6

On the internet there is unsolved mystery of 3301/Cicada where decrypted text says:

"AN END. WITHIN THE DEEP WEB TH

ERE EXISTS A PAGE THAT HA

SHES TO:

36367763ab73783c7af284446c

59466b4cd653239a311cb7116

d4618dee09a8425893dc7500b

464fdaf1672d7bef5e891c6e227

4568926a49fb4f45132c2a8b4

IT IS THE DUTY OF EUERY PILGR

IM TO SEEK OUT THIS PAGE."

This potentially can be interpreted as the hash of an onion page.

Anyone of you know what this might refer to? Any way to find an onion/i2p address by hash rather than hashing the address and comparing it with the given hash?

Read more:

Related:

  • Just to be clear; this is an .onion address that has been hashed (again)? If so, I don't think there is any way of reversing it -I don't think you can even tell which has algorithm it is with certainty. – user3349 Aug 19 '14 at 5:15
  • We tried ^ and also harvested several onions It didn't work – user3449 Aug 20 '14 at 19:31
  • 1
    It's definitely an SHA512 hash. When you concatenate the strings, you get 36367763ab73783c7af284446c59466b4cd653239a311cb7116d4618dee09a8425893dc7500b464fdaf1672d7bef5e891c6e2274568926a49fb4f45132c2a8b4 – Aaron Esau Aug 25 '17 at 20:31
  • 1
    I scraped a bunch of lists of onion sites off google and tried several people's other lists, but to no avail. Currently running a spider too to try to find onion sites and hash them. – Aaron Esau Aug 25 '17 at 20:33
  • 1
    To those that claim the hashed page links to 1711141131131.xyz I call B.S. Please show your steps with its respective solution. – John Doe Dec 10 '19 at 23:31
3

First, you need to know what kind of hash it is.

Read more:

Assuming it's 512-bit SHA unsalted hash, then it'll be a bit tricky and it can take a lot of time, because it's not possible to decrypt the hashes - you've to crack them.

You may use dictionary attack or brutal force method to recover the original text from the Hash code.

Because the attack is very time consuming, you may consider to restrict as many possibilities you can by using dictionary attack.

By using a targeted technique (dictionary attack), you need to investigate or guess the expected output. Assuming it's in .onion format, you would expect the 16-character alpha-semi-numeric hash + a pseudo-top-level .onion domain. Read more: Where I can find, export or download the biggest list of all .onion addresses?.

Read the example:

Further more you can restrict the list by creating list of every page that has been online (e.g. some search engines, etc.). E.g. Ahmia.fi is gathering .onion addresses using various methods by crawling the hidden services, downloading visited page data from the Tor2web nodes, and users can use an HTML form to add new addresses.

So you can create a kind of script that reads a list of .onions, saves those into the text file. Then write the script to use the dictionary attack to crack the hash.

To increase the time, you may consider to run the attach in parallel (e.g. ask your friends or use the cloud computing).


Example of random attack in shell using Python (change 1234 to your hash):

while true; do python -c "import random,base64,codecs; print base64.b32encode(codecs.decode(codecs.encode('{0:020x}'.format(random.getrandbits(80))),'hex_codec')).lower() + '.onion';" | sha512sum; done | grep 1234

More examples, see: How to define 80-bit long variable in Python to generate random .onion addresses?

Example of dictionary attack in bash:

time cat sites.txt | xargs -L1 -I% -P4 sh -c "printf % | sha512sum" | grep 123

Where sites.txt is your file containing list of all onion addresses.

| improve this answer | |
2

I placed

36367763ab73783c7af284446c59466b4cd653239a311cb7116d4618dee09a8425893dc7500b464fdaf1672d7bef5e891c6e2274568926a49fb4f45132c2a8b4

into DDG and came across md5hashing.net.

Which when I decrypt the (whirlpool) hash I get a pastebin account with this downloadable file uRkNsGsa.htm.

The info from this file I can't get past the recapture on the md5hashing site but when I run the file normally, I get a site with a recapture that won't load so I am stuck.

| improve this answer | |
  • Could you re-post your answer at here? – kenorb Jul 12 '16 at 9:02
  • This doesn't answer the question. – cacahuatl Jul 20 '16 at 9:00
1

So I cracked the hash in the seeker message here are two links one for the union site and the other to a cryptic video perhaps you will have more luck than I did - W dxwd42hgpd7qrccm.onion < onion site in reference in the Primus and the corestponding link the onion takes you to https://1711141131131.xyz/

| improve this answer | |
  • Can you elaborate how? Can you link the video which you mention? – kenorb Aug 27 '19 at 12:29
1

The Onion address landing page produced from the hash [dxwd42hgpd7qrccm.onion] shows Lat/Long coordinates 51°29'56.4"N 0°09'41.0"W which resolves to the Ecuadorian Embassy in London where Julian Assange was held. The vault reference is likely to Wikileaks vault. Date is to left [4-7/19] is right around the time Wikileaks discovered the subterfuge.

The video at https://1711141131131.xyz/ needs to be downloaded and viewed frame by frame because there is a LOT of embedded/subliminal imagery there. Too much to describe here but is classic Cicada3301. The video "cicada_317.mp4" autoloads from index.html and can be saved from the console.

| improve this answer | |

Not the answer you're looking for? Browse other questions tagged or ask your own question.