Nearly every pen test I’ve been on, we’ve been able to obtain hashes of some sort. These hashes could be generated by a web application, database, operating system, or more. Typically, there will come a point where I either need to generate a hash myself, or compare the hashes I’ve obtained with their potential plaintext value. The problem that we face is it’s not operationally safe to blindly submit cleartext passwords or hashes to online websites. I/we don’t know with 100% certainty what is happening to the hash or cleartext password and if they are being copied to another location. In the end, I don’t trust anything online for anything sensitive in nature.
As a result, I needed a way to quickly generate password hashes and/or compare a hash that I have with a cleartext string and determine if they match, but I need to do this locally to my computer. As a thought exercise, I wanted to make my own application that can meet these needs, so I’m happy to introduce Hasher.
Hasher allows you to generate a hash in a hashing algorithm that you choose, with a cleartext string of your choice, all locally on your machine. Additionally, Hasher lets you compare a cleartext string with a hashed value to determine if they match, again, all locally to your machine. One item to note, Hasher is NOT designed to be a password/hash cracking program. It’s designed for locally creating hashed, or comparing passwords and hashes locally, not for cracking passwords.
Current supported hashing algorithms:
- MySQL v3.2.3
- MySQL v4.1
- Oracle 10G
- Oracle 11G
Hasher is easily used with a Menu driven interface. Just select the option you want to use, provide the cleartext string or hash, and you’ll get your result. I’ve also made Hasher easily scriptable via the command line. Not all CLI options are required, it’s dependent upon the hashtype you are using, and even then, if you don’t provide a required option, one is typically generated. The CLI options looks like the following:
If you have any questions, or encounter any bugs, please be sure to submit an issue or pull request via github and I will be sure to address it shortly. Also, if you have any specific hash type requests, please be sure to submit a request or github issue to me and I can look into adding that hash type.
To get a copy of Hasher, simply:
git clone https://github.com/ChrisTruncer/Hasher.git
Some sample uses are below:
Creating a NTLM hash with the password of “Password”:
Comparing the password “Password” with a NTLM hash for the correct value:
Comparing the password “password” with a NTLM hash for an incorrect value: