Difference between revisions of "Hash Set"
(Created page with "A hash set in Truxton is a sorted list of [https://en.wikipedia.org/wiki/MD5 MD5] hashes that will be used to eliminate file content during exploitation. The hashes can be in...") |
(→Format) |
||
| Line 12: | Line 12: | ||
Truxton supports a variety of formats for a hash set. | Truxton supports a variety of formats for a hash set. | ||
| + | |||
| + | ==Text== | ||
| + | Truxton supports three different textual formats of hashset. | ||
| + | |||
| + | ==Binary== | ||
| + | |||
| + | ==Commercial== | ||
Revision as of 05:38, 7 June 2020
A hash set in Truxton is a sorted list of MD5 hashes that will be used to eliminate file content during exploitation. The hashes can be in a variety of formats.
Description
By maintaining lists of well-known file hashes, you can increase the speed of exploitation by ignoring file contents that will have no investigative value.
For example, on a Windows computer, it will contain a file called kernel32.dll which is an executable file.
It comes from Microsoft so we know it's contents won't contain anything of analytic value.
If we encounter a file in our exploitation that has the same hash as one that came from Microsoft, we can safely ignore it.
Truxton will save the meta data of every file it processes but if the hash matches one from a hash set, the contents will not be stored.
Format
Truxton supports a variety of formats for a hash set.
Text
Truxton supports three different textual formats of hashset.
