Hash Set

A hash set in Truxton is a sorted list of MD5 hashes that will be used to eliminate file content during exploitation. The hashes can be in a variety of formats.

Description

By maintaining lists of well-known file hashes, you can increase the speed of exploitation by ignoring file contents that will have no investigative value. For example, on a Windows computer, it will contain a file called kernel32.dll which is an executable file. It comes from Microsoft so we know it's contents won't contain anything of analytic value. If we encounter a file in our exploitation that has the same hash as one that came from Microsoft, we can safely ignore it. Truxton will save the meta data of every file it processes but if the hash matches one from a hash set, the contents will not be stored.

When using a hash set with Truxton, there is no need to designate a format. It will automatically figure it out.

Format

Truxton supports a variety of formats for a hash set.

Text

Truxton supports three different textual formats of hashset. Text hash sets are very easy to produce, any text editor will do.

ASCII No Termination

This consists of 32 character ASCII hashes with nothing separating the entries.

Sample

000102030405060708090A0B0C0D0E0F00112233445566778899AABBCCDDEEFF

ASCII Single Terminator

This consists of 32 character ASCII hashes with a single byte separating entries. The byte can be of any value such as a carriage return.

Sample

000102030405060708090A0B0C0D0E0F<CR>
00112233445566778899AABBCCDDEEFF

ASCII Double Terminator

This consists of 32 character ASCII hashes with a two bytes separating entries. These bytes can be of any value such as a carriage return line feed pair.

Sample

000102030405060708090A0B0C0D0E0F<CR><LF>
00112233445566778899AABBCCDDEEFF

Binary

The binary format produces a hash set that is roughly half the size of the text version.