CyberKit

Hash Identification

Identify a hash by its length and shape, and sort algorithms by what they are still safe for.

Type the algorithm, and sort batches of real digests into categories. Foundational, about 15 minutes.

What you will be able to do

  • Identify a hash algorithm from the length of its digest (Hash Calculator & Verifier)
  • Read a prefixed format string ($2y$, $6$, …) and name the scheme it declares
  • Say when a digest is genuinely ambiguous, and why "32 hex characters" alone cannot separate MD5 from NTLM
  • Judge how much confidence an identification deserves, instead of reporting a guess as a fact
Notes for teaching it
  • Short enough to use as a warm-up at the start of a session, or as the thing you hand to whoever finishes another exercise early.
  • The ambiguity questions are the point of the drill, not a trick. Learners trained on "hash length = algorithm" tables consistently answer these confidently and wrongly, which makes them the best discussion starter here.
  • Pair it with the Hash Calculator on screen: identifying a digest and then generating one from a known input in the same minute is what makes the length rule stick.

All questions

  1. Hashing the string "admin" with one of this tool's supported algorithms produced this digest: 21232f29 7a57a5a7 43894a0e 4a801fc3 That's 32 hex characters (128 bits). Which algorithm produced it? (e.g. "MD5", "SHA-256")

  2. Hashing the string "password123" with one of this tool's supported algorithms produced this digest: cbfdac60 08f9cab4 083784cb d1874f76 618d2a97 That's 40 hex characters (160 bits). Which algorithm produced it? (e.g. "MD5", "SHA-256")

  3. Hashing the string "root" with one of this tool's supported algorithms produced this digest: 4813494d 137e1631 bba301d5 acab6e7b b7aa74ce 1185d456 565ef51d 737677b2 That's 64 hex characters (256 bits). Which algorithm produced it? (e.g. "MD5", "SHA-256")

  4. Hashing the string "svc_backup" with one of this tool's supported algorithms produced this digest: 2eb894fa b92f51d6 aa26a2ce d87121f2 f6a1ec24 3763d924 3ab8776c f91c1440 e062a7a0 baa7bf8a d2c30e27 cc470c0e That's 96 hex characters (384 bits). Which algorithm produced it? (e.g. "MD5", "SHA-256")

  5. Hashing the string "administrator" with one of this tool's supported algorithms produced this digest: cf835de3 d4ea0136 7c45e412 e7a9393a 85a4e40a f149ed8c 3ed6c37c 05b67b27 813d7ff8 072c1035 cedd1941 5adf1712 8d63186f 05f0d656 002b0ca1 c34f44a0 That's 128 hex characters (512 bits). Which algorithm produced it? (e.g. "MD5", "SHA-256")

  6. An analyst finds this bare hex string pasted into a ticket, with no other context: 21232f29 7a57a5a7 43894a0e 4a801fc3 It's 32 hex characters. True or false: its format alone is enough to say with confidence that it's an MD5 digest and nothing else.

  7. The same Identify panel is given this 40-hex-character string: cbfdac60 08f9cab4 083784cb d1874f76 618d2a97 What confidence level (High/Medium/Low) does it assign to SHA-1 as the source?

  8. This string turns up in a leaked database dump: $2b$12$KIXQeYQ9Z5W8n1JlY0m0uOe3z7Q4rXk9pC2mN6sT1vB5dF7gH8jK9 What hashing scheme is this? (Short answer: name the format, e.g. "sha256", "crc32", "bcrypt".)

  9. This string turns up in a copied /etc/shadow line: $6$rounds=656000$abcXYZ123saltHere$Qk9z5W8n1JlY0m0uOe3z7Q4rXk9pC2mN6sT1vB5dF7gH8jK0m0uOe3z7Q4rXk9pC2mN6sT1vB5dF7gH8jK. What format is this? (short answer, e.g. "bcrypt", "md5crypt", "sha512crypt")

  10. Per the algorithm reference table, how many bits does a SHA-384 digest produce? (numeric answer)

  11. A batch of five digests just came off a triage script with no labels attached. Sort each one into the algorithm that produced it, using nothing but digest length.

  12. Same idea, different sort: these five strings are labeled only by how confidently the Hash Calculator's Identify panel can name their source. Sort each into its real confidence tier.

  13. The exact same 32-character hex string, 21232f297a57a5a743894a0e4a801fc3, turns up in four different places during an investigation. Sort each occurrence by what it most likely is, given where it was found.

Answer key

Next: Subnetting. All drills