{"id":34075116,"url":"https://github.com/krontab/cisco-hashgen","last_synced_at":"2025-12-30T14:40:32.029Z","repository":{"id":308988756,"uuid":"1034654064","full_name":"Krontab/cisco-hashgen","owner":"Krontab","description":"Generate and verify Cisco-compatible password hashes for Cisco ASA \u0026 IOS/IOS-XE.","archived":false,"fork":false,"pushed_at":"2025-08-14T05:38:15.000Z","size":72,"stargazers_count":1,"open_issues_count":1,"forks_count":0,"subscribers_count":0,"default_branch":"main","last_synced_at":"2025-11-01T07:20:54.398Z","etag":null,"topics":["asa","cisco","cli","firewall","networking","one-way-hash-functions","pbkdf2","router","security","switch","type-5","type-8","type-9"],"latest_commit_sha":null,"homepage":"","language":"Python","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/Krontab.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null}},"created_at":"2025-08-08T18:46:03.000Z","updated_at":"2025-09-08T18:45:42.000Z","dependencies_parsed_at":"2025-08-09T05:31:11.837Z","dependency_job_id":"bbe68735-c1ca-422f-8b65-d80bf6c5eaf4","html_url":"https://github.com/Krontab/cisco-hashgen","commit_stats":null,"previous_names":["krontab/cisco-hashgen"],"tags_count":18,"template":false,"template_full_name":null,"purl":"pkg:github/Krontab/cisco-hashgen","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Krontab%2Fcisco-hashgen","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Krontab%2Fcisco-hashgen/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Krontab%2Fcisco-hashgen/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Krontab%2Fcisco-hashgen/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/Krontab","download_url":"https://codeload.github.com/Krontab/cisco-hashgen/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Krontab%2Fcisco-hashgen/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":27724156,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","status":"online","status_checked_at":"2025-12-14T02:00:11.348Z","response_time":56,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["asa","cisco","cli","firewall","networking","one-way-hash-functions","pbkdf2","router","security","switch","type-5","type-8","type-9"],"created_at":"2025-12-14T09:04:16.404Z","updated_at":"2025-12-14T09:04:17.280Z","avatar_url":"https://github.com/Krontab.png","language":"Python","funding_links":[],"categories":[],"sub_categories":[],"readme":"# cisco-hashgen\n\n[![PyPI version](https://img.shields.io/pypi/v/cisco-hashgen.svg)](https://pypi.org/project/cisco-hashgen/)\n[![Python versions](https://img.shields.io/pypi/pyversions/cisco-hashgen.svg)](https://pypi.org/project/cisco-hashgen/)\n[![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](LICENSE)\n[![CI](https://github.com/Krontab/cisco-hashgen/actions/workflows/ci.yml/badge.svg?branch=main)](https://github.com/Krontab/cisco-hashgen/actions/workflows/ci.yml)\n\n\u003c!-- Enable this once downloads look healthy :)\n[![Downloads](https://static.pepy.tech/badge/cisco-hashgen)](https://pepy.tech/project/cisco-hashgen)\n--\u003e\n\n\u003e Generate and verify Cisco-compatible password hashes for Cisco ASA \u0026 IOS/IOS-XE.\n\n**cisco-hashgen** supports the generation and verification of the following formats:\n\n- **Cisco ASA (PBKDF2-SHA512)** → `$sha512$\u003citer\u003e$B64(salt)$B64(dk16)`\n- **Cisco IOS/IOS-XE Type 5** (MD5-crypt) → `$1$\u003csalt\u003e$\u003chash\u003e`\n- **Cisco IOS/IOS-XE Type 8** (PBKDF2-SHA256) → `$8$\u003cCisco64(salt)\u003e$\u003cCisco64(dk32)\u003e`\n- **Cisco IOS/IOS-XE Type 9** (scrypt) → `$9$\u003cCisco64(salt)\u003e$\u003cCisco64(dk32)\u003e`\n\n## Capabilities\n\n- Generate password hashes discretely in a masked (non-echoing) terminal session.\n- Generate hashes offline and embed them in config templates.\n- Piped input/output for easy integration with other tools like [pass](https://www.passwordstore.org/), [ansible-vault](https://docs.ansible.com/ansible/latest/user_guide/vault.html), or [GitHub Actions](https://docs.github.com/en/actions/security-guides/encrypted-secrets).\n- Securely read passwords from the command line, shell, or environment variables.\n- Securely read passwords from the macOS Keychain.\n- Verify existing hashes offline without touching the device. (audit mode, brute force)\n\n## Why this exists\n\n1) **Generate Cisco-compatible hashes from any system**  \n   - Now you don't have to have a Cisco switch or router to generate hashes.  \n2) **Bootstrap device configs without plaintext passwords**\n   - Pre-generate hashes offline and embed them in config templates.   \n   - No more storing or echoing the clear text password.\n3) **Verify existing hashes offline**  \n   - Check if a password matches a Cisco hash without touching the device.\n   - Script out the verification process of many password hashes looking for matches. \n4) **Shoulder surfing and screen share privacy**\n   - Generate a valid hash with cisco-hashgen which masks your input by default. \n   - All you see is the hash which you paste into your config or command line.\n\n\u003e 💡 Hashes are only as strong as the password and parameters. Prefer long, random passphrases; keep iteration counts at Cisco defaults (or higher where supported); and protect generated hashes like any credential artifact.\n\n## ⚠️ Cautions\n- Hashes produced by this tool ***should*** be able to be used on many Cisco switches, routers, and firewalls but ***please*** test thoroughly before using in production.\n- This tool does not support Type 1, 2, 3, 4, or 6. (yet)\n\n## 🚀 Quick Install\n\n**Recommended:** Use [pipx](https://pipx.pypa.io/) to install in an isolated environment.\nThis avoids dependency conflicts and works the same on Linux, macOS, and Windows.\n\n### Ubuntu / Debian\n```text\nsudo apt update\nsudo apt install pipx\npipx ensurepath\npipx install cisco-hashgen\n```\n\n### macOS (Homebrew)\n```text\nbrew install pipx\npipx ensurepath\npipx install cisco-hashgen\n```\n\n### Windows (PowerShell)\n```powershell\npython -m pip install --user pipx\npython -m pipx ensurepath\npipx install cisco-hashgen\n```\n\n### Verify installation\n```text\ncisco-hashgen --help\n```\n\n\u003e 💡 If you cannot use pipx, you can still install with:\n```text\n# Linux/macOS\npython3 -m pip install --user cisco-hashgen\n\n# Windows\npython -m pip install --user cisco-hashgen\n\n# On Debian/Ubuntu you may need:\npython3 -m pip install --user cisco-hashgen --break-system-packages\n```\n\n## Quick start\n\n### Generate ASA (PBKDF2-SHA512)\nDefault operation is interactive password input (password is masked)\n\n```text\n~ \u003e\u003e cisco-hashgen -asa\nCisco HashGen v2.0.1rc2 — Generate and verify Cisco-compatible hashes\n  ASA PBKDF2-SHA512 defaults: iterations=5000, salt-bytes=16\n  IOS/IOS-XE Type 5 (MD5-crypt)\n  IOS/IOS-XE Type 8 PBKDF2-SHA256 defaults: iterations=20000, salt-bytes=10\n  IOS/IOS-XE Type 9 (scrypt) defaults: N=16384, r=1, p=1, salt-bytes=10\n  Validation: minlen=8, maxlen=1024\n\n[Generating ASA PBKDF2-SHA512 hash]\nEnter password: ********\nRetype to confirm: ********\n$sha512$5000$ICO3MWp5LADdvY85gGkqYA==$kji0GEgm5nHqKum7VmoY/w==\n```\n\u003e💡 Note: cisco-hashgen defaults to -asa output, but you can specify -asa for clarity.\n\n### Generate IOS/IOS-XE Type 9 (ASCII Salt) and use hash in configuration\n```text\n~ \u003e\u003e cisco-hashgen -ios9 -ios9-salt-mode ascii -quiet\nEnter password: ********\nRetype to confirm: ********\n$9$cFiaINGxv8Gp4U$qG0lKpyM56WpYvZ1B2IY8LX6fInUsHs5NmRbVpyqHDQ\n\n# From Cisco device\nswitch1#configure terminal\nswitch1(config)#username admin secret 9 $9$cFiaINGxv8Gp4U$qG0lKpyM56WpYvZ1B2IY8LX6fInUsHs5NmRbVpyqHDQ\n```\n\n### Verify a hash (auto-detects hash type!) \n```text\n\u003e\u003e cisco-hashgen -v '$sha512$5000$ICO3MWp5LADdvY85gGkqYA==$kji0GEgm5nHqKum7VmoY/w=='\n[Verifying ASA PBKDF2-SHA512 hash]\n[Enter password to verify against ASA PBKDF2-SHA512]\nEnter password to verify: ********\n[+] Password matches.\n```\n\n### One-liner verify (stdin + -v) - Insecure / Password is visible\n```text\necho 'My S3cr3t!' | cisco-hashgen -v '$8$HxHoQOhOgadA7E==$HjROgK8oWfeM45/EHbOwxCC328xBBYz2IF2BevFOSok=' \n[Verifying IOS/IOS-XE Type 8 PBKDF2-SHA256 hash]\n[+] Password matches.\n```\n\u003e 💡 This above example illustrates the tool's flexibility for stdin/stdout. When executed this way, the password is displayed on screen and likely saved in the terminal history or process list. See more secure methods below.\n\n## Supplying passwords securely\n\n### A) Interactive (masked, safest)\n```text\ncisco-hashgen -asa\n```\n\n### B) Shell read (no secret in history)\n```text\nread -rs PW \u0026\u0026 printf '%s' \"$PW\" | cisco-hashgen -asa -quiet \u0026\u0026 unset PW\n# or use env var:\nread -rs PW \u0026\u0026 CISCO_HASHGEN_PWD=\"$PW\" cisco-hashgen -ios8 -env CISCO_HASHGEN_PWD -quiet \u0026\u0026 unset PW\n```\n\n### C) macOS Keychain (GUI → CLI)\n1. Open **Keychain Access** → add a new password item (e.g., Service: `HASHGEN_PW`).\n2. Use it without revealing plaintext:\n```text\nsecurity find-generic-password -w -s HASHGEN_PW | cisco-hashgen -asa -quiet\n```\n3. Remove later with: `security delete-generic-password -s HASHGEN_PW`\n\n### D) pass (Password Store)\n```text\nbrew install pass gnupg\ngpg --quick-generate-key \"Your Name \u003cyou@example.com\u003e\" default default never\ngpg --list-secret-keys --keyid-format LONG\npass init \u003cYOUR_LONG_KEY_ID\u003e\n\npass insert -m network/asa/admin \u003c\u003c'EOF'\nStr0ngP@ss!\nEOF\n\npass show network/asa/admin | head -n1 | cisco-hashgen -ios8 -v\n```\n\n### E) CI secret environment variable (GitHub Actions)\n```yaml\n- name: Generate ASA hash\n  env:\n    CISCO_HASHGEN_PWD: ${{ secrets.CISCO_HASHGEN_PWD }}\n  run: |\n    cisco-hashgen -asa -env CISCO_HASHGEN_PWD -quiet \u003e hash.txt\n```\n\n## Quoting cheatsheet (very important)\n\n- Always **single-quote** `$sha512...` / `$8$...` hashes to avoid `$` expansion:\n  ```text\n  cisco-hashgen -v '$sha512$5000$...$...'\n  ```\n- For passwords with spaces or shell characters, prefer interactive input, `read -rs`, Keychain, or `pass`.\n- If you must put a password on the command line (not recommended), single-quote it; if it contains a single quote, use:\n  ```text\n  'pa'\"'\"'ss'\n  ```\n\n## CLI\n\n```text\ncisco-hashgen -h\nusage: cisco-hashgen [-h] [-asa | -ios5 | -ios8 | -ios9] [-verify HASH] [-iter ITER] [-salt-bytes SALT_BYTES]\n                     [--ios9-salt-mode {cisco64,ascii,stdb64}] [-minlen MINLEN] [-maxlen MAXLEN] [-pwd STRING]\n                     [-env VAR] [-quiet] [-no-color] [-no-prompt] [-V] [-ios9-debug]\n```\n\n### options\n- `-h, --help` — show this help message and exit\n- `-asa` — Generate ASA PBKDF2 (SHA-512) hash (default).\n- `-ios5` — Generate IOS/IOS-XE Type 5 (MD5-crypt) hash.\n- `-ios8` — Generate IOS/IOS-XE Type 8 (PBKDF2-SHA256) hash.\n- `-ios9` — Generate IOS/IOS-XE Type 9 (scrypt) hash.\n- `-verify, -v HASH` — Verify a password against an existing hash.\n- `-iter ITER` — Override iterations (default: ASA=5000, IOS8=20000).\n- `-salt-bytes SALT_BYTES` — Override salt length in bytes (default: ASA=16, IOS8=10, IOS9=10).\n- `-ios9-debug` — Enable maximum IOS9 verify diagnostics\n- `-ios9-salt-mode` `{cisco64, ascii, stdb64}` — IOS9 salt field mode.  \n  - **cisco64** (default) stores Cisco64 text and uses decoded bytes for KDF.\n  - **ascii** stores Cisco64 text but uses the literal ASCII text for KDF;\n  - **stdb64** stores StdBase64 text and uses that literal ASCII for KDF.\n- `-minlen MINLEN` — Minimum password length (default: 8).\n- `-maxlen MAXLEN` — Maximum password length (default: 1024).\n- `-pwd STRING` — Password provided directly (quote if it contains spaces/shell chars).\n- `-env VAR` — Read password from environment variable VAR.\n- `-quiet` — Suppress banners and extra output (script-friendly).\n- `-no-color` — Disable ANSI colors in help/banners.\n- `-no-prompt` — Fail if no password is provided via stdin/-pwd/-env (no interactive prompt).\n- `-V, --version` — show program's version number and exit\n\n## Exit codes\n- `0` — Success / verified match  \n- `1` — Verify mismatch  \n- `2` — Unsupported/invalid hash format  \n- `3` — Password validation error  \n- `4` — No password provided and `-no-prompt` set  \n- `130` — User interrupted (Ctrl-C)\n\n## Technical notes\n\n- **ASA**: PBKDF2-HMAC-SHA512; iterations stored; salt Base64; **first 16 bytes** of DK stored.  \n  _Why it matters_: Only a portion of the derived key is stored, so reproducing the hash requires exact PBKDF2 parameters and truncation behavior.\n\n- **IOS/IOS-XE Type 5**: MD5-based crypt (`md5crypt`); 1000 iterations (fixed); salt up to 8 chars; Cisco Base64 alphabet (`./0..9A..Za..z`).  \n  _Why it matters_: Legacy format, still seen on older systems; uses a fixed iteration count and short salts, making it less secure but widely compatible.\n\n- **IOS/IOS-XE Type 8**: PBKDF2-HMAC-SHA256; **20000** iterations (fixed); salt 10 bytes; Cisco Base64 alphabet (`./0..9A..Za..z`).  \n  _Why it matters_: Modern, strong PBKDF2 with fixed parameters; hash reproduction must match iteration count exactly.\n\n- **IOS/IOS-XE Type 9 – Canonical**: scrypt (N=16384, r=1, p=1); salt 14 bytes; Cisco Base64 alphabet (`./0..9A..Za..z`).  \n  _Why it matters_: Strongest Cisco hash; requires exact scrypt parameters and binary salt encoding for compatibility.\n\n- **IOS/IOS-XE Type 9 – ASCII Salt**: scrypt (N=16384, r=1, p=1); salt literal ASCII (non-canonical but accepted by some platforms); salt length 14 chars; Cisco Base64 alphabet for hash output only.  \n  _Why it matters_: Some devices expect ASCII salt rather than binary; essential for login compatibility on these picky systems.\n\n- **IOS/IOS-XE Type 9 – Mixed Salt**: scrypt (N=16384, r=1, p=1); salt may contain printable ASCII + Cisco64 characters (non-canonical); length still 14; Cisco Base64 alphabet for hash output.  \n  _Why it matters_: Rare variant; sometimes seen when salts are generated inconsistently; necessary to replicate for exact hash matching.\n\n## Supported Platforms\n- Python 3.8+ (tested on 3.8–3.13)  \n- macOS / Linux / Windows\n\n## License\nCisco-Hashgen is available under the MIT license. See the LICENSE file for details.\nAuthor: Gilbert Mendoza\n\n## Changelog\nSee the [docs/releases](docs/releases/) folder for complete version history, or visit the [GitHub Releases](https://github.com/Krontab/cisco-hashgen/releases) page.\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fkrontab%2Fcisco-hashgen","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fkrontab%2Fcisco-hashgen","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fkrontab%2Fcisco-hashgen/lists"}