Good afternoon. Welcome back.
Uh We've talked about hashing, right? We showed you how to use hashing.
If you remember, you can refer back to the video.
Uh And we know that hashing has to do with file integrity.
We know that we can provide file integrity within a system.
We also call this a checksum.
Uh We can use this in a variety of different ways.
We've shown you how you can download stuff, say the Cali dot VirtualBox
and you can go through and give you a checksum and then you can run
that checksum or that hash value on that program you downloaded to make
sure that what the website is telling you versus what you downloaded is exactly
the same and that if anything is in that file or in that
program changes that you can detect it because the hash values won't match.
And we use that for file integrity on download.
We also use it for file integrity when we're talking about making sure that
our system didn't change system files folders
or executables within the operating system.
Now,
this can be important if I've got malware or
I suspect malware or malicious activity within my systems,
I can go through and I can use a program
that will quite literally go through and provide a hashing value for
every file or folder on my system or specific files and folders,
depending on how I have it set up.
And I can go through and make sure that nothing ever changes.
However, that's incredibly hard to
go through and actually show,
but we can show the manual process and that's what we're going to do today.
And we're gonna use a program called hash sheet
to accomplish this. So I'm gonna open up my terminal
and let me blow it up so you can read my screen.
The first thing I'm gonna do is I'm gonna do an LS
and you can see here that I have a document called totalsem.
Now, it doesn't have to be a document. Give me anything.
It's just for the purposes of today's exercise.
A document makes more sense because we can go in there, we could change it,
we could add to it.
We're not doing a lot to it
and it still provides us the great experience that we're looking for. Ok.
So the first thing I want to do is I'm gonna just do a cat
tools.
I
just so we can see what's in it
and you can see that I'm going to pass my cys A plus exam with fly colors.
Thanks, Doctor K.
However, if I wanted to create an audit trail for this. Right. I could do a
very slow, very painful audit trail by just doing, say a shaw
256 sum and then just totals,
right?
And I could go through and I could grab this and then I could
put it in a word document or in a notepad and I could save it
and then I could go back through later date to make sure it didn't change. And
that's just a lot of work.
So instead of doing that for this specific thing,
we're gonna use a program called hash tape.
And this is what
a lot of times what your system will do
automatically if it's a good antivirus system or if
it's got those extra features associated with it,
right? So I'm gonna do a hash
just so we can see it. This is the manual, this is the help menu for it.
I would like to show this off so that if you get lost or
if you want to do something more than what I'm showing you here today,
you can go back through and really explore this on your own.
All right. The first command I want to do is actually create that audit trail.
So I'm going to do hash D
just like so
and then I need
to do the name of the file. So Totalsem in this case,
and then I need to do an output.
I need to provide some type of output for that audit trail to look at.
So instead of just saving it to a text document
and having to go through and copy and paste,
it literally goes through and does it for us with that reader downside, right.
And so I should say that less than sign.
So let's go through, let's create that.
I'm just gonna do a total
and then we'll just call it hash dot TXT just like that.
And that's gonna provide us with that document. And we can see here right here.
I do Ls Total hash dot TX CI can actually read that by typing the cat
photo
sim
or I should say total hash
just like that
and we can see that it provides us
with the hash for this specific item and it tells us what's going on with it.
Uh And the great part is it, it provides us multiple hashes, right? So providing MD5.
Yeah.
Well, if you look right here,
it's providing us the size that says 66 it's providing us the MD5 hash,
then it's providing us the sha 256 hash.
And then it's telling us where the file name actually is.
Ok. So we have the hash we have the audit trail that we wanted to associate with.
Next thing we want to do is we actually want to change it.
So I'm gonna do, well, let's do a,
let's check and make sure that it actually matches up.
So let's do a hash deep
just like this,
we're gonna do A T
A with the TOTALSEM
just like. So this is going to look at the file, that's what the A is for.
It's saying, hey,
I want to look at this specific file and then we have to tell it what to audit against.
So I'm going to do the total SIM or I should say total hash dot TXT.
Now, we can see that the audit passed and that's great. We want to pass.
Nothing changed in there, but let's change it now.
And if I do leafpad
and then totalsem
just like, so
oops, there we go.
I could change something. I'm just gonna change
and I'm gonna add that.
Well, I'm gonna add two exclamation marks at the end because why not? Right.
And then I'm just going to do file
save, it's res saved and let's rerun that command now
and it should fail and there it is, it's failed now because of the new
hash or the new checksum associated with the hashing file that we associate with. It
didn't match up. And so it does a failure in there
now. Or antivirus programs for file integrity or file integrity programs depend
on how you utilize it based on those features. They do pretty much the same thing
except instead of doing one file per or one hash or check some file per file,
they provide a full directory or list, sort of like a table,
cross analyze against it
and they go through and they're really looking for
the different hash values and if something does change,
ie you gave it permission to change and it was supposed to,
then it goes through and it updates that table as needed.
We add files or we add directories.
It does a new hash or new check some associated with it.
So this was a basic file integrity utilization using the program hash view.
I hope this made sense. I hope it kind of clears things up for you until next time.
Thanks again.