In this video I'm going to teach you how to crack hashes in Python and more specifically you're going
to learn how to crack and the FIVE HASHES or an empty five hash.
Now if you didn't know hashing or a hash function is an algorithm that computes or gives out a fixed
size value from a file or even from one string right now.
What does that actually mean.
Well simply put let's say that you want to send the file to your friend over the Internet you trust
the file that you're sending.
Meaning that you are very certain and that's integrity and you want to make sure that your friend receives
the same file such as that no other malicious entities intercept the file modify it and forward the
modified version to your friend.
Therefore in order to validate the integrity you end the five hash it and get the hash value of your
file before sending it.
That actually means that you calculate a unique value string from the entire information contained in
the file.
If the file suffers even the slightest modification the uniques value string will actually be different.
Now in other words the file is going to have a different empty five hash.
What's particularly interesting about the five hashes is that they have not only been used for data
integrity but also for ways to store passwords.
So let's say that you have a password code secret and you want to save it safely or not allow it.
And it's plain text version.
Similarly to what you're doing to amplify flash a file you can end the five hash this password and you
will actually get a unique hash of it.
And interestingly enough even though MDA five hashes are very poor and unsecure ways to store passwords
there are a lot of systems that still use them today and to get back to what we're doing here.
We're going to build the code that given an empty five hash password.
It will try to crack it.
In other words it will try to reverse it.
In other words giving you the plaintext cracked password.
Before we start I want to tell you that there are many other more secure ways to hash data other than
and be five.
You can have as a Che CRC so you can have as a Che CRC each man came back and so on.
Look up Wikipedia for hashing function as it's a good place to start if you want to learn more.
Now our program will be running the command line or terminal in the following way.
It will say Python and the five crack P Y will also give it the hash and then the dictionary file look
to see.
So as you can see we have two arguments that will provide a hash and the dict text.
So the basic idea behind the codes is very simple.
One
it's gonna look into the dictionary and in the dictionary there is a word on every line too.
It's going to end the five hash each word.
So Emily five hash each word and compare the hash with our provided hash and number three if there is
a match then we've sort of speak cracked the hash and retrieve the password.
All right.
So let's generate an empty five hash for the word secret source a secret over here and then generate
and then this is our hash.
OK.
Now this program or script would none of them possible without the inspiration coming from Cameron Buchanan's
as a python weapon iteration testing cookbook.
So a very big thank you for that.
All right let's move into visual studio code.
So first thing first we'll import to libraries which are both found in the python standard library.
So the first one is hash lab and the second one.
So we're going to use our pass instead of source for command line arguments because I think it's more
developed solved.
Also import are pass.
Ok first we're going to work on the command line arguments which is going to help us make our program
more user friendly so we'll see faster.
We have to create a parser and we use armed force that argument faster and then we'll have a description
which is going to say and the five cracker.
OK.
And then we add arguments like I said one for the hash and one for the dictionary.
So we'll say for certain dot add argument it's gonna be minus and the five the destination variable
is gonna be hash the help message display is gonna to say Andy five hash and this is gonna be a required
argument so required equals true.
Then another argument for the word list or dictionary so we'll say pass or an underscore or argument
let's say minus W the destination variable is gonna be word list the help message display there's gonna
be word lists for convenience.
And this is also a required
required argument then we have to pass them so that they can actually work.
So we'll see forced args equals answer force args.
So this is actually gonna pass the arguments.
Then we'll grade a main function so we'll see.
Def main not man.
And then instantiate a variable as empty string that will output in the case the hash is not cracked
so we'll see a hash underscore cracked equals empty string.
Now let's open our dictionary or word list.
So with open sourced or it's word list so past args word list as file and then go line by line through
each word.
So we'll say
for line and file we'll do line equals line dot strip.
We use the strip to strip the words of spaces.
OK.
And then we amplify flash the word and compare it with our provided hash.
So this is actually the main functionality of the code.
So say if hash lib thought and the five bytes we need the bytes of the line and we also need to encode
it in UTF 8 and then we have to hex digest it so we use the hex digest method.
So if the hash lib if the MDC file of our line is equal to past marks dot hash.
So if we have a match then hash cracked is going to be updated to the lines so we actually got the password.
Then we can simply print on a new line and define let's say Hash has been successfully cracked.
The value is
line of course
however the other f f fashion on their score.
Correct.
This is indented here even more so here.
If we get through the entire loop without actually having the hash correct updated.
So if hash cracked equals equals an empty string we can simply print on a new line failed to crack.
The hash try using a bigger different dictionary.
That's it.
Finally we get on the function and we say if underscore underscore name underscore underscore equals
equals underscore underscore remain simply run.
The main function this actually means that when we run the program in the command prompt or terminal
the main function is going to execute.
And that's actually the whole gist of it.
Again simplicity at its finest.
Now let's save this and does that in the command prompt.
So I'm going to navigate the desktop where we have the script and I will say Python and the where I
thought the Y.
And then I need to provide the hash for the word secret that we have over here.
So copy this and then I also need to specify the dictionary like I said so minus W the dictionary on
the desktop.
I think it's dict the text is invalid syntax.
Okay.
There is no done outside the dot as inside controls save.
All right let's go back.
Repeat the command we need to specify the arguments with blindness and the 5 which is the hash minus
WD 60.
There you have it.
It's been actually cracked in no time.
However this was a short word list and our attack was a dictionary attack.
Now for a larger word lists such as in the millions of words it may take extensively longer and we'd
have to use a queuing and threading in Python to actually dramatically increase the speed and reduce
the time vs. a sequential approach like this one.
In any case if you want to go deeper into this rabbit hole I encourage you to study and try it yourself
but your imagination to work.
This is Python and it gives you limitless possibilities.