{
  "slug": "hash-ioc-match",
  "name": "gizza-ai/hash-ioc-match",
  "version": "0.1.0",
  "title": "Hash IOC Matcher — Flag a File Against a Known-Bad Hash Blocklist — gizza.ai",
  "description": "Hash text, hex or base64 content and match its MD5/SHA-1/SHA-256/SHA-512 against a pasted blocklist of known-bad IOC hashes. Free, private, in-browser.",
  "tags": [
    "hash",
    "ioc",
    "blocklist",
    "known bad hashes",
    "malware",
    "md5",
    "sha1",
    "sha256",
    "sha512",
    "threat intelligence",
    "cti",
    "soc",
    "file reputation",
    "indicator match"
  ],
  "category": "security",
  "urls": {
    "page": "https://gizza.ai/tools/hash-ioc-match/",
    "markdown": "https://gizza.ai/tools/hash-ioc-match/index.md",
    "descriptor": "https://gizza.ai/tools/hash-ioc-match/tool.json",
    "deep_link_example": "https://gizza.ai/tools/hash-ioc-match/?input=Paste%20the%20file%27s%20content%20here%20%E2%80%94%20e.g.%20abc&blocklist=Paste%20known-bad%20hashes%2C%20one%20per%20line%20or%20any%20format%20%E2%80%94%20e.g.%0AMD5%3A%20900150983cd24fb0d6963f7d28e17f72%20%2C%20dropper.exe%0A%23%20sha256%20feed%0Aba7816bf8f01cfea414140de5dae2223b00361a396177a9cb410ff61f20015ad&input_encoding=text"
  },
  "cli": "gizza tool hash-ioc-match \"Paste the file's content here — e.g. abc\" 'blocklist=Paste known-bad hashes, one per line or any format — e.g.\nMD5: 900150983cd24fb0d6963f7d28e17f72 , dropper.exe\n# sha256 feed\nba7816bf8f01cfea414140de5dae2223b00361a396177a9cb410ff61f20015ad'",
  "tool": {
    "description": "Hash a piece of content and check it against a blocklist of known-bad file hashes. Provide the `input` (a file's bytes as text, hex, or base64 via `input_encoding`) and a `blocklist` of known-bad hashes pasted in any format. The tool computes the input's MD5, SHA-1, SHA-256 and SHA-512 digests and reports FLAGGED if any of them appears in the blocklist, or CLEAN otherwise, listing every computed digest and which one matched. The blocklist is parsed leniently: labelled ('MD5: <hash>'), CSV ('<hash>,malware.exe'), '0x'-prefixed and '#'/';'-commented lines all work — any 32/40/64/128-char hex run (MD5/SHA-1/SHA-256/SHA-512 widths) is extracted, case-insensitively, and duplicates collapse. Use this to triage a sample against threat-intel IOC feeds. To just compute a hash use the hash-text tool; to pull hashes out of a report use the ioc-extract tool.",
    "parameters": {
      "additionalProperties": false,
      "properties": {
        "blocklist": {
          "description": "Pasted list of known-bad hashes to match against — one per line or any format. Labelled ('MD5: <hash>'), CSV ('<hash>,name.exe'), '0x'-prefixed and '#'-commented lines are all parsed; only 32/40/64/128-char hex runs (MD5/SHA-1/SHA-256/SHA-512 widths) are kept, case-insensitively.",
          "type": "string"
        },
        "input": {
          "description": "The file content to hash and check, as text, hex, or base64 (set `input_encoding` to match). The tool computes its MD5, SHA-1, SHA-256 and SHA-512 digests.",
          "type": "string"
        },
        "input_encoding": {
          "default": "text",
          "description": "How to interpret `input` before hashing. 'text' (default) hashes the UTF-8 bytes as-is; 'hex' decodes it from hexadecimal first; 'base64' decodes it from standard base64 first.",
          "enum": [
            "text",
            "hex",
            "base64"
          ],
          "type": "string"
        }
      },
      "required": [
        "input",
        "blocklist"
      ],
      "type": "object"
    }
  }
}