5

On the internet there is unsolved mystery of 3301/Cicada where decrypted text says:

"AN END. WITHIN THE DEEP WEB TH

ERE EXISTS A PAGE THAT HA

SHES TO:

36367763ab73783c7af284446c

59466b4cd653239a311cb7116

d4618dee09a8425893dc7500b

464fdaf1672d7bef5e891c6e227

4568926a49fb4f45132c2a8b4

IT IS THE DUTY OF EUERY PILGR

IM TO SEEK OUT THIS PAGE."

This potentially can be interpreted as the hash of an onion page.

Anyone of you know what this might refer to? Any way to find an onion/i2p address by hash rather than hashing the address and comparing it with the given hash?

Read more:

Related:

  • Just to be clear; this is an .onion address that has been hashed (again)? If so, I don't think there is any way of reversing it -I don't think you can even tell which has algorithm it is with certainty. – user3349 Aug 19 '14 at 5:15
  • We tried ^ and also harvested several onions It didn't work – user3449 Aug 20 '14 at 19:31
  • Heh heh, I was searching for the SHA1 hash on google trying to find the site, and I found this post. Hello, fellow solver. – Arin Aug 25 '17 at 20:30
  • 1
    It's definitely an SHA512 hash. When you concatenate the strings, you get 36367763ab73783c7af284446c59466b4cd653239a311cb7116d4618dee09a8425893dc7500b464fdaf1672d7bef5e891c6e2274568926a49fb4f45132c2a8b4 – Arin Aug 25 '17 at 20:31
  • 1
    I scraped a bunch of lists of onion sites off google and tried several people's other lists, but to no avail. Currently running a spider too to try to find onion sites and hash them. – Arin Aug 25 '17 at 20:33
2

First, you need to know what kind of hash it is.

Read more:

Assuming it's 512-bit SHA unsalted hash, then it'll be a bit tricky and it can take a lot of time, because it's not possible to decrypt the hashes - you've to crack them.

You may use dictionary attack or brutal force method to recover the original text from the Hash code.

Because the attack is very time consuming, you may consider to restrict as many possibilities you can by using dictionary attack.

By using a targeted technique (dictionary attack), you need to investigate or guess the expected output. Assuming it's in .onion format, you would expect the 16-character alpha-semi-numeric hash + a pseudo-top-level .onion domain. Read more: Where I can find, export or download the biggest list of all .onion addresses?.

Read the example:

Further more you can restrict the list by creating list of every page that has been online (e.g. some search engines, etc.). E.g. Ahmia.fi is gathering .onion addresses using various methods by crawling the hidden services, downloading visited page data from the Tor2web nodes, and users can use an HTML form to add new addresses.

So you can create a kind of script that reads a list of .onions, saves those into the text file. Then write the script to use the dictionary attack to crack the hash.

To increase the time, you may consider to run the attach in parallel (e.g. ask your friends or use the cloud computing).


Example of random attack in shell using Python (change 1234 to your hash):

while true; do python -c "import random,base64,codecs; print base64.b32encode(codecs.decode(codecs.encode('{0:020x}'.format(random.getrandbits(80))),'hex_codec')).lower() + '.onion';" | sha512sum; done | grep 1234

More examples, see: How to define 80-bit long variable in Python to generate random .onion addresses?

Example of dictionary attack in bash:

time cat sites.txt | xargs -L1 -I% -P4 sh -c "printf % | sha512sum" | grep 123

Where sites.txt is your file containing list of all onion addresses.

2

I placed

36367763ab73783c7af284446c59466b4cd653239a311cb7116d4618dee09a8425893dc7500b464fdaf1672d7bef5e891c6e2274568926a49fb4f45132c2a8b4

into DDG and came across md5hashing.net.

Which when I decrypt the (whirlpool) hash I get a pastebin account with this downloadable file uRkNsGsa.htm.

The info from this file I can't get past the recapture on the md5hashing site but when I run the file normally, I get a site with a recapture that won't load so I am stuck.

  • Could you re-post your answer at here? – kenorb Jul 12 '16 at 9:02
  • This doesn't answer the question. – cacahuatl Jul 20 '16 at 9:00

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.