Hashes, identification and cracking
Identify a digest by shape, understand why hashing is one-way, and learn where wordlist cracking works and where it is a trap.
By the end you can
- Identify a hash from its length and prefix, and name the ambiguities that length alone cannot resolve
- Explain the difference between encoding, encryption, and hashing
- Crack a fast unsalted hash with a wordlist and rule transforms
- Recognise a deliberately slow hash and choose a different approach
1. Read
2. Use the tools
In the order they come up while solving. Each opens the workspace tab that runs it.
Hash identifier with hashcat mode lookup
Identify a hash from its shape and prefix - MD5, SHA family, bcrypt, NTLM, and the salted formats - and get the hashcat mode number to crack it.
MD5, SHA-1 and SHA-256 hash generator
Compute MD5, SHA-1, SHA-256, SHA-384, and SHA-512 of any text in the browser, using Web Crypto. Nothing is sent anywhere.
In-browser hash cracker with rule transforms
Crack MD5, SHA-1, SHA-256, SHA-384, and SHA-512 against a wordlist in your browser, with leetspeak, case, reversal, and digit-append rules.
SHA-3, BLAKE2, Keccak and RIPEMD calculator
Compute the hash functions outside the standard set - SHA-3, Keccak, BLAKE2, and RIPEMD-160 - when SHA-2 does not match.
3. Try one now
Generated in your browser and checked in your browser. No account, nothing to download, and a fresh one whenever you want another.
Practice
generated here, checked here, no account and nothing to download
4. Practise on the real thing
Real picoCTF challenges that use these techniques, easiest first. 13 match in total - see the full index.
Checkpoint
Identify an unknown digest, justify the identification, then crack it - or argue from the algorithm why cracking is the wrong path.
Teaching note
The valuable outcome is the negative one: students should leave able to say 'this is bcrypt, so the password is somewhere else in the challenge'. That judgement is worth more than any successful crack.