Video summary

TryHackMe Hashing Basics Walkthrough | Step-by-Step CTF Guide

Main summary

Key takeaways

Educational

Main ideas & lessons (Hashing Basics Walkthrough)

Task 1: Introduction to hashing

  • What hashing is
    • You can hash any data that can be represented in binary (0s and 1s).
    • Hashing is a one-way function (“one-way trip”): you take input → compute hash → get a fixed-size output.
    • The hash output is typically a string (size depends on the algorithm).
  • Fixed-size output (why it matters)
    • Large input files (e.g., a 10GB download) and small files (e.g., a half-page document) both produce a hash of fixed length for the chosen algorithm.
  • Hashes are useful for comparison
    • Instead of comparing full files, you hash both files and compare the resulting hash strings to check whether content matches.
  • Why prerequisites
    • Understanding later material is easier after completing Cryptography Basics and Public Key Cryptography Basics.
  • What the room will cover
    • Hash functions and collisions
    • Hashing use for authentication
    • Identifying the hash type from output
    • Cracking hashes and using hashing for integrity

Task 1 question takeaways

  • Identify the SHA-256 hash of a given file (e.g., passport.jpeg).
  • Determine MD5 hash output size (noted as 16 bytes).
  • For an 8-bit hash, compute number of possible values:
    • (2^8 = 256)

Task 2: Hash functions (difference from encryption, avalanche effect, command-line hashing)

  • Hashing vs encryption
    • Hashing: one-way, cannot reliably reverse (no “decrypt hash to plaintext”).
    • Encryption: reversible when you have the correct key.
  • Single-bit change causes major hash change (avalanche effect)
    • Two inputs that differ by only one bit (example: text file “T” vs “U”) produce hashes that look completely different.
    • This makes hashes effective for detecting changes.
  • Different hash algorithms / different outputs
    • Examples discussed and used:
      • MD5
      • SHA-1
      • SHA-256
    • Using the same algorithm yields fixed-length output; using different algorithms yields different lengths.
  • Security intuition based on output size
    • Generally, larger output → more resistance to collisions → usually more secure (examples given: SHA-256 > SHA-1 > MD5).
  • Hash collisions
    • A collision is when two different inputs produce the same hash.
    • Collisions are possible because:
      • There are infinitely many possible inputs but finite possible hash outputs
      • This is described as the pigeonhole effect
    • Modern algorithms (e.g., SHA-256) have far fewer practical collisions than weaker ones.
  • Attacking collisions
    • MD5 and SHA-1 are noted as attacked/insecure because collisions can be engineered.
    • Attacks may not have simultaneous collisions across multiple algorithms at once.
    • Practical defense mentioned:
      • Use multiple hash types when verifying (e.g., compare multiple hashes, not just one).
  • Command-line hashing methodology shown
    • General structure:
      • <algorithm>sum <file> (the script described as “hash name” then sum then filename)
    • Example wildcard approach:
      • Hash all matching files at once using a wildcard (e.g., files ending in .txt)
    • The walkthrough uses these examples to compute and compare MD5/SHA-1/SHA-256 for different files.

Task 2 question takeaways

  • Identify the SHA-256 hash of a given file (e.g., passport.jpeg).
  • Determine MD5 hash output size (noted as 16 bytes).
  • For an 8-bit hash, compute number of possible values:
    • (2^8 = 256)

Task 3: Insecure password storage for authentication

  • Common insecure practices (what not to do)
    • Plaintext password storage
    • Weak/broken encryption
    • Insecure or tamperable hashing
  • Breaches consequence
    • These mistakes lead to password exposure after hacks.
  • Salting introduced (but deferred)
    • Salting = add a random value to a password before hashing to prevent attackers from using precomputed tables.

Task 3 question takeaways

  • Finding “the 20th password” in rockyou.txt by navigating the wordlist (walkthrough uses piping to less to view and count lines; notes Q to quit).

Task 4: Secure password storage (hashing + salting + rainbow tables)

  • Core principle
    • Do not store plaintext passwords.
    • Store hashes instead of passwords:
      • Database stores username → hash (and later also salt).
      • Login flow:
        1. User enters plaintext password.
        2. System hashes the entered password (with the proper method and salt).
        3. Compare computed hash to stored hash.
  • Why hashing helps
    • If attackers steal the database, they get hashes, not plaintext passwords.
    • Because hashing is one-way, recovering passwords is harder than reading plaintext.
  • Rainbow tables (why hashing alone isn’t enough)
    • A rainbow table is a precomputed list:
      • common passwords → their hashes
    • Attack workflow:
      • Attacker steals hashes
      • Looks up stolen hash values in the rainbow table
      • If there’s a match, they recover the corresponding password
    • Mention of sites/services acting like large rainbow tables (e.g., “CrackStation”-style references).
  • Why complex passwords matter
    • Rainbow tables target common passwords; uncommon passwords make matches less likely.
  • Salting methodology (detailed steps as presented)
    • Protect against rainbow table lookups by using a unique salt per password.
    • Walkthrough steps:
      1. Choose a secure hashing function.
      2. Generate a unique random salt for each password (added to front or end).
      3. Compute the hash over:
        • hash = HASH( salt + password ) (or HASH( password + salt ) depending on system convention)
      4. Store in the database:
        • the hash value
        • the unique salt used
      5. During login:
        • retrieve salt for the user
        • hash the entered password using that salt
        • compare to stored hash.
  • Why not encryption for passwords
    • Encryption would require storing encryption keys.
    • If keys are compromised, attackers could decrypt passwords.
    • Hashing + salting avoids needing a decryption key.

Task 4 question takeaways

  • Crack a hash using a provided online rainbow table/manual approach (walkthrough mentions Hashcat may not work for the last hint-based challenge).
  • Verify that one of the answers requires using the online service per hint.

Task 5: Recognizing password hashes (hash formats + identifying algorithms with prefixes)

  • Linux hash format concepts
    • Hashes may appear with structured fields, especially in Linux auth systems.
    • Discussed structure (as described in the video):
      • Prefix wrapped in $...$
      • Options (also between $...$)
      • Salt (between $...$)
      • Actual hash
  • Linux “shadow” file
    • On Linux, password hashes are stored in the /etc/shadow file.
    • Access is restricted (generally root-only).
    • The walkthrough recommends using documentation like man 5 shadow for colon-separated fields.
  • Mapping prefixes to algorithms
    • A table is referenced to identify algorithms from hash prefixes (without memorizing everything, often possible to Google/identify).
  • Windows mention
    • Windows uses NTLM-style hashing and related formats; also mentions SAM and that hashes are accessible via tools (e.g., mimikatz mention).
  • Hashcat relevance
    • To crack hashes, you need the correct hash mode number that corresponds to the hash algorithm/format.
  • Task 5 activities
    • Identify hash size (example given: “yes script” → 256 bits).
    • Determine Hashcat hash mode for a specific hash type (example: “Cisco ASA md5”).
    • Determine the hashing algorithm for “Cisco iOS” based on $9$ style prefix (example result stated as sha512 crypt).

Task 6: Password cracking with Hashcat / hashcat workflow

  • Wordlists
    • rockyou.txt is used as a common password list in CTFs.
  • How cracking works (high-level)
    • Attack workflow:
      1. Provide Hashcat a hash to crack.
      2. Provide a wordlist (candidate passwords).
      3. Hashcat hashes each candidate and compares against the target hash.
      4. If a candidate produces the same hash, Hashcat outputs the cracked password.
  • GPU & VM notes
    • GPU can speed up cracking (with caveats).
    • Cracking inside VMs can be slower or harder; sometimes recommended to crack on a real system or copy hashes over.
  • Hashcat syntax presented
    • General template:
      • hashcat -m <mode> -a <attack_mode> <hash_file> <wordlist>
    • Used attack mode:
      • -a 0 (straight mode: try wordlist passwords sequentially)
  • Methodology shown for solving Hashcat tasks
    • Step-by-step approach used by the walkthrough:
      1. Inspect/identify hash type using Task 5 knowledge or an online hash identifier.
      2. Determine correct Hashcat hash mode (-m).
      3. Run Hashcat with:
        • correct mode
        • attack mode 0
        • provided hash file path
        • rockyou.txt wordlist
      4. Wait for cracking result; check status with Hashcat’s features (e.g., show status).
      5. Copy the cracked password as the answer.
  • Examples of cracking targets
    • bcrypt hash:
      • Identified using an online hash identifier
      • Hashcat mode set to 3200
    • SHA-256 hash:
      • Identified as SHA-2 256 variant (note about confusing SHA 256 vs SHA2-256)
      • Hashcat mode set to 1400
    • SHA-512 crypt / Unix-style:
      • Identified via the hash format and mode selection
  • What to expect when cracking fails
    • If cracking doesn’t succeed:
      • Hashcat may report exhausted status
      • Indicates wrong algorithm/mode or the correct password isn’t in the wordlist.
  • Hint-based online cracking
    • For the final challenge, Hashcat won’t work as intended.
    • The walkthrough emphasizes:
      • Use an online service per hint (rainbow table approach).

Task 6 key “don’t waste time” lesson

  • If a hint says “use online tool,” don’t keep trying Hashcat with different modes—switch tools accordingly.

Task 7: Hashing for integrity checking + HMAC

  • Integrity checking concept
    • Hashing is excellent for verifying that files haven’t changed.
    • Even one bit difference → hash changes significantly.
  • Use case
    • When downloading software, verify provided hashes to ensure authenticity/integrity.
  • HMAC (Hash-based Message Authentication Code)
    • Introduced as a combination of cryptography + hashing.
    • Purpose:
      • verify authenticity and integrity
    • Mentioned components:
      • key-based approach (conceptually)
      • uses XOR-related math in explanation (details not fully covered in the walkthrough).
  • Task 7 questions
    • Compute SHA-256 hash of a large file (example file path referenced).
    • Identify the Hashcat mode number for an HMAC/HX-SHA-512 style target (answer given as mode number 1750).

Task 8: Conclusion + distinction between hashing, encoding, and encryption

  • What to know by the end
    • Hashing fundamentals, collisions, password storage, cracking basics, and integrity checking.
  • Hashing vs encryption vs encoding
    • Hashing:
      • one-way
    • Encryption:
      • reversible with a key
    • Encoding:
      • not secure
      • just transforms representation (e.g., language change metaphor or Base64)
      • can typically be reversed easily
  • Base64 example
    • Uses command-line concept:
      • encode/decode using base64 with decode flag (-d)
    • Applied to decode a provided challenge string.

Speakers / sources featured

  • Speaker (video host): “the helpful hacker” (named in subtitles as the presenter)
  • Primary external sources/tools referenced:
    • TryHackMe (Hashing Basics room; Crypto Basics / Public Key Cryptography Basics rooms)
    • hashcat (password cracking tool)
    • John the Ripper (mentioned as another cracking tool)
    • rockyou.txt (common password wordlist)
    • MD5 / SHA-1 / SHA-256 / SHA-512 crypt / bcrypt (hash algorithms referenced)
    • Linux /etc/shadow (shadow file concept)
    • Rainbow tables / online rainbow table sites (general references)
    • Hash identifier website(s) (e.g., “hashes.com” / “hashes dcom” as referenced)
    • CrackStation / hashes docomo (mentioned as examples of cracking/rainbow-table websites)
    • mimikatz (mentioned for dumping Windows SAM hashes)
    • Base64 (encoding/decoding command example)

Original video