hashid

Overview

hashid analyzes hash strings by length and character set to suggest matching hash algorithms. Before cracking a hash, you need to know what algorithm produced it. hashid narrows down the possibilities and maps them to hashcat modes and JtR formats.

Basic Usage

Identify a single hash

hashid 5f4dcc3b5aa765d61d8327deb882cf99

Identify multiple hashes from file

hashid -f hashes.txt

Show hashcat mode numbers

hashid -m 5f4dcc3b5aa765d61d8327deb882cf99

Show JtR format names

hashid -j 5f4dcc3b5aa765d61d8327deb882cf99

Show both hashcat and JtR modes

hashid -mj 5f4dcc3b5aa765d61d8327deb882cf99

Example Output

$ hashid -m 5f4dcc3b5aa765d61d8327deb882cf99
Analyzing '5f4dcc3b5aa765d61d8327deb882cf99'
[+] MD2
[+] MD5 [Hashcat Mode: 0]
[+] MD4 [Hashcat Mode: 900]
[+] Double MD5 [Hashcat Mode: 2600]
[+] LM [Hashcat Mode: 3000]
[+] RIPEMD-128
[+] Haval-128
[+] Tiger-128
[+] Skein-256(128)
[+] Skein-512(128)
[+] Lotus Notes/Domino 5 [Hashcat Mode: 8600]
[+] Skype [Hashcat Mode: 23]
[+] Snefru-128
[+] NTLM [Hashcat Mode: 1000]
[+] Domain Cached Credentials [Hashcat Mode: 1100]

Common Hash Formats

MD5           32 hex chars      → hashcat -m 0
NTLM          32 hex chars      → hashcat -m 1000
SHA1          40 hex chars      → hashcat -m 100
SHA256        64 hex chars      → hashcat -m 1400
SHA512        128 hex chars     → hashcat -m 1700
bcrypt        $2a$..            → hashcat -m 3200
WPA2          hc22000 format    → hashcat -m 22000
NetNTLMv2     NTLMSSPHash       → hashcat -m 5600
Kerberos 5    $krb5tgs$23$*     → hashcat -m 13100

Batch Identification

Identify all hashes in a file

hashid -f hashes.txt -m

Extract unique hash types

hashid -f hashes.txt -m | grep "Hashcat Mode" | sort -u

Process output for automation

hashid -m "5f4dcc3b5aa765d61d8327deb882cf99" 2>/dev/null | grep "MD5 \[Hashcat"

After Identification — Cracking

Crack MD5 hash

hashcat -m 0 5f4dcc3b5aa765d61d8327deb882cf99 rockyou.txt

Crack NTLM

hashcat -m 1000 aad3b435b51404eeaad3b435b51404ee:e52cac67419a9a224a3b108f3fa6cb6d rockyou.txt

Crack SHA256

hashcat -m 1400 hash.txt rockyou.txt

Crack bcrypt (slow, use GPU)

hashcat -m 3200 '$2a$12$...' rockyou.txt

Tips

• MD5 and NTLM are both 32-character hex — context determines which (Linux vs Windows)
• NetNTLMv2 hashes (from Responder) use mode 5600, not 1000
• Kerberoast hashes ($krb5tgs$23$*) use mode 13100
• When unsure, try the top hashcat mode suggestion and check if it cracks

hashid [options] INPUT

INPUT           Hash string or file with -f
-f FILE         Read hashes from file
-m              Show hashcat mode numbers
-j              Show JtR format names
-e              Show extended information
-o FILE         Output to file
--help          Show help

Vue d’ensemble

hashid analyse des chaînes de hachage par longueur et jeu de caractères pour suggérer les algorithmes de hachage correspondants. Avant de casser un hachage, il faut savoir quel algorithme l’a produit. hashid réduit les possibilités et les fait correspondre aux modes hashcat et aux formats JtR.

Utilisation de base

# Identifier un seul hachage
hashid 5f4dcc3b5aa765d61d8327deb882cf99

# Identifier plusieurs hachages depuis un fichier
hashid -f hashes.txt

# Afficher les numéros de mode hashcat
hashid -m 5f4dcc3b5aa765d61d8327deb882cf99

# Afficher les noms de format JtR
hashid -j 5f4dcc3b5aa765d61d8327deb882cf99

# Afficher à la fois les modes hashcat et JtR
hashid -mj 5f4dcc3b5aa765d61d8327deb882cf99

Exemple de sortie

$ hashid -m 5f4dcc3b5aa765d61d8327deb882cf99
Analyzing '5f4dcc3b5aa765d61d8327deb882cf99'
[+] MD2
[+] MD5 [Hashcat Mode: 0]
[+] MD4 [Hashcat Mode: 900]
[+] Double MD5 [Hashcat Mode: 2600]
[+] LM [Hashcat Mode: 3000]
[+] RIPEMD-128
[+] Haval-128
[+] Tiger-128
[+] Skein-256(128)
[+] Skein-512(128)
[+] Lotus Notes/Domino 5 [Hashcat Mode: 8600]
[+] Skype [Hashcat Mode: 23]
[+] Snefru-128
[+] NTLM [Hashcat Mode: 1000]
[+] Domain Cached Credentials [Hashcat Mode: 1100]

Formats de hachage courants

MD5           32 hex chars      → hashcat -m 0
NTLM          32 hex chars      → hashcat -m 1000
SHA1          40 hex chars      → hashcat -m 100
SHA256        64 hex chars      → hashcat -m 1400
SHA512        128 hex chars     → hashcat -m 1700
bcrypt        $2a$..            → hashcat -m 3200
WPA2          hc22000 format    → hashcat -m 22000
NetNTLMv2     NTLMSSPHash       → hashcat -m 5600
Kerberos 5    $krb5tgs$23$*     → hashcat -m 13100

Identification par lot

# Identifier tous les hachages d'un fichier
hashid -f hashes.txt -m

# Extraire les types de hachage uniques
hashid -f hashes.txt -m | grep "Hashcat Mode" | sort -u

# Traiter la sortie pour l'automatisation
hashid -m "5f4dcc3b5aa765d61d8327deb882cf99" 2>/dev/null | grep "MD5 \[Hashcat"

Après identification : cassage

# Casser un hachage MD5
hashcat -m 0 5f4dcc3b5aa765d61d8327deb882cf99 rockyou.txt

# Casser un NTLM
hashcat -m 1000 aad3b435b51404eeaad3b435b51404ee:e52cac67419a9a224a3b108f3fa6cb6d rockyou.txt

# Casser un SHA256
hashcat -m 1400 hash.txt rockyou.txt

# Casser un bcrypt (lent, utiliser le GPU)
hashcat -m 3200 '$2a$12$...' rockyou.txt

Conseils

• MD5 et NTLM font tous les deux 32 caractères hex : le contexte détermine lequel (Linux vs Windows)
• Les hachages NetNTLMv2 (issus de Responder) utilisent le mode 5600, pas 1000
• Les hachages Kerberoast ($krb5tgs$23$*) utilisent le mode 13100
• En cas de doute, essayez la première suggestion de mode hashcat et vérifiez si ça casse

hashid [options] INPUT

INPUT           Hash string or file with -f
-f FILE         Read hashes from file
-m              Show hashcat mode numbers
-j              Show JtR format names
-e              Show extended information
-o FILE         Output to file
--help          Show help