Unit 1: Encoding, hashing and encryption · Lesson 4 of 5 · 20 min
What is this file?
Sort six unknown files into hash, encoding, ciphertext and key by their shape alone.
mission
- You are
- You are helping the incident team triage files from a shared drive.
- Situation
- Six files were found in a folder called
artifacts. Nobody remembers what they are, and the team needs to know which ones hold anything sensitive. - Goal
- Identify each file without guessing passwords or keys.
- Hand in
- A one-line label per file.
Ask file first
file reads magic bytes and headers. It recognises PEM keys, PGP messages and the OpenSSL salted format.
file artifacts/*
artifacts/a1.txt: ASCII text
artifacts/a2.txt: ASCII text
artifacts/a3.bin: openssl enc'd data with salted password
artifacts/a4.pem: ASCII text
artifacts/a5.asc: PGP message Symmetric-Key Encrypted Session Key (old)
artifacts/a6.txt: ASCII text
Read the first bytes
Encrypted files often start with a fixed header. OpenSSL's passphrase format begins with the ASCII text Salted__, followed by an 8-byte salt.
xxd artifacts/a3.bin | head -2
00000000: 5361 6c74 6564 5f5f 0aa4 4152 4a31 6f6e Salted__..ARJ1on
00000010: ea48 ad1b a4c9 60e2 6872 7ceb 07b1 e844 .H....`.hr|....D
you should see Salted__ then random-looking bytes.
Check the armour lines
head -1 artifacts/a4.pem artifacts/a5.asc
==> artifacts/a4.pem <==
-----BEGIN PUBLIC KEY-----
==> artifacts/a5.asc <==
-----BEGIN PGP MESSAGE-----
you should see A public key, which is safe to share, and a PGP message, which is encrypted.
Measure the hash candidate
A hex string of exactly 64 characters is almost always SHA-256. 32 is MD5, 40 is SHA-1, 128 is SHA-512.
cat artifacts/a1.txt 78fd3937f5714fddf2570d3fd630dd851642e2a0915d595f87d5f796d50a2151 tr -d '\n' < artifacts/a1.txt | wc -c 64
Decode the two encodings
base64 -d artifacts/a2.txt Shipment 4471 leaves dock 3 at 06:00 python3 -c 'import sys,urllib.parse;print(urllib.parse.unquote(open(sys.argv[1]).read().strip()))' artifacts/a6.txt user=ana@fernhill.example&role=viewer
defender tip Base64 and URL encoding hid readable data in plain sight. Label those as sensitive if the content is.
Shapes to recognise
| Command | What it does |
|---|---|
64 hex characters | SHA-256 hash |
Salted__ header | openssl enc ciphertext |
-----BEGIN PUBLIC KEY----- | Public key, shareable |
-----BEGIN PGP MESSAGE----- | GnuPG encrypted message |
A-Z a-z 0-9 + / = | Base64 |
%3D %40 %26 | URL encoding |
What a defender takes away
- 1Headers and lengths identify most crypto files.
- 2Ciphertext and keys need protecting, encodings need decoding before you judge them.
- 3Never try to guess passwords on evidence. Ask the owner.
Questions
0 of 3 solved
Answer each one from what you find on your lab machine.