TryHackMe: Hashing Basics

Overview

Room: Hashing Basics
Difficulty: Easy
Platform: TryHackMe
Path: Cyber Security 101 > Cryptography

What is Hashing?

A hash function takes an input of arbitrary size and produces a fixed-length output called a hash value. Key properties:

• Deterministic — same input always produces the same output
• One-way — you cannot reverse a hash to recover the original input
• Avalanche effect — a single bit change in the input produces a completely different hash
• Fixed output size — regardless of input length, the output is always the same size

Common use cases: password storage, file integrity verification, digital signatures, and data deduplication.

Task 2 — Hash Functions

Hash functions produce a fixed-size digest. Some common algorithms:

If a hash function has an 8-bit output, there are 2^8 = 256 possible hash values. The smaller the output, the higher the collision probability.

# Compute SHA256 hash of a file
sha256sum passport.jpg

# Compute MD5
md5sum passport.jpg

Task 3 — Insecure Password Storage

The RockYou breach is the canonical example of why plaintext password storage is catastrophic. RockYou stored millions of user passwords in plaintext; when breached, those passwords became the rockyou.txt wordlist — now a standard tool in every pentester’s toolkit, sitting at /usr/share/wordlists/rockyou.txt on Kali Linux.

Other insecure patterns:

• Plaintext storage — no protection at all
• Encryption — reversible with the key; wrong tool for passwords
• Unsalted MD5/SHA1 — fast to crack; rainbow tables work directly against them

# View first 20 entries in rockyou.txt
head -n 20 /usr/share/wordlists/rockyou.txt

Task 4 — Secure Password Storage with Hashing

Proper password storage uses:

• Slow hashing algorithms — bcrypt, scrypt, Argon2, yescrypt. Deliberately computationally expensive to slow down brute-force attempts.
• Salting — a unique random value added to each password before hashing. Prevents rainbow table attacks and ensures identical passwords produce different hashes.

A rainbow table is a precomputed lookup table mapping hashes back to plaintext. Salting defeats this entirely since the attacker would need a separate table per unique salt.

Why not encrypt passwords?
Encryption is reversible. If the key is compromised, all passwords are exposed. Hashing is one-way by design — the system never needs to recover the original password, only verify it.

Task 5 — Recognising Password Hashes

Hash formats follow identifiable patterns, particularly on Linux and network devices:

Tools for identification:

• hash-identifier — Python tool, included in Kali
• hashid — more accurate, supports more formats
• Hashcat’s example hashes page (referenced in hashcat --example-hashes)

Task 6 — Password Cracking

hashcat is the go-to GPU-accelerated password cracker. Syntax:

hashcat -m <mode> <hashfile> <wordlist>

Common mode numbers:

Cracking the Task 6 hashes:

# hash1.txt — bcrypt ($2a$)
hashcat -m 3200 hash1.txt /usr/share/wordlists/rockyou.txt

# hash2.txt — SHA2-256
hashcat -m 1400 hash2.txt /usr/share/wordlists/rockyou.txt

# hash3.txt — sha512crypt ($6$)
hashcat -m 1800 hash3.txt /usr/share/wordlists/rockyou.txt

# hash4.txt — MD5
hashcat -m 0 hash4.txt /usr/share/wordlists/rockyou.txt

Online tools like hashes.com are useful for quick MD5/SHA1 lookups against precomputed databases.

Task 7 — Hashing for Integrity Checking

Hash functions are used to verify that files have not been tampered with. Software projects publish SHA256 checksums alongside downloads — you compute the hash of what you downloaded and compare it against the published value.

# Verify a downloaded file
sha256sum libgcrypt-1.11.0.tar.bz2

# Compare against published hash
echo "09120c9867ce7f2081d6aaa1775386b98c2f2f246135761aae47d81f58685b9c  libgcrypt-1.11.0.tar.bz2" | sha256sum --check

HMAC (Hash-based Message Authentication Code) extends this further by combining a hash function with a secret key. It provides both:

• Integrity — data has not been altered
• Authenticity — data came from someone who holds the key

Used in TLS, API authentication, VPN tunnel verification (TryHackMe’s own VPN uses HMAC-SHA512).

Task 8 — Conclusion

Base64 is commonly confused with encryption but it is purely encoding — reversible with no key required. It is used to represent binary data as ASCII text (email attachments, JWT tokens, etc.).

# Decode base64
base64 -d ~/Hashing-Basics/Task-8/decode-this.txt

# Encode to base64
echo "ENcodeDEcode" | base64

Flags / Answers

Key Takeaways

• MD5 and SHA-1 are broken for security purposes — never use them for passwords or signatures
• Always salt passwords before hashing; salting defeats rainbow table attacks entirely
• Use purpose-built slow algorithms (bcrypt, scrypt, Argon2, yescrypt) for password storage — never fast hashes like MD5/SHA-256 raw
• $2a$ = bcrypt, $6$ = sha512crypt, $9$ = scrypt (Cisco) — learn to recognise these on sight
• hashcat with rockyou.txt cracks weak passwords in seconds; strong unique passwords with proper salting are the only real defence
• SHA256 checksums on downloads are your first line of defence against supply chain tampering