Hashlash: MD5, SHA-256, bcrypt, Argon2

1 Hash Funksiya Nima?

2 Hash Algoritmlar Taqqoslanishi

import hashlib

# Turli hash algoritmlar
message = b"CTF{hash_me}"

print("MD5:    ", hashlib.md5(message).hexdigest())
print("SHA-1:  ", hashlib.sha1(message).hexdigest())
print("SHA-256:", hashlib.sha256(message).hexdigest())
print("SHA-512:", hashlib.sha512(message).hexdigest())
print("SHA3-256:", hashlib.sha3_256(message).hexdigest())
print("BLAKE2b:", hashlib.blake2b(message).hexdigest())

# Avalanche effektini ko'rish
a = hashlib.sha256(b"hello").hexdigest()
b = hashlib.sha256(b"Hello").hexdigest()  # Faqat 1 harf farq
print(f"Mos bitlar: {sum(x==y for x,y in zip(a,b))}/{len(a)}")
# ~0 ta mos bit — to'liq farq!

3 Parollarni Xavfsiz Saqlash

import bcrypt
from argon2 import PasswordHasher
import hashlib, os

# ============================
# bcrypt
# ============================
password = b"mysecretpassword"
hashed = bcrypt.hashpw(password, bcrypt.gensalt(rounds=12))
print(hashed)  # $2b$12$...

# Tekshirish (timing-safe)
bcrypt.checkpw(password, hashed)  # True

# ============================
# Argon2id (eng yaxshi tanlov)
# ============================
ph = PasswordHasher(
    time_cost=3,      # iteratsiya
    memory_cost=65536,# 64MB xotira
    parallelism=2,    # parallel iplar
    hash_len=32,
)
h = ph.hash("mypassword")
ph.verify(h, "mypassword")  # True yoki VerifyMismatchError

# ============================
# PBKDF2-HMAC-SHA256
# ============================
salt = os.urandom(32)
key = hashlib.pbkdf2_hmac(
    'sha256', password, salt,
    iterations=600_000  # NIST 2023 min
)

# NOTO'G'RI (hech qachon bunday qilmang!)
# bad_hash = hashlib.md5(password).hexdigest()
# bad_hash = hashlib.sha256(password).hexdigest()

4 Rainbow Table Hujumi va Tuz (Salt)

5 HMAC (Hash-based Message Authentication Code)

HMAC — hash funksiya + sir kalit birlashmasidir. Xabarning ham yaxlitligini, ham autentikligini ta'minlaydi. Odatiy hash faqat yaxlitlik (kim o'zgartirgani ko'rinmaydi) beradi — HMAC esa autentlik ham qo'shadi.

import hmac, hashlib

# HMAC yaratish
key = b"super_secret_key"
message = b"Hello, World!"

mac = hmac.new(key, message, hashlib.sha256)
print(mac.hexdigest())

# Tekshirish (timing-safe compare!)
def verify_hmac(key, message, received_mac):
    expected = hmac.new(key, message, hashlib.sha256).digest()
    # hmac.compare_digest — timing attack dan himoya
    return hmac.compare_digest(expected, received_mac)

# JWT misol (qo'lda)
import base64, json

def create_jwt(payload: dict, secret: str) -> str:
    header = base64.b64encode(json.dumps(
        {"alg": "HS256", "typ": "JWT"}).encode()
    ).rstrip(b'=')
    payload_b = base64.b64encode(
        json.dumps(payload).encode()
    ).rstrip(b'=')

    unsigned = header + b'.' + payload_b
    sig = hmac.new(secret.encode(), unsigned, hashlib.sha256).digest()
    sig_b = base64.b64encode(sig).rstrip(b'=')
    return (unsigned + b'.' + sig_b).decode()

jwt_token = create_jwt({"user": "alice"}, "mysecret")
print(jwt_token)

6 CTF: Hash Cracking

# MD5 dictionary attack
hashcat -m 0 hash.txt rockyou.txt

# SHA-256 brute force (6 raqam)
hashcat -m 1400 hash.txt -a 3 ?d?d?d?d?d?d

# bcrypt (m=3200)
hashcat -m 3200 hash.txt wordlist.txt

john --format=raw-md5 hash.txt
john --wordlist=rockyou.txt hash.txt
john --show hash.txt

import hashlib

# CTF: Dictionary attack
def crack_md5(target_hash, wordlist_file):
    with open(wordlist_file) as f:
        for line in f:
            word = line.strip()
            h = hashlib.md5(word.encode()).hexdigest()
            if h == target_hash:
                print(f"Topildi: {word}")
                return word
    return None

# CTF: Hash turini aniqlash
def identify_hash(h):
    h = h.strip()
    if h.startswith('$2b$') or h.startswith('$2a$'):
        return "bcrypt"
    elif h.startswith('$argon2'):
        return "Argon2"
    elif len(h) == 32 and all(c in '0123456789abcdef' for c in h):
        return "MD5"
    elif len(h) == 40:
        return "SHA-1"
    elif len(h) == 64:
        return "SHA-256"
    elif len(h) == 128:
        return "SHA-512"
    return "Noma'lum"

# CTF: Hash extension attack
# SHA-256(secret + message) → SHA-256(secret + message + padding + extra)
# hashpump yoki hlextend Python kutubxonasi
# hashpump -s hash -d data -a '&admin=true' -k 16

Bilimni Sinash