# MD5 Hashing
**URL:** https://community.zeek.org/t/md5-hashing/2261
**Category:** Zeek
**Created:** [March 13, 2012, 6:22pm UTC](https://community.zeek.org/t/md5-hashing/2261 "2012-03-13T18:22:38Z")
**Posts on this page:** 7
**Page:** 1
### Author:  [@Chris\_Crawford](https://community.zeek.org/u/Chris_Crawford)
#### Post date: [March 13, 2012, 6:22pm UTC](https://community.zeek.org/t/md5-hashing/2261/1 "2012-03-13T18:22:38Z")
What is the correct way to turn on MD5 hashing in SMTP and HTTP logs?
Which variables do I need to set in my share/bro/site/local.bro ?
-Chris
---
### Author:  [@Seth\_Hall3](https://community.zeek.org/u/Seth_Hall3)
#### Post date: [March 13, 2012, 6:55pm UTC](https://community.zeek.org/t/md5-hashing/2261/2 "2012-03-13T18:55:42Z")
# Windows executables are hashed by default (it's a regex matching the mime type of the file)
redef HTTP::generate\_md5 += /image.\*/;
redef SMTP::generate\_md5 += /image.\*/;
Those were pulled from these pages in our docs…
[http://www.bro-ids.org/documentation/scripts/base/protocols/http/file-hash.html#id-HTTP::generate\_md5](http://www.bro-ids.org/documentation/scripts/base/protocols/http/file-hash.html#id-HTTP::generate_md5)
[http://www.bro-ids.org/documentation/scripts/base/protocols/smtp/entities.html#id-SMTP::generate\_md5](http://www.bro-ids.org/documentation/scripts/base/protocols/smtp/entities.html#id-SMTP::generate_md5)
This is being seriously reworked for 2.1 right now too. There is going to be a file analysis policy where you will be able to be declare more easily with much better granularity when you'd like to do certain analyses.
.Seth
---
### Author:  [@Chris\_Crawford](https://community.zeek.org/u/Chris_Crawford)
#### Post date: [March 13, 2012, 7:24pm UTC](https://community.zeek.org/t/md5-hashing/2261/3 "2012-03-13T19:24:05Z")
Sounds simple enough.
So, hypothetically, if I wanted SMTP to MD5 hash all mime types that
are image.\* or application.\*, I would add the lines below to my
local.bro?
redef SMTP::generate\_md5 += /image.\*/;
redef SMTP::generate\_md5 += /application.\*/;
I'm assuming that the += operator appends new regular expressions. Is
that correct?
-Chris
---
### Author:  [@Seth\_Hall3](https://community.zeek.org/u/Seth_Hall3)
#### Post date: [March 13, 2012, 7:30pm UTC](https://community.zeek.org/t/md5-hashing/2261/4 "2012-03-13T19:30:30Z")
> So, hypothetically, if I wanted SMTP to MD5 hash all mime types that
> are image.\* or application.\*, I would add the lines below to my
> local.bro?
>
> redef SMTP::generate\_md5 += /image.\*/;
> redef SMTP::generate\_md5 += /application.\*/;
Yep, just keeping in mind that the PDF mime type falls within application/ too (and a number of others).
> I'm assuming that the += operator appends new regular expressions. Is
> that correct?
Correct.
.Seth
---
### Author:  [@Mike\_Sconzo](https://community.zeek.org/u/Mike_Sconzo)
#### Post date: [March 13, 2012, 7:54pm UTC](https://community.zeek.org/t/md5-hashing/2261/5 "2012-03-13T19:54:27Z")
Will the changes in 2.1 allow for passing of data to an MD5 function?
Or will it (the file analysis policy) use protocol knowledge + magic
number to determine if it should be MD5'd or not?
I only ask because seeing an exe downloaded with a mime type of
image/jpg is not completely uncommon.
---
### Author:  [@Seth\_Hall3](https://community.zeek.org/u/Seth_Hall3)
#### Post date: [March 13, 2012, 8:10pm UTC](https://community.zeek.org/t/md5-hashing/2261/6 "2012-03-13T20:10:12Z")
> Will the changes in 2.1 allow for passing of data to an MD5 function?
> Or will it (the file analysis policy) use protocol knowledge + magic
> number to determine if it should be MD5'd or not?
That's only a cheat mechanism I put in place. You actually have a lot more flexibility than that if you write a bit of code. The HTTP::Info data structure is extended in the scripts/base/protocols/http/file-hash.bro script to get a field named "calc\_md5". If you set that field to true (T) before the first chunk of data is seen Bro will calculate an MD5 sum for the transfer. If you handle the http\_header event for example, you would just do your condition and then set the field to T. Here's a short and dumb example…
event http\_header(c: connection, is\_orig: bool, name: string, value: string)
{
if ( ! is\_orig && name == "CONTENT-TYPE" && value == "IMAGE/JPG" )
c$http$calc\_md5 = T;
}
This will make Bro calculate md5 sums for any HTTP transfer where the server sent jpg as the content type (this is not what would be matched with the generate\_md5 variable as I mention below).
> I only ask because seeing an exe downloaded with a mime type of
> image/jpg is not completely uncommon.
Those mime types are sniffed (we ignore the content-type header). If it's a windows executable it will be detected as such.
.Seth
---
### Author:  [@system](https://community.zeek.org/u/system)
#### Post date: [May 6, 2022, 3:40pm UTC](https://community.zeek.org/t/md5-hashing/2261/7 "2022-05-06T15:40:15Z")