Hash Set

A hash set in Truxton is a sorted list of MD5 hashes that will be used to eliminate file content during exploitation. The hashes can be in a variety of formats.

Description

By maintaining lists of well-known file hashes, you can increase the speed of exploitation by ignoring file contents that will have no investigative value. For example, on a Windows computer, it will contain a file called kernel32.dll which is an executable file. It comes from Microsoft so we know it's contents won't contain anything of analytic value. If we encounter a file in our exploitation that has the same hash as one that came from Microsoft, we can safely ignore it. Truxton will save the meta data of every file it processes but if the hash matches one from a hash set, the contents will not be stored.

Format

Truxton supports a variety of formats for a hash set.