Difference between revisions of "Hash Set"
(→Format) |
|||
| Line 8: | Line 8: | ||
If we encounter a file in our exploitation that has the same hash as one that came from Microsoft, we can safely ignore it. | If we encounter a file in our exploitation that has the same hash as one that came from Microsoft, we can safely ignore it. | ||
Truxton will save the meta data of every file it processes but if the hash matches one from a hash set, the contents will not be stored. | Truxton will save the meta data of every file it processes but if the hash matches one from a hash set, the contents will not be stored. | ||
| + | |||
| + | When using a hash set with Truxton, there is no need to designate a format. It will automatically figure it out. | ||
=Format= | =Format= | ||
| − | |||
Truxton supports a variety of formats for a hash set. | Truxton supports a variety of formats for a hash set. | ||
==Text== | ==Text== | ||
Truxton supports three different textual formats of hashset. | Truxton supports three different textual formats of hashset. | ||
| + | Text hash sets are very easy to produce, any text editor will do. | ||
| + | |||
| + | ===ASCII No Termination=== | ||
| + | This consists of 32 character ASCII hashes with nothing separating the entries. | ||
| + | |||
| + | ====Sample==== | ||
| + | <syntaxhighlight lang="txt">000102030405060708090A0B0C0D0E0F00112233445566778899AABBCCDDEEFF</syntaxhighlight> | ||
| + | |||
| + | ===ASCII Single Terminator=== | ||
| + | This consists of 32 character ASCII hashes with a single byte separating entries. | ||
| + | The byte can be of any value such as a [https://en.wikipedia.org/wiki/Carriage_return carriage return.] | ||
| + | |||
| + | ====Sample==== | ||
| + | <syntaxhighlight lang="txt">000102030405060708090A0B0C0D0E0F<CR> | ||
| + | 00112233445566778899AABBCCDDEEFF</syntaxhighlight> | ||
| + | |||
| + | ===ASCII Double Terminator=== | ||
| + | This consists of 32 character ASCII hashes with a two bytes separating entries. | ||
| + | These bytes can be of any value such as a [https://en.wikipedia.org/wiki/Newline carriage return line feed pair.] | ||
| + | |||
| + | ====Sample==== | ||
| + | <syntaxhighlight lang="txt">000102030405060708090A0B0C0D0E0F<CR><LF> | ||
| + | 00112233445566778899AABBCCDDEEFF</syntaxhighlight> | ||
==Binary== | ==Binary== | ||
| + | The binary format produces a hash set that is roughly half the size of the text version. | ||
| + | |||
| + | ===Big Endian High Low=== | ||
| + | |||
| + | ===Big Endian Low High=== | ||
| + | |||
| + | ===Little Endian High Low=== | ||
| + | |||
| + | ===Little Endian Low High=== | ||
==Commercial== | ==Commercial== | ||
| + | |||
| + | ===Encase=== | ||
| + | |||
| + | ===Autopsy=== | ||
| + | |||
| + | ===XWays=== | ||
Revision as of 06:27, 7 June 2020
A hash set in Truxton is a sorted list of MD5 hashes that will be used to eliminate file content during exploitation. The hashes can be in a variety of formats.
Description
By maintaining lists of well-known file hashes, you can increase the speed of exploitation by ignoring file contents that will have no investigative value.
For example, on a Windows computer, it will contain a file called kernel32.dll which is an executable file.
It comes from Microsoft so we know it's contents won't contain anything of analytic value.
If we encounter a file in our exploitation that has the same hash as one that came from Microsoft, we can safely ignore it.
Truxton will save the meta data of every file it processes but if the hash matches one from a hash set, the contents will not be stored.
When using a hash set with Truxton, there is no need to designate a format. It will automatically figure it out.
Format
Truxton supports a variety of formats for a hash set.
Text
Truxton supports three different textual formats of hashset. Text hash sets are very easy to produce, any text editor will do.
ASCII No Termination
This consists of 32 character ASCII hashes with nothing separating the entries.
Sample
000102030405060708090A0B0C0D0E0F00112233445566778899AABBCCDDEEFFASCII Single Terminator
This consists of 32 character ASCII hashes with a single byte separating entries. The byte can be of any value such as a carriage return.
Sample
000102030405060708090A0B0C0D0E0F<CR>
00112233445566778899AABBCCDDEEFFASCII Double Terminator
This consists of 32 character ASCII hashes with a two bytes separating entries. These bytes can be of any value such as a carriage return line feed pair.
Sample
000102030405060708090A0B0C0D0E0F<CR><LF>
00112233445566778899AABBCCDDEEFFBinary
The binary format produces a hash set that is roughly half the size of the text version.
