retour aux outils back to tools Ducklings

Name-That-Hash

Outil moderne d'identification de type de hash qui détermine ce qu'un hash donné pourrait être et suggère le bon mode hashcat/John pour le casser. Modern hash-type identification tool that identifies what a given hash could be and suggests the right hashcat/John mode to crack it.

↗ https://github.com/HashPals/Name-That-Hash

Overview

Name-That-Hash (NTH) is an actively maintained, colorful replacement for older hash-identification tools like hashid. Given one or more hashes, it returns a ranked list of possible algorithms along with the matching hashcat mode and John the Ripper format, saving the guesswork before kicking off a cracking job.

Common Usage

Identify a single hash

nth -t 5f4dcc3b5aa765d61d8327deb882cf99

Identify from a file of hashes, one per line

nth -f hashes.txt

Only show the most likely candidates

nth -t <hash> --most-likely

JSON output for scripting/pipelines

nth -t <hash> --json

Identify and pipe straight into hashcat mode lookup

nth -t <hash> --hc

Example Workflow

Grab hashes from a dump, identify them, then crack with the suggested mode

nth -f dumped_hashes.txt --most-likely

Suppose NTH suggests NTLM (hashcat mode 1000)

hashcat -m 1000 dumped_hashes.txt /usr/share/wordlists/rockyou.txt

Options

-t, --text TEXT     Hash(es) to identify, comma separated
-f, --file FILE     File containing hashes, one per line
--most-likely        Only display the most probable hash types
--json                Output results as JSON
--hc                  Only show hashcat-compatible modes
--john                Only show John the Ripper formats
-g, --greppable       Non-interactive greppable output
-q, --quiet           Suppress banner

Tips

NTH is a heuristic tool — it identifies possible hash types by format/length, not the actual algorithm; always sanity-check against the source (e.g. a Windows SAM dump implies NTLM).
Use --json when chaining into automated cracking pipelines or CTF solve scripts.

Help / Man page

usage: nth [-h] [-t TEXT] [-f FILE] [--most-likely] [--json] [--hc] [--john]
            [-g] [-q] [--version]

Name-That-Hash: identify hash types

optional arguments:
  -h, --help            show this help message and exit
  -t TEXT, --text TEXT  the hash(es) to identify, comma separated
  -f FILE, --file FILE  file containing hashes, one per line
  --most-likely         only show the most likely candidate(s)
  --json                output as JSON
  --hc                  only show hashcat modes
  --john                only show John the Ripper formats
  -g, --greppable       greppable, non-interactive output
  -q, --quiet           don't display the banner
  --version             show program's version number and exit

Vue d’ensemble

Name-That-Hash (NTH) est un remplaçant activement maintenu et coloré des anciens outils d’identification de hash comme hashid. Étant donné un ou plusieurs hashs, il retourne une liste classée d’algorithmes possibles ainsi que le mode hashcat correspondant et le format John the Ripper, évitant les conjectures avant de lancer une tâche de cassage.

Utilisation courante

# Identifier un seul hash
nth -t 5f4dcc3b5aa765d61d8327deb882cf99

# Identifier depuis un fichier de hashs, un par ligne
nth -f hashes.txt

# N'afficher que les candidats les plus probables
nth -t <hash> --most-likely

# Sortie JSON pour scripts/pipelines
nth -t <hash> --json

# Identifier et enchaîner directement vers la recherche de mode hashcat
nth -t <hash> --hc

Exemple de flux de travail

# Récupérer les hashs d'un dump, les identifier, puis les casser avec le mode suggéré
nth -f dumped_hashes.txt --most-likely

# Supposons que NTH suggère NTLM (mode hashcat 1000)
hashcat -m 1000 dumped_hashes.txt /usr/share/wordlists/rockyou.txt

Options

-t, --text TEXT     Hash(es) to identify, comma separated
-f, --file FILE     File containing hashes, one per line
--most-likely        Only display the most probable hash types
--json                Output results as JSON
--hc                  Only show hashcat-compatible modes
--john                Only show John the Ripper formats
-g, --greppable       Non-interactive greppable output
-q, --quiet           Suppress banner

Conseils

NTH est un outil heuristique : il identifie des types de hash possibles par format/longueur, pas l’algorithme réel ; vérifiez toujours par rapport à la source (par exemple un dump SAM Windows implique NTLM).
Utilisez --json lors du chaînage dans des pipelines de cassage automatisés ou des scripts de résolution CTF.

Aide / Page de manuel

usage: nth [-h] [-t TEXT] [-f FILE] [--most-likely] [--json] [--hc] [--john]
            [-g] [-q] [--version]

Name-That-Hash: identify hash types

optional arguments:
  -h, --help            show this help message and exit
  -t TEXT, --text TEXT  the hash(es) to identify, comma separated
  -f FILE, --file FILE  file containing hashes, one per line
  --most-likely         only show the most likely candidate(s)
  --json                output as JSON
  --hc                  only show hashcat modes
  --john                only show John the Ripper formats
  -g, --greppable       greppable, non-interactive output
  -q, --quiet           don't display the banner
  --version             show program's version number and exit