They are always 40 Characters in length (160 bits).They are always hexadecimal (Only use characters 0-9 and A-F).
Algorithm: Same as the sha1() function in PHP. 

 

Example: 356a192b7913b04c54574d18c28d46e6395428ab

sha1(strtolower($username).$pass) : Used in SMF.
Length: 20 bytes.

Example:- Admin:6c7ca345f63f835cb353ff15bd6c5e052ec08e7a

 

SHA-256(Unix) : Used in Linux and other similar OS.
Length: 55 characters.
Description: The hash begins with the $5$ signature, then there goes the salt (up to 8 random characters; in our example the salt is the string "12345678"), then there goes one more $ character, followed by the actual hash.
Algorithm: Actually that is a loop calling the SHA-256 algorithm 5000 times.

Example: $5$12345678$jBWLgeYZbSvREnuBr5s3gp13vqiKSNK1rkTk9zYE1v0

SHA-512(Unix) :Used in Linux and other similar OS.
Length: 98 characters.
Description: The hash begins with the $6$ signature, then there goes the salt (up to 8 random characters; in our example the salt is the string "12345678"), then there goes one more $ character, followed by the actual hash.
Algorithm: Actually that is a loop calling the SHA-512 algorithm 5000 times. 

 

Example:- $6$12345678$U6Yv5E1lWn6mEESzKen42o6rbEmFNLlq6Ik9X3reMXY3doKEuxrcDohKUx0Oxf44aeTI​xGEjssvtT1aKyZHjs

Identifying Salted SHA

sha1($salt.sha1($salt.sha1($pass))) : Used in Woltlab BB.
Length: 20 bytes.

Example: cd37bfbf68d198d11d39a67158c0c9cddf34573b:1234

Identifying Other hash types

MySQL < 4.1 : These aren't used very often but still come up on very often because people have no idea what to do with them, they are used in older versions of MySQL.

Length : 16 characters(8 bytes)
Description :They are always hexadecimal (Only use characters 0-9 and A-F).

Example:- 606727496645bcba

MYSQL5 : Used in newer versions of MYSQL to store database user passwords.
Length: 41 characters
Description :They are always capitalized. They always begin with an asterisk .

 

Example:- *C8EB599B8E8EE7BE9F1A5691B7BC9ECCB8DE1C75

DES(Unix) : Used in Linux and other similar OS.
Length: 13 characters.
Description: The first two characters are the salt (random characters; in our example the salt is the string "Iv"), then there follows the actual hash.

Example:- IvS7aeT4NzQPM

Domain Cached Credentials :Used for caching passwords of Windows domain.
Length: 16 bytes.
Algorithm: MD4(MD4(Unicode($pass)).Unicode(strtolower($username)))

Example:- Admin:b474d48cdfc4974d86ef4d24904cdd91

I hope this information is useful to you and I belief that this post will help many others. 

References : Here

Related articles

• Lightweight Introduction to Cryptography | Terminology, Security Goals and Cryptographic Attacks
• 100 Best Open Source Security Tools
• Generate Wordlists in Backtrack 5 R3 using Crunch
• Using Dban to Securely Wipe data from hard disk
• 80+ Best Free Hacking Tutorials | Resources to Become Pro Hacker

Continue Reading →

Crawling Net-Security.org Archive Magazines using Python

English: A candidate icon for Portal:Computer security (Photo credit: Wikipedia)

(IN)SECURE Magazine is a free digital security publication discussing some of the hottest information security topics. I wrote to code to download all the magazines, save then in a folder and then create an archive of the folder. Manually downloading them is boring and I am lazy enough to avoid getting my hands on them. So I wrote a little code which does the work for me. I will be crawling all the mags from this page. For the purpose of crawling I used requests and lxml libraries and so if you're using this code make sure you install these two packages using pip.

Without further adieu, I will give you he code now. 

Working Screenshot

Related articles

• Math Expression Parser in Java
• Visual Stack Application in Java
• 3D Rotating Square with WebGL in Three.js
• PiXMatch - A Picture Matching Game in VB.NET
• Image to ASCII ART converter in Java
• Insertion Sort using Binary Search in Python

Continue Reading →