CryptoCoreRuns in the API, always on

Hash Identifier: Name the Family

  • easy
  • 100 pts
  • First blood: still open

When a password database or a forensic artefact turns up, the first question is often what kind of hash you are looking at. The answer decides which tools work, how fast an attacker could guess and how worried you should be.

The identifier shows 7 digests from several families: plain MD5, SHA-1, SHA-256 and SHA-512, and the password formats bcrypt, sha512crypt and Argon2id. You cannot tell them apart by what they hash, but you can by how they look. Plain digests differ in length. Password formats announce themselves with a prefix between dollar signs, and carry their cost settings and salt in the same string.

Name the family of every digest and send your verdicts. If every one is right, the server returns the flag; if not, it tells you how many are wrong, but never which.

The digests are generated for your instance and are not hashes of anything real. What you practise is triage: identify first, then decide.

  • hashing
  • password-hashing
  • triage

Hints

Hints do not affect your points. Each one stays revealed.

Hint 1
Hint 2
Hint 3
Jump to workbench
Loading the play area...