Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am doing a penetration test, and i would like to know if i can decrypt passwords stored in LDAP. i tried some sites decrypt MD5 , they give me error message tells that the input is not MD5. Could you please help thanks

This is an example

userPassword: {MD5}KdScezWFVZxY7rHb5C4X1w==
share|improve this question

closed as not a real question by Antony Vennard, Gilles, AJ Henderson, Terry Chia, Luc Mar 28 '13 at 15:42

It's difficult to tell what is being asked here. This question is ambiguous, vague, incomplete, overly broad, or rhetorical and cannot be reasonably answered in its current form. For help clarifying this question so that it can be reopened, visit the help center.If this question can be reworded to fit the rules in the help center, please edit the question.

Hashing is not encryption. You cannot decrypt an MD5; you can only find a collision. – logicalscope Mar 16 '12 at 15:45
And LDAP is not a storage location, it's a communications protocol. – Graham Hill Mar 16 '12 at 16:03
ok, i got the tree stored in LDAP and it contains passwords hashed using MD5, but when i am trying sites to get the original pass, the site gives error message tells "the input is not MD5". i wish it is more clear now. – user1028 Mar 16 '12 at 16:15
MD5 is not a difficult "format": it is 16 bytes of pure, raw data (or 32 ASCII-formatted hexadecimal numbers in the range of [0-9a-fA-F]). Anything else is not a valid MD5 signature. – logicalscope Mar 16 '12 at 16:44
Other than references in WAHH, not familiar with burpsuite. It seems like burp is assuming some weird encoding for the b64 decode; rather than re-encoding in hexidecimal. A 24 char b64 encoding ending with == should be 16 bytes (each set of four-b64 chars corresponds to 3 bytes; except the last with has only one indicated by the two equals). As a byte is two hex chars, this works out right. – dr jimbob Mar 16 '12 at 20:03

Your MD5 hash {MD5}KdScezWFVZxY7rHb5C4X1w== appears to be base64 encoded. MD5 hashes in the rainbow tables probably would be in hexidecimal, so you should convert the two.

In python you can do this with

>>> from base64 import b64decode, b16encode
>>> b16encode(b64decode('KdScezWFVZxY7rHb5C4X1w==')).lower()

Or you can use:

share|improve this answer

In order to try and identify the password that gives you a particular hash, the only real way is to try all passwords and hash them to see what you get.

What those websites have done is already tried a huge number of passwords and stored the calculated hashes so when you input your hash they quickly look up their database and provide you with an answer. Have a look at this question on Rainbow Tables.

They do not cope with salted hashes, however (well, you can create a table for each salt, but that dramatically increases the size of the table space) - so the answer you have had back may just mean they have failed to look up that hash.

share|improve this answer

John The Ripper knows how to deal with the LDAP hashes. The option -format=nsldap should force it.

If it doesn't recognize your format, use base64.exe -d b64enc.hash | xxd -ps to convert your base64 encoded hashes into a hexdump.

share|improve this answer

dr jimbob right, it seems to be base64 encoded.

you can try to find your hash password. that site does not use a very own database but a Google Custom Search Engine (CSE).

share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.