Good afternoon.
Welcome back.
Uh, we've talked about hashing, right?
We showed you how to use hashing.
If you remember, you can refer back to that video.
Uh, and we know that hashing has to do with file integrity.
We know that we can provide file integrity within a system.
We also call this a checksum.
Uh, we can use this in a variety of different ways.
We've shown you how you can download stuff, say the Kali VirtualBox.
Uh, and you can go through and give you a checksum, and then you can run that checksum or that hash
value on that program you downloaded to make sure that what the website is telling you versus what you
downloaded is exactly the same, and that if anything is in that file or in that program, changes that
you can detect it because the hash values won't match.
And we use that for file integrity on downloading.
We also use it for file integrity when we're talking about making sure that our system didn't change
system files, folders or executables within the operating system.
Now, this can be important if I've got malware or I suspect, malware or malicious activity within
my systems.
I can go through and I can use a program that will quite literally go through and provide a hashing
value for every file or folder on my system, or specific files and folders, depending on how I have
it set up.
And I can go through and make sure that nothing ever changes.
However, that's incredibly hard to go through and actually show, but we can show the manual process,
and that's what we're going to do today.
And we're going to use a program called hashed to accomplish this.
So I'm going to open up my terminal and let me blow it up so you can read my screen.
The first thing I'm going to do is I'm going to do an LZ.
And you can see here that I have a document called Total Sam.
Now it doesn't have to be a document.
It can be anything.
It's just for the purposes of today's exercise, a document makes more sense because we can go in there
and we can change it.
We could add to it.
We're not doing a lot to it.
Uh, and it still provides us the great experience that we're looking for.
Okay, so the first thing I want to do is I'm going to just do a cat total Sam, just so we can see
what's in it.
And you can see that I'm going to pass my CSA plus exam with flying colors.
Thanks, doctor.
Kay.
However, if I wanted to create an audit trail for this right, I could do a very slow, very painful
audit trail by just doing, say, a Sha 256 sum and then just total Sam.
Right.
And I could go through and I could grab this, and then I could put it in a word document or in a notepad,
and I could save it.
And then I could go back through later date to make sure it didn't change and compare.
And that's just a lot of work.
So instead of doing that for this specific thing, we're going to use a program called Hash Shape.
And this is what a lot of times what your system will do automatically if it's a good antivirus system
or if it's got those extra features associated with it.
Right.
So I'm going to do a hash dash just so we can see it.
This is the manual.
This is the help menu for it.
I always like to show this off so that if you get lost or if you want to do something more than what
I'm showing you here today, you can go back through and really explore this on your own.
All right.
The first command I want to do is actually create that audit trail.
So I'm going to do hashtag just like so.
And then I'm going to do the name of the file.
So total sim in this case.
And then I need to do an output I need to provide some type of output for that audit trail to look at.
So instead of just saving it to a text document and having to go through and copy and paste, it literally
goes through and does it for us with that greater than sign.
Right.
Uh, and so I should say that less than sign.
So let's go through let's create that.
I'm just going to do a total and then we'll just call it hash dot txt just like that.
And that's going to provide us with that document.
And we can see here right here.
And I do an LS total hash dot txt.
I can actually read that by typing the cat total sim or I should say total hash just like that.
And we can see that it provides us with the hash for this specific item, and it tells us what's going
on with it.
Uh, and the great part is, is it provides us multiple hashes Right.
So it's providing MD5 here.
Well if you look right here, it's providing us the size that's at 66.
It's providing us the MD5 hash.
Then it's providing us the Sha256 hash, and then it's telling us where the file name actually is in
the process.
Okay.
So we have the hash.
We have the audit trail that we wanted to associate with.
Next thing we want to do is we actually want to change it.
So I'm going to do well.
Let's do a let's check and make sure that it actually matches up.
So let's do a hash DB just like this.
We're going to do a tac a with the total sim just like so this is going to look at the file.
That's what the A is for.
It's saying hey I want to look at this specific file.
And then we have to tell it what to audit against.
So I'm going to do the total sim or I should say total hash dot txt.
Now we can see that the audit passed.
And that's great.
We wanted to pass.
Nothing changed in there.
But let's change it now.
And if I do leafpad and then total sim just like so oops.
There we go.
I could change something.
I'm just going to change.
And I'm going to add that, well, I'm going to add two exclamation marks at the end because why not.
Right.
Uh, and then I'm just going to do File.
Save its resaved.
And let's rerun that command now and it should fail.
And there it is.
It's failed now because the new hash, or the new checksum associated with the hashing file that we
associated with it didn't match up.
And so it does a failure in there.
Now our antivirus programs for file integrity or file integrity programs, depending on how you utilize
it based on those features, they do pretty much the same thing, except instead of doing one file per
or one hash or checksum file per file, they provide a full directory or list, sort of like a table
to cross analyze against it.
And they go through and they're really looking for the different hash values.
And if something does change, i.e. you gave it permission to change and it was supposed to, then it
goes through and it updates that table as needed.
We add files or we add directories.
It does a new hash or new checksum associated with it.
So this was a basic file integrity utilization using the program hash view.
I hope this made sense I hope it kind of clears things up for you.
Until next time, thanks again.