8

During some of my research work I encountered an unknown hashed string. What I am curious about is the algorithm used to generate it. A factor that makes it interesting - the string contains an asterisk, that acts as some sort of a delimiter. Here is an example:

i6ygOQQhiUbOFeUbzI2L33*cwsrXsCuZu0CQOPhKrZbii8ynu7qx9g

The asterisk does not have a fixed position, so another example of a valid hashed string is this:

NHudTnpSWRDKXAvLwtsAA0HAnCOFe4aLRiL4e8Y5cWYLYVI*hdMRlQ

I ran these values through HashID, but it was not able to identify the algorithm. Any of you security experts ever encountered something like this? Any pointers as to what might be the hashing method?

Improve this question
5
  • 2
    I don't know the answer myself, but have you considered that the hash might be homebrewed and not one of the popular hashing algorithms?
    – user10211
    Sep 13, 2012 at 2:05
  • The lengths of the hash makes me suspect the same too
    – sudhacker
    Sep 13, 2012 at 3:46
  • I was thinking about that and it seems like it is one of the most plausible versions at this point, but I was wondering if maybe I missed something while searching for an existing algorithm to fit this in.
    – Den
    Sep 13, 2012 at 4:56
  • Can you add more examples of the hashes?
    – Mark Burnett
    Sep 14, 2012 at 0:16
  • Will dump more hashes once I get to the machine, yes.
    – Den
    Sep 14, 2012 at 1:16

1 Answer 1

Reset to default
8

Looks like the first part is a base64'd 128-bit hash, likely MD5, and the second part is a base64'd salt.

In hex:

Hash: 8baca03904218946ce15e51bcc8d8bdf
Salt: 730b2b5ec0ae66ed0240e3e12ab65b8a2f329eeeeac7d8

If you have other examples of the hash, it'd be easy to verify this.

Improve this answer
5
  • Nice, I tried to decode base64 from an online calculator, but all I got was garbage. What did you do to get this ? Own script ?
    – sudhacker
    Sep 13, 2012 at 13:51
  • 2
    It's base64 of the binary representation of the hash, hence garbage. I just converted base64 to hex and guessed MD5 based on the fact that it's 128-bit.
    – Polynomial
    Sep 13, 2012 at 15:04
  • Will try to confirm this once I get to the machine with the hashes. I have a stack of 20+ of them, so hopefully something will come up.
    – Den
    Sep 13, 2012 at 16:05
  • It probably isn't true base64 of md5 because you would see an "=" at the end of each code since 128 bits isn't a multiple of 24 bits (3 octets). It's not likely conversion of any real hash due to the variable length. Also, conversion of hex codes to base64 would only contain the characters ABDEFGIJMNOQRTUVWYZcdghijklmwxyz012345.
    – Mark Burnett
    Sep 14, 2012 at 1:36
  • It's not ASCII hex to base64, it's raw bytes to base64. The full character set is in effect.
    – Polynomial
    Sep 14, 2012 at 6:17

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .