haiti v1.4 releases: Hash type identifier

haiti

A CLI tool (and library) to identify hash types (hash type identifier).

Features

• 442+ hash types detected
• Modern algorithms supported (SHA3, Keccak, Blake2, etc.)
• Hashcat and John the Ripper references
• CLI tool & library
• Hackable

Why?

hashID is unmaintained since March 2015, hash-identifier is unmaintained since 2011, Dagon since June 2018, and findmyhash since 2011. They all have no/wrong/erroneous support for modern hashes like Keccak/SHA3/Blake2 etc. Also, a tool like hash-identifier which is fully interactive has no options and is not handy for scripting. findmyhash has a very limited set of detected hashes. The most interesting tool is hashID (for hash identification) but since it is unmaintained for more than 5 years, issue and open PR are stacking, bugs remain and some features keep lacking.

That’s what motivated me to create a new tool and by the way adding color support and a library. The lib is especially good for scripting since one doesn’t have to wrap a CLI tool in a sub-process.

Since January 2021, nearly two years after I started Haiti, a project named Name-That-Hash surfaced because the author needed a Python lib for Ciphey. There are now two valid options for hash identification even if NTH has fewer hash types supported and has some broken or incomplete regexp.

The conclusion is that haiti is THE hash identifying tool and stay on the top for now.

Changelog v1.4

• Additions:
  • AzureAD #93
  • HTTP Digest access authentication #94
  • IPB 2.x (Invision Power Board) #95
  • Amazon AWS4-HMAC-SHA256 #126
  • Bitcoin WIF private key (P2PKH), compressed #126
  • Bitcoin WIF private key (P2PKH), uncompressed #126
  • Bitcoin WIF private key (P2WPKH, Bech32), compressed #126
  • Bitcoin WIF private key (P2WPKH, Bech32), uncompressed #126
  • Bitcoin WIF private key (P2SH(P2WPKH)), compressed #126
  • Bitcoin WIF private key (P2SH(P2WPKH)), uncompressed #126
  • BLAKE2-512($pass.$salt) #126
  • BLAKE2-512($salt.$pass) #126
  • DPAPI masterkey file v1 (context 1 and 2) #126
  • DPAPI masterkey file v1 (context 3) #126
  • DPAPI masterkey file v2 (context 1 and 2) #126
  • DPAPI masterkey file v2 (context 3) #126
  • Exodus Desktop Wallet #126
  • Flask Session Cookie #126
  • KeePass 1 AES / without keyfile #126
  • KeePass 1 Twofish / with keyfile #126
  • KeePass 1 Twofish / without keyfile #126
  • KeePass 2 AES / without keyfile #126
  • Keepass 2 AES / with keyfile #126
  • KeePass 2 ChaCha20 (KDBX 3) / without keyfile #126
  • Kerberos 5 DB etype 17 #126
  • Kerberos 5 DB etype 18 #126
  • Kerberos 5 DB etype 3
  • Kerberos 5 TGT
  • Kerberos 4 TGT
  • PostgreSQL #126
  • PostgreSQL SCRAM-SHA-256 #126
  • Radmin3 #126
  • Teamspeak 3 (channel hash) #126
  • Terra Station Wallet #126
  • bcrypt(sha512($pass)) / bcryptsha512 #126
  • md5(sha1($pass).$salt) #126
  • sha1($salt.sha1(utf16le($username).’:’.utf16le($pass))) #126
  • sha256($salt.sha256_raw($pass)) #126
• Enhancements:
  • 7-zip: #118
    • Add samples
    • Match variants with optional fields
  • WinZip: #118
    • Add samples
    • Enhance regexp, 7th token can be at max 0x200000 * 4 * 2
  • SecureZip: #118
    • Add samples
  • PKZIP: #118
    • Add samples
    • Add HC codes
    • Add several sub-variants
  • PostgreSQL CRAM (MD5): #126
    • Add samples
    • Enhance regexp
  • many Kerberos 5 types:
    • Add samples
  • sha1 / RIPEMD-160
    • Enhance regexp
  • sha256(sha256_raw($pass)) / sha256($salt.sha256($pass)) / sha256(sha256($pass).$salt)
    • add HC
    • add sample
  • Hide some uncommon hash types (not removed but set as extended)
• CLI:
  • Now can read hash from STDIN
  • New command to display hash samples
• Lib:
  • New class method to find hash samples
• Chore:
  • Fix github action ruby workflow
• Install:
  • Can now be installed on Debian with a .deb
  • Can now be installed on Void Linux
• Documentation:
  • Comparison to houndsniff
  • Add some legal terms

Install & Use

Copyright (c) 2020-2020 Alexandre ZANNI
Copyright (c) 2019-2020 Alexandre ZANNI at Orange Cyberdefense