← retour aux outils back to tools

# Name-That-Hash

Outil moderne d'identification de type de hash qui détermine ce qu'un hash donné pourrait être et suggère le bon mode hashcat/John pour le casser. Modern hash-type identification tool that identifies what a given hash could be and suggests the right hashcat/John mode to crack it.

↗ https://github.com/HashPals/Name-That-Hash

## Overview

Name-That-Hash (NTH) is an actively maintained, colorful replacement for older hash-identification tools like `hashid`. Given one or more hashes, it returns a ranked list of possible algorithms along with the matching hashcat mode and John the Ripper format, saving the guesswork before kicking off a cracking job.

## Common Usage

Identify a single hash

    nth -t 5f4dcc3b5aa765d61d8327deb882cf99

Identify from a file of hashes, one per line

    nth -f hashes.txt

Only show the most likely candidates

    nth -t <hash> --most-likely

JSON output for scripting/pipelines

    nth -t <hash> --json

Identify and pipe straight into hashcat mode lookup

    nth -t <hash> --hc

## Example Workflow

Grab hashes from a dump, identify them, then crack with the suggested mode

    nth -f dumped_hashes.txt --most-likely

Suppose NTH suggests NTLM (hashcat mode 1000)

    hashcat -m 1000 dumped_hashes.txt /usr/share/wordlists/rockyou.txt

## Options

    -t, --text TEXT     Hash(es) to identify, comma separated
    -f, --file FILE     File containing hashes, one per line
    --most-likely        Only display the most probable hash types
    --json                Output results as JSON
    --hc                  Only show hashcat-compatible modes
    --john                Only show John the Ripper formats
    -g, --greppable       Non-interactive greppable output
    -q, --quiet           Suppress banner

## Tips

- NTH is a heuristic tool — it identifies possible hash types by format/length, not the actual algorithm; always sanity-check against the source (e.g. a Windows SAM dump implies NTLM).
- Use `--json` when chaining into automated cracking pipelines or CTF solve scripts.

Help / Man page

    usage: nth [-h] [-t TEXT] [-f FILE] [--most-likely] [--json] [--hc] [--john]
                [-g] [-q] [--version]

    Name-That-Hash: identify hash types

    optional arguments:
      -h, --help            show this help message and exit
      -t TEXT, --text TEXT  the hash(es) to identify, comma separated
      -f FILE, --file FILE  file containing hashes, one per line
      --most-likely         only show the most likely candidate(s)
      --json                output as JSON
      --hc                  only show hashcat modes
      --john                only show John the Ripper formats
      -g, --greppable       greppable, non-interactive output
      -q, --quiet           don't display the banner
      --version             show program's version number and exit

## Vue d’ensemble

Name-That-Hash (NTH) est un remplaçant activement maintenu et coloré des anciens outils d’identification de hash comme `hashid`. Étant donné un ou plusieurs hashs, il retourne une liste classée d’algorithmes possibles ainsi que le mode hashcat correspondant et le format John the Ripper, évitant les conjectures avant de lancer une tâche de cassage.

## Utilisation courante

    # Identifier un seul hash
    nth -t 5f4dcc3b5aa765d61d8327deb882cf99

    # Identifier depuis un fichier de hashs, un par ligne
    nth -f hashes.txt

    # N'afficher que les candidats les plus probables
    nth -t <hash> --most-likely

    # Sortie JSON pour scripts/pipelines
    nth -t <hash> --json

    # Identifier et enchaîner directement vers la recherche de mode hashcat
    nth -t <hash> --hc

## Exemple de flux de travail

    # Récupérer les hashs d'un dump, les identifier, puis les casser avec le mode suggéré
    nth -f dumped_hashes.txt --most-likely

    # Supposons que NTH suggère NTLM (mode hashcat 1000)
    hashcat -m 1000 dumped_hashes.txt /usr/share/wordlists/rockyou.txt

## Options

    -t, --text TEXT     Hash(es) to identify, comma separated
    -f, --file FILE     File containing hashes, one per line
    --most-likely        Only display the most probable hash types
    --json                Output results as JSON
    --hc                  Only show hashcat-compatible modes
    --john                Only show John the Ripper formats
    -g, --greppable       Non-interactive greppable output
    -q, --quiet           Suppress banner

## Conseils

- NTH est un outil heuristique : il identifie des types de hash possibles par format/longueur, pas l’algorithme réel ; vérifiez toujours par rapport à la source (par exemple un dump SAM Windows implique NTLM).
- Utilisez `--json` lors du chaînage dans des pipelines de cassage automatisés ou des scripts de résolution CTF.

Aide / Page de manuel

    usage: nth [-h] [-t TEXT] [-f FILE] [--most-likely] [--json] [--hc] [--john]
                [-g] [-q] [--version]

    Name-That-Hash: identify hash types

    optional arguments:
      -h, --help            show this help message and exit
      -t TEXT, --text TEXT  the hash(es) to identify, comma separated
      -f FILE, --file FILE  file containing hashes, one per line
      --most-likely         only show the most likely candidate(s)
      --json                output as JSON
      --hc                  only show hashcat modes
      --john                only show John the Ripper formats
      -g, --greppable       greppable, non-interactive output
      -q, --quiet           don't display the banner
      --version             show program's version number and exit