← retour aux outils back to tools

# hashid

Identifiant de type de hachage. Analyse des chaînes de hachage et suggère les algorithmes de hachage les plus probables : utile avant de tenter un cassage pour déterminer le bon mode hashcat/john. Hash type identifier. Analyzes hash strings and suggests the most likely hash algorithms — useful before attempting cracking to determine the correct hashcat/john mode.

↗ https://github.com/psypanda/hashID

## Overview

hashid analyzes hash strings by length and character set to suggest matching hash algorithms. Before cracking a hash, you need to know what algorithm produced it. hashid narrows down the possibilities and maps them to hashcat modes and JtR formats.

## Basic Usage

Identify a single hash

    hashid 5f4dcc3b5aa765d61d8327deb882cf99

Identify multiple hashes from file

    hashid -f hashes.txt

Show hashcat mode numbers

    hashid -m 5f4dcc3b5aa765d61d8327deb882cf99

Show JtR format names

    hashid -j 5f4dcc3b5aa765d61d8327deb882cf99

Show both hashcat and JtR modes

    hashid -mj 5f4dcc3b5aa765d61d8327deb882cf99

## Example Output

    $ hashid -m 5f4dcc3b5aa765d61d8327deb882cf99
    Analyzing '5f4dcc3b5aa765d61d8327deb882cf99'
    [+] MD2
    [+] MD5 [Hashcat Mode: 0]
    [+] MD4 [Hashcat Mode: 900]
    [+] Double MD5 [Hashcat Mode: 2600]
    [+] LM [Hashcat Mode: 3000]
    [+] RIPEMD-128
    [+] Haval-128
    [+] Tiger-128
    [+] Skein-256(128)
    [+] Skein-512(128)
    [+] Lotus Notes/Domino 5 [Hashcat Mode: 8600]
    [+] Skype [Hashcat Mode: 23]
    [+] Snefru-128
    [+] NTLM [Hashcat Mode: 1000]
    [+] Domain Cached Credentials [Hashcat Mode: 1100]

## Common Hash Formats

    MD5           32 hex chars      → hashcat -m 0
    NTLM          32 hex chars      → hashcat -m 1000
    SHA1          40 hex chars      → hashcat -m 100
    SHA256        64 hex chars      → hashcat -m 1400
    SHA512        128 hex chars     → hashcat -m 1700
    bcrypt        $2a$..            → hashcat -m 3200
    WPA2          hc22000 format    → hashcat -m 22000
    NetNTLMv2     NTLMSSPHash       → hashcat -m 5600
    Kerberos 5    $krb5tgs$23$*     → hashcat -m 13100

## Batch Identification

Identify all hashes in a file

    hashid -f hashes.txt -m

Extract unique hash types

    hashid -f hashes.txt -m | grep "Hashcat Mode" | sort -u

Process output for automation

    hashid -m "5f4dcc3b5aa765d61d8327deb882cf99" 2>/dev/null | grep "MD5 \[Hashcat"

## After Identification — Cracking

Crack MD5 hash

    hashcat -m 0 5f4dcc3b5aa765d61d8327deb882cf99 rockyou.txt

Crack NTLM

    hashcat -m 1000 aad3b435b51404eeaad3b435b51404ee:e52cac67419a9a224a3b108f3fa6cb6d rockyou.txt

Crack SHA256

    hashcat -m 1400 hash.txt rockyou.txt

Crack bcrypt (slow, use GPU)

    hashcat -m 3200 '$2a$12$...' rockyou.txt

## Tips

- MD5 and NTLM are both 32-character hex — context determines which (Linux vs Windows)
- NetNTLMv2 hashes (from Responder) use mode 5600, not 1000
- Kerberoast hashes (`$krb5tgs$23$*`) use mode 13100
- When unsure, try the top hashcat mode suggestion and check if it cracks

Help / Man page

    hashid [options] INPUT

    INPUT           Hash string or file with -f
    -f FILE         Read hashes from file
    -m              Show hashcat mode numbers
    -j              Show JtR format names
    -e              Show extended information
    -o FILE         Output to file
    --help          Show help

## Vue d’ensemble

hashid analyse des chaînes de hachage par longueur et jeu de caractères pour suggérer les algorithmes de hachage correspondants. Avant de casser un hachage, il faut savoir quel algorithme l’a produit. hashid réduit les possibilités et les fait correspondre aux modes hashcat et aux formats JtR.

## Utilisation de base

    # Identifier un seul hachage
    hashid 5f4dcc3b5aa765d61d8327deb882cf99

    # Identifier plusieurs hachages depuis un fichier
    hashid -f hashes.txt

    # Afficher les numéros de mode hashcat
    hashid -m 5f4dcc3b5aa765d61d8327deb882cf99

    # Afficher les noms de format JtR
    hashid -j 5f4dcc3b5aa765d61d8327deb882cf99

    # Afficher à la fois les modes hashcat et JtR
    hashid -mj 5f4dcc3b5aa765d61d8327deb882cf99

## Exemple de sortie

    $ hashid -m 5f4dcc3b5aa765d61d8327deb882cf99
    Analyzing '5f4dcc3b5aa765d61d8327deb882cf99'
    [+] MD2
    [+] MD5 [Hashcat Mode: 0]
    [+] MD4 [Hashcat Mode: 900]
    [+] Double MD5 [Hashcat Mode: 2600]
    [+] LM [Hashcat Mode: 3000]
    [+] RIPEMD-128
    [+] Haval-128
    [+] Tiger-128
    [+] Skein-256(128)
    [+] Skein-512(128)
    [+] Lotus Notes/Domino 5 [Hashcat Mode: 8600]
    [+] Skype [Hashcat Mode: 23]
    [+] Snefru-128
    [+] NTLM [Hashcat Mode: 1000]
    [+] Domain Cached Credentials [Hashcat Mode: 1100]

## Formats de hachage courants

    MD5           32 hex chars      → hashcat -m 0
    NTLM          32 hex chars      → hashcat -m 1000
    SHA1          40 hex chars      → hashcat -m 100
    SHA256        64 hex chars      → hashcat -m 1400
    SHA512        128 hex chars     → hashcat -m 1700
    bcrypt        $2a$..            → hashcat -m 3200
    WPA2          hc22000 format    → hashcat -m 22000
    NetNTLMv2     NTLMSSPHash       → hashcat -m 5600
    Kerberos 5    $krb5tgs$23$*     → hashcat -m 13100

## Identification par lot

    # Identifier tous les hachages d'un fichier
    hashid -f hashes.txt -m

    # Extraire les types de hachage uniques
    hashid -f hashes.txt -m | grep "Hashcat Mode" | sort -u

    # Traiter la sortie pour l'automatisation
    hashid -m "5f4dcc3b5aa765d61d8327deb882cf99" 2>/dev/null | grep "MD5 \[Hashcat"

## Après identification : cassage

    # Casser un hachage MD5
    hashcat -m 0 5f4dcc3b5aa765d61d8327deb882cf99 rockyou.txt

    # Casser un NTLM
    hashcat -m 1000 aad3b435b51404eeaad3b435b51404ee:e52cac67419a9a224a3b108f3fa6cb6d rockyou.txt

    # Casser un SHA256
    hashcat -m 1400 hash.txt rockyou.txt

    # Casser un bcrypt (lent, utiliser le GPU)
    hashcat -m 3200 '$2a$12$...' rockyou.txt

## Conseils

- MD5 et NTLM font tous les deux 32 caractères hex : le contexte détermine lequel (Linux vs Windows)
- Les hachages NetNTLMv2 (issus de Responder) utilisent le mode 5600, pas 1000
- Les hachages Kerberoast (`$krb5tgs$23$*`) utilisent le mode 13100
- En cas de doute, essayez la première suggestion de mode hashcat et vérifiez si ça casse

Aide / Page de manuel

    hashid [options] INPUT

    INPUT           Hash string or file with -f
    -f FILE         Read hashes from file
    -m              Show hashcat mode numbers
    -j              Show JtR format names
    -e              Show extended information
    -o FILE         Output to file
    --help          Show help