How to implement and verify checksums on Linux

PublishedJune 15, 2022

•3 min read•View as Markdown

How to implement and verify checksums on Linux

Joshua Cole

Comments

Join the discussion

No comments yet. Be the first to comment.

More from this blog

How to Reverse Engineer Stripped Binaries Easily Using GDB

During in the process of reverse engineering binaries, a common problem arises. How do I reverse engineer stripped binaries? There are no symbols to break on, offsets change, scripts don't work, and you ask yourself why am I doing this? Luckily there...

Sep 8, 20246 min read

How to Reverse Engineer Stripped Binaries Easily Using GDB

Pwning 0x01: C Typecasting

When I was learning how to tackle pwn challenges in CTFs, I had a tough time finding a single, clear guide that could show me the ropes of actually carrying out these exploits. That's why I decided to put together a complete guide that covers everyth...

Nov 1, 202310 min read

Exfiltrating Data using Light

Using python to capture and project data

Feb 5, 20235 min read

PicoCTF 2022: Buffer Overflow 1

Intro This is a write-up for PicoCTF 2022: Buffer Overflow 1. This is one of my favourite challenges to do. I recommend solving it for yourself before you read this write-up. What is a Buffer Overflow? Before we get started we need to first know what...

Sep 30, 20226 min read

Making a $2 BadUSB (USB Rubber Ducky)

What is a BadUSB? A BadUSB is a USB device that acts as a keyboard and injects preprogrammed keystrokes into a computer. A BadUSB is Indistinguishable from a generic keyboard, making it near impossible to detect and patch. You can setup reverse shell...

Sep 17, 20223 min read

Joshua Cole's Blog

24 posts

What are checksums and why do you need them?

Checksums are critically important if you want to make sure the data you have downloaded hasn't been corrupted or tampered with. Checksums are created by hash algorithms like SHA256 or MD5 directly from a file you want to verify. All you need to know about hashes is that given the exact same file, they will reproduce the exact same string of characters. If you change one character in the file the hash will be completely different. This is shown in the example below.

[root@desktop]# echo "I love checksums." | md5sum 26d1fe18b4d5414232e6707acdfc5d3b - [root@desktop]# echo "I love checksums" | md5sum 062753536863028865f43f4fe6e13719 -

Checksums even work on look-alikes. In the example below, I have changed the "o" in "loves" to the look-alike "о".

[user@desktop# echo "Everyone loves checksums" | md5sum 9b3a59a06b590390167ae1dcecdb9381 - [user@desktop]# echo "Everyone lоves checksums" | md5sum 0600be673d633072ab7fb6c223eb27d3 -

What are the common utilities and hash algorithms used?

The most common hashing algorithms used in checksums are MD5 and SHA256. You will know the difference between the hashes by the number of characters. MD5 hashes are 32 characters long. A SHA256 hash will produce a 64-character long hash. If available, use the SHA256 hash as it is a more secure algorithm than MD5.

Generally, most systems on Linux will have "sha256sum" and "md5sum" installed by default. Another great utility is gtkhash, although you do have to install it on your Linux machine yourself. Here is a good tutorial about checksums on windows.

Checking Checksums

When downloading a file, generally they will have a checksum page near the download area. This is shown on the VirtualBox website below.

You would then grab the line for the specific file you have.

You then put this text into a file in the same directory as your download. In this case, my file name was sum.sha256. After that, you now need to run sha256sum -c sum.sha256. The -c flag reads from the hash file and checks the download.

[user@desktop]$ nano sum.sha256 [user@desktop]$ sha256sum -c sum.sha256 virtualbox-6.1_6.1.34-150636.1~Ubuntu~jammy_amd64.deb: OK

It outputs that the file has not been corrupted or tampered with.

No matter whether you have an MD5 or SHA512, the commands will be very similar. All you need to switch out is the sha256sum command with md5sum or sha512sum command.

How to implement and verify checksums on Linux

Comments

More from this blog

How to Reverse Engineer Stripped Binaries Easily Using GDB

Pwning 0x01: C Typecasting

Exfiltrating Data using Light

PicoCTF 2022: Buffer Overflow 1

Making a $2 BadUSB (USB Rubber Ducky)

What are checksums and why do you need them?

What are the common utilities and hash algorithms used?

Checking Checksums

Generating Checksums

Closing Notes

Command Palette

Comments

More from this blog

What are checksums and why do you need them?

What are the common utilities and hash algorithms used?

Checking Checksums

Generating Checksums

Closing Notes