TechKnowSurge
CompTIA Security+ 1.4 NIST 800-53 SC-13 ISC2 CISSP 3.6 NIST NICE S0622
TechKnowSurge Catalog Videos DEMO: Hashing in Windows
VideoSecurityFree

DEMO: Hashing in Windows

File hashing on Windows can be performed using the built-in CertUtil command-line utility, which generates cryptographic hash values for any file using algorithms such as MD5 or MD2.

⚑ Complete this video to capture a CTF flag worth 1 point.

About this video

CertUtil is a native Windows command-line utility that, while built for certificate management, includes a practical file hashing function accessible through the hashfile parameter. Using a standard Command Prompt, users can point the tool at any file, specify a hashing algorithm such as MD5 or MD2, and receive a fixed-length hash value representing that file's contents. This makes CertUtil a straightforward way to explore cryptographic hashing concepts without installing additional software. Hashing has three defining properties that this tool makes easy to observe. First, even a minimal change to a file — such as removing a single period — produces a hash that is entirely different from the original, demonstrating the avalanche effect. Second, the hash output remains the same fixed length regardless of whether the input file contains a single sentence or several paragraphs of text. Third, the algorithm is deterministic: the same file will always produce the same hash value, confirming consistency across repeated operations. Running the same file through different algorithms, such as MD5 versus MD2, illustrates that each algorithm produces its own distinct fingerprint. While MD5 and MD2 are older algorithms no longer recommended for security-critical applications, they serve as accessible examples for understanding how hashing works in practice. CertUtil provides a low-friction environment for experimenting with these concepts directly on a Windows system.

What you'll learn

What's covered

Hashing Files on Windows

Aligned to

CompTIA Security+
1.4 Explain the importance of using appropriate cryptographic solutions.
NIST 800-53
SC-13 Cryptographic Protection
ISC2 CISSP
3.6 Select and determine cryptographic solutions
NIST NICE
S0622 Skill in implementing one-way hash functions

Key terms

Hash Function
A mathematical algorithm that converts input data of any size into a fixed-size output value used to verify data integrity.
Data Integrity
The assurance that data has not been altered or corrupted during storage or transmission.
Avalanche Effect
A property of cryptographic hash functions where a small change in the input produces a drastically different output hash value.
Message Digest 5
MD5
Message Digest 5 is a widely used cryptographic hash function producing a 128-bit digest; MD5 is considered cryptographically broken due to collision vulnerabilities and must not be used for security-critical purposes such as digital signatures or certificate validation.
certutil
A Windows command-line utility primarily used for certificate management that also supports generating and verifying cryptographic file hashes.

Topics

Cryptography File Hashing Certutil Md5 Windows Cli Avalanche Effect

Transcript

Let's take a look at what hashing looks like. We're going to hash a file on a Windows machine.

The certutil command

On the Windows machine there's a program called certutil, and although this program is really designed to manage certificates, one of the functions that it does is it creates a hash out of a file. So that's what we're going to do today: we're going to use this certutil to create a hash out of a file.

The first step is that we need to open up a command prompt. What I'm going to do is click on the Windows button here, type in CMD, and it shows the command prompt, so I'll hit enter, bring that up, and now I have the command prompt.

Next I'm going to just take a look at the options that the certutil command has. So I'll type in certutil, which is the program that we'll be using, and I'll do a dash question mark to see what options we have. If we scroll up through this, we can see that one of the options that we have in here is hashfile. So this is what we're going to use. I'll do a -hashfile -? and I can see some commands that are associated with this.

Creating a file to hash

Next let's create a document that we're going to hash. What I'm going to do is open up Windows here, go to the C drive — and I'm just choosing the C drive because it's going to be easy to navigate to — and I'll create a temp folder in here. We'll get into the temp folder and then I'm going to create a new document, and it's just going to be a text document. I'll create this text document and we'll call this plain text doc, and I'll hit enter. We'll open this up and say "this is plain text", and I'll save this and we'll X out of there.

Hashing it

Now let's create a hash of this plain text doc. What I'm going to do is use this command right here: certutil with a -hashfile, and then I will give the path for the file, and then the hashing algorithm. There are several hashing algorithms that I can use here, so let's do MD5 with this.

So I'm going to do certutil -hashfile, space, and we're going to the C drive, the temp, and the plain text doc, and then I need to specify the hashing algorithm — we said we were going to do MD5. We'll hit enter, and there is the hash of that file.

A small change to the input

One of the things that we said about a hash is that if we make a little change it'll have a drastic difference, so let's see what that looks like. I'm going to bring up this document again, I'm going to open it up, and I'll delete the period at the end of it, and then save. So we just made one small change to this.

With that small change I'll do this same command, and what we see now is that this hash right here, this fingerprint, is completely different than what it was before. So we see a very different fingerprint here.

The fingerprint size stays the same

Another thing that we said is that this fingerprint is going to remain the same — at least on many of these hashing algorithms, the fingerprint size is going to stay the same. So let's take a look at what that looks like.

What I'm going to do is just pull up a web browser here and type in lorem ipsum. Lorem ipsum is just random text, so we'll take this random text here, we'll copy this out, and then let's open up our document. I'm going to put this on a separate line, and we're just going to have all this random text here, and then we'll save this document. Once we've got that, now it's a much longer document, so let's run it at this point. We can see it has drastically changed from the fingerprint perspective, but it's still the same size.

Consistency

We also need that consistency — we need to come up with the same result over and over again — so let's make sure the algorithm does this. I'm going to open up this document again, we're going to delete all this extra stuff and go back to our original document with a period at the end. I'm going to save this out and then we'll run this once again. If I look at this hash and compare it to this hash, we can see that they are exactly the same. So we've got consistency, as long as the input is the same.

A different algorithm

Just for fun, we can see what another algorithm would pop up here. So instead of doing MD5, let's do MD2 and see what comes up there. Yes, it's a very different, unique fingerprint that comes up for a different hashing algorithm.

So that's hashing using certutil. It's a fun little utility that you can use to play around with some different hashing with your files.

About TechKnowSurge

TechKnowSurge builds IT and cybersecurity professionals through hands-on, concept-first training built around real understanding — not memorization. Free interactive tools, structured programs, and 25+ years of real-world experience, all in one place.

Explore free tools and programs →