Any internet user will need to download files eventually, along with also most simply have faith of which what they are downloading is usually trustworthy. This specific doesn’t give much clarity into the contents of the file, yet if the file’s author published the original checksum, comparing This specific to the SHA-256 hash of the downloaded file can ensure nothing was tampered with.
When we have a file of which we need to audit against a checksum provided by the file’s author, we can use open source cryptographic software to calculate a checksum. Reviewing the checksum is usually used for situations where maybe you are at a sketchy website or you don’t know if your favorite site is usually being spoofed.
How a Hash Works
Data through a file to be checked is usually divided into 512-bit blocks, each block is usually passed through the SHA-256 algorithm along with also added to a sum, until there is usually no more data to be added to of which number. The final sum of This specific calculation is usually our checksum, also known as a hash. You can learn more about how hashing works from the video below.
In essence, when we calculate a hash This specific is usually a one-way cryptographic function, meaning a change to an individual bit will generate a brand new, seemingly random number of which is usually very hard to arrive at again. If you can cause two different files to generate the same checksum, This specific creates an extremely rare condition called a collision. This specific kind of attack is usually a weakness in SHA-1 along with also some other cryptographic functions yet takes significant time along with also resources to attempt to exploit.
In This specific article, I will demonstrate how to compare the SHA-256 hash of a file downloaded with the one provided by the file’s author first on a Windows system, along with also then on Kali Linux.
Step 1: Download 7-Zip to Calculate the Hash
The first thing we are going to do is usually download a program for Windows called 7-Zip. This specific tool isn’t only for comparing the checksum, yet also for compressing along with also decompressing files along with also folders. You can download of which through the 7-Zip download page. Make sure to download the most recent along with also stable type. This specific is usually a very simple to install, simply follow the on-screen prompts.
Step 2: Review the Checksum
Next, let’s compare a downloaded hash by going to a website of which displays the checksum for a download. just for This specific test, we will be using the download page of VLC media player for Windows. On their site, they helpfully display their checksum in a SHA-256 hash format by pressing the “Display Checksum” button.
Stay on This specific web page, as we’ll need to compare against of which number shortly. Let’s go to the folder where you downloaded the VNC installation file. After locating This specific, we just right-click on the file along with also scroll down to the part where This specific says “CRC SHA.”
We will need to choose the correct SHA algorithm, which VLC has provided on their website. In This specific case, we will select the SHA-256 option by clicking on This specific from the submenu.
Finally, This specific will show the outcome of the checksum. today, we’ll need to compare This specific value with the one we were provided by the website. Check back with the VLC website along with also locate the checksum to compare the values.
Don’t Miss: How to Crack Passwords, Part 3 (Using Hashcat)
If the contents of the file had been tampered with, the whole checksum would likely change, so I personally usually look at the last 4 characters. If the number has changed, then we know the download was tampered with or corrupted.
Step 3: Test a Hash on Kali Linux
today let’s open our favorite Linux distro, Kali Linux, along with also open up the browser.
To run our test, go to the Kali ISO downloads page to locate our example file to download. For a shorter download, we will be selecting the smallest ISO, the “Kali armel” image to download. You can choose to download This specific over HTTP or torrent.
Once the image has been downloaded, open up a terminal window along with also use cd to navigate to the folder where you downloaded the file to. There are many ways to unzip a file on Linux, yet what worked for me was a command included by default in Kali called “unxz”. Run the unxz command followed by the path to the file to unzip the ISO image you downloaded.
Don’t Miss: How To Break WPA/WPA2 Hashes via GPU
Once of which is usually extracted, we want to type the following into a terminal window.
Make sure “2017.1” is usually replaced with the current type you downloaded.
Hit return along with also the checksum for the file will be displayed from the terminal window. today, you can compare against the checksum provided by the website. They should match, as shown from the image below.
Threats Against Hashing
There are still attacks about using the checksum method, most recently SHA-1 was demonstrated to be vulnerable to a collision attack, so most users have switched to a brand new standard protocol that has a longer, more secure cryptographic algorithm called SHA-256. There could be people, at This specific moment, working on a generating a collision attack on SHA-256.
These techniques can be subverted by tactics like a Man-in-the-Middle attack. An attacker could simply comprise the web host for of which file, replace the real hash with the checksum of their own malicious file, or create a brand new hash with the attacker’s manipulated file’s checksum value along with also swap the file for the original on the site. This specific is usually exactly what happened to users who downloaded a compromised type of Linux Mint 17.3 Cinnamon edition, hosted on a compromised Bulgarian FTP server, so be careful out there!
SHA-256 — Your Second Set of Eyes
producing sure of which’s This specific, you can today confirm of which the download is usually in its true form, along with also was not manipulated in any way. This specific is usually just one of many methods for staying safe on the internet while downloading files. In reality, This specific is usually a way of being more aware of your surroundings, similar to protecting your PIN number at an ATM. Aside through defending against malicious hackers embedding malware into downloads, This specific also can be used to detect corrupted files.
Thanks for reading. Stay connected along with also check out our social accounts!
Screenshots provided by Nitrous / Null Byte