Generate Hashes from HASHMASH

Hashmash is a tool to aid in generating various hashes from user supplied values. For example password reset functionality that returns an MD5 hash of something. Here’s where Hashmash comes in.

In this example we have access to the user account so we might know, or be in a position to make an educated guess, of some key values that could be used to generate this MD5 hash. Perhaps it’s a combination of all, some or none of; firstname, surname, ID, email address or even a Epoch value. Using Hashmash we can supply a list of variables in a file, choose the hashing algorithm (i.e. MD5, SHA1 etc.) select any delimiters that might have been used to separate the values, for example firstname:surname or firstname & surname, and then generate a hash for each combination. The aim is to try and get a match of the hash we have and therefore we can deduce that the password reset link might be constructed in the form of ID:firstname:emailaddress or Epoch:ID:name etc. With this knowledge we could then potentially change the password for another valid account as we have ‘cracked’ the construction!

Basic usage is as follows…

Example run:

Let’s say our values.txt file contains the values 1, 2, 3. Running Hashmash in the most basic mode will generate the following combinations.

Cleartext Value: 1
c4ca4238a0b923820dcc509a6f75849b
Cleartext Value: 2
c81e728d9d4c2f636f067f89cc14862c
Cleartext Value: 3
eccbc87e4b5ce2fe28308fd9f2a7baf3
Cleartext Value: 12
c20ad4d76fe97759aa27a0c99bff6710
Cleartext Value: 13
c51ce410c124a10e0db5e4b97fc2af39
Cleartext Value: 21
3c59dc048e8850243be8079a5c74d079
Cleartext Value: 23
37693cfc748049e45d87b8c7d8b9aacd
Cleartext Value: 31
c16a5320fa475530d9583c34fd356ef5
Cleartext Value: 32
6364d3f0f495b6ab9dcf8d3b5c6e0b01
Cleartext Value: 123
202cb962ac59075b964b07152d234b70
Cleartext Value: 132
65ded5353c5ee48d0b7d48c591b8f430
Cleartext Value: 213
979d472a84804b9f647bc185a877a8b5
Cleartext Value: 231
9b04d152845ec0a378394003c96da594
Cleartext Value: 312
950a4152c2b4aa3ad78bdd6b366cc179
Cleartext Value: 321
caf1a3dfb505ffed0d024130f58c5cfa

OK, let’s generate a ‘test’ hash:

echo -n 1459970019:surname:email@theblackhacker.com | md5sum

e23e4ae268f4ba432e74e625e6600e59 –

Run the script:

python hashmash.py --match e23e4ae268f4ba432e74e625e6600e59 --alg 1 --delim 2 --file values.txt    --st "2016-04-06 19:13:00" --et "2016-04-06 19:15:00" --sec

And…

[+] Gotya!
 1459970019:surname:email@theblackhacker.com

Compatibility for v0.1:
Tested on Kali 2.0/Python 2.7.9 and Ubuntu 14.04/Python 2.7.6 platforms.

Disclaimer:

I’m not a developer! The code is rough, very very rough. I know this. But it works. Hopefully.

Feedback, improvement suggestions (and additions) are always welcome.  

if you enjoy my visitor plz share this artical and Follow me on blogger.