If I know the initial value of a string and the resulting hash but have no access to the system that produces the output, how can I determine what has actually occurred so I can reproduce the hashing algorithm?

To give you an example let's say I have a list like so:

Nathan    b01f1c8a5cc02855a2fc19ffc0da421b
password  0b8b946432f1ac91f0b07bd5f8df6587
string    c741dd70bca16058ca3f62b2ee926ec6

I know the steps I took to get this were MD5(Base64("string")) but is there any way to determine that based on the above data alone? Aside from just trying a bunch of common hashing/encoding sequences on the original strings and hoping to stumble across a matching output? If I have a lot of input strings and output hashes does that help in any way for analysis?

  • 1
    Just a heads-up: There is no reason to Base64 encode input to a hash function if the hash function and the input are both on the same system. – Henning Klevjer Nov 1 '12 at 6:56
  • @HenningKlevjer the Base64 method is merely an example of a simple way to obfuscate the original string before hashing it. – Nathan Nov 1 '12 at 7:57
  • Why obfuscate the original string before hashing, if it's being hashed on the same system? If input and hashing are on the same system, the only protection you need is from outsiders - and that protection is provided by the hashing function, so any obfuscation prior to hashing is rather pointless. – Iszi Nov 1 '12 at 13:43
  • @Iszi The outsiders have access to the input string, if I just had used MD5("string") in my example it would've been a lot easier to figure out that you get the same output hash by running the input string through an MD5 function. – Nathan Nov 1 '12 at 22:23

Is there any way to determine that based on the above data alone aside from just trying a bunch of common hashing/encoding sequences on the original strings and hoping to stumble across a matching output?

No, there is no other way. Sometimes we get hints from knowing the length of things (MD5 hashes are shorter than SHA-256, etc.), but that still doesn't promise you anything.

  • That's some sad news, Jeff. Are there any utilities out there that will perform a bunch of different iterations of common algorithms on a given input to assist me in nutting this one out? – Nathan Nov 1 '12 at 6:12
  • 3
    @Nathan See insidepro.com/hashes.php – Jeff Ferland Nov 1 '12 at 6:19
  • Thanks Jeff, that's somewhat useful but it doesn't do iterations of the output, say I'd want it to Base64 the input, then md5 the output of that function, or Base64 the input twice, then md5 it, etc. until it reaches a given hash or exhausts all available algorithms and iterations. I guess I should brush up on my PHP skills :) – Nathan Nov 1 '12 at 6:38
  • Marking this as the answer, even if it's not exactly the answer I was hoping for. – Nathan Nov 1 '12 at 22:24

Nathan - no tools will help you here. If you knew it was from a short, fixed set of algorithms you might be in with a chance, but hashing usually uses salts, which makes this impossible.

The combination of a good hashing algorithm plus a salt means you could have any output for a given input (excluding the occasional length difference)

  • Well I can make some fairly educated guesses here. The implementation is likely done in PHP, so that limits things a little. It's also likely only done using string manipulation functions of PHP, not the crypto ones (so not SHA-1 etc.) I am also going to take a stab at guessing the final step is an md5 (possibly reversed). Salting would be very easy to do, and something I'd likely never know even something simple as appending "fO0~" to the string before encoding it would throw me out. I guess I was mainly hoping if having the results of a large dataset that has already been hashed would help! – Nathan Nov 1 '12 at 8:03
  • Oh I should add that the output is always the same for the given input, it's a repeatable sequence. I only wish to find out what that sequence is. – Nathan Nov 1 '12 at 8:07

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.