a cryptographic hash function with a 128-bit (16-byte) output, now deprecated

learn more… | top users | synonyms

-3
votes
1answer
55 views

SQL injection when the password has a MD5 hash

Whenever i put username = ') or ('a'='a' password = any string It shows the . MD5 is converting my sql string into some hexadecimals. so is there any way we can bypass it? Also why can't we see ...
2
votes
2answers
39 views

How can SHA256-hashes as input to MD5 be revealed?

I know that you shouldn't use unsalted MD5 hashes of passwords in databases. But unfortunately, people do, see https://hashes.org/public.php. From this site I downloaded a file with passwords which ...
3
votes
1answer
1k views

How does VTP authentication prevent unauthorized access (Can the password be cracked given captured packets)

I know that when setting up VTP across switches in a network you should set a secret/password to prevent unauthorized requests. My question is I know that this uses an MD5 hash to ensure that ...
0
votes
2answers
101 views

As a user, is using MD5-encrypted passwords on websites a good practice? [duplicate]

Disclaimer: This is from a user standpoint. We'll thus assume the target website (say, Paypal or Netflix) already uses a strong hashing algorithm with salts (bcrypt of pbkdf2, for example) and accepts ...
3
votes
4answers
962 views

Convert SHA-256 to SHA-1 and MD5 - Increase bit length/entropy? [duplicate]

I know this is a real dumb question and I am certainly talking complete rubbish, but let me explain: We have a long SHA-256 hash, e.g.: ...
11
votes
3answers
3k views

Is Postgres password-based authentication secure?

According to Postgres's documentation, Postgres's password authentication method uses MD5 hashing to secure the password: The password-based authentication methods are md5 and password. These ...
1
vote
0answers
107 views

Find salt from md5 hash if password is known

I have a salted MD5 hash and I also know the password. How can I recover the salt using tools like John The Ripper (I have JTR jumbo installed)?
-4
votes
1answer
1k views

Please tell me two strings which have the same MD5 hash value

Yes, I know MD5 is weak and should not be used. To make a prove of concept I need two strings with the same MD5 value but all I can find is binary. Like this nice example. Works fine as binary but ...
-2
votes
3answers
152 views

Is it possible to reverse MD5? [duplicate]

I'm new in the security world and right now I'm studying about hashes. Let's say I have md5(x+q) and md5(y+q). I know the value of x and y hidden into md5. Would it be possible to reverse it and ...
-1
votes
2answers
47 views

Launching SQL injection in MD5 with mysqli_real_escape_string()?

Can we exploit the MD5() and mysqli_real_escape_string() methods in this case to perform SQL injection? Here is the code snippet: $pwd = mysqli_real_escape_string($conn,MD5($_POST['pwd'])); $login = ...
-12
votes
1answer
88 views

I have an MD5 encrypted link. How do I decrypt? [closed]

I have this MD5 hash of a link: 687474703a2f2f696d6775722e636f6d2f45554a43734742 I only have this code, no other information. How can I crack it?
2
votes
2answers
61 views

Using a hash in place of user data

I'm storing client data and they are sensitive about privacy and security of the data. In some cases, I don't need the actual data, but could work with a hash of the data. For example, in the case of ...
-6
votes
2answers
55 views

How to brute force this token in php, if it is possible

it is possible to brute-force this token (MD5 Hash) of the following script (PHP) in a realistic time (0,5h - 24h)? If the answer is YES, how could I do it, for example with PHP or Python? $time = ...
26
votes
2answers
2k views

How can the content of a file refer to its own MD5?

So I just saw this picture on Imgur: http://imgur.com/gxRCrCM The intriguing thing about it is that the picture refers to an old Daft Punk song named "Face 2 Face". The image's MD5 is ...
4
votes
2answers
75 views

Is CHAP authentication still secure?

Assuming the use of the default hashing algorithm MD5, is CHAP authentication still secure? I appreciate that MD5 is considered broken in terms of collision resistance, but I also understand that in ...
7
votes
2answers
164 views

Is there any recommended approach for “upgrading” MD5 hashes to something secure? [duplicate]

I'm currently dealing with a couple of user accounts containing MD5 hashed passwords. These accounts got migrated from an old system into our current system which uses PBKDF2 for password hashing. I ...
39
votes
7answers
5k views

Exploiting MD5 vulnerability in this PHP form?

I've been practicing in security-related topics and I came upon this problem which I don't understand at all. You receive a form with one input named pass, and this is the code you need to bypass: &...
4
votes
1answer
134 views

Exploiting MD5/Salt Vulnerability in this PHP form?

I've been practicing security-related subjects and this challenge has befuddled me. Note: I can't access any PHP source code, nor can I edit it. I'm only able to view it. The following is given: I ...
1
vote
1answer
82 views

Multi hash security [duplicate]

Is md5(sha1(pass)) more secure than md5(pass)? For example in case of sqli when an attacker can't get our hashing schema, brute force or dictionary attack would be much less efficient. Am I right or ...
0
votes
0answers
15 views

Insecure data in-transit

My organization processes some PII data and shares it with an outbound connection (outflow only) that is a third party. The data transfer transactions occur without human intervention. That outbound ...
1
vote
1answer
37 views

Possible number of collisions in a hashing function with constant message size

Jumping to conclusions from my question, can we predict possible number of collisions for a given message in a given hashing algorithm. Say I am using SHA-1 which outputs 160 characters string, and ...
-1
votes
1answer
58 views

Shouldn't multiple images always exist even in most powerful hashing algorithm?

I have a confusion in mind that since in hashing we transform a large string into a smaller fixed size string, so its unlikely that any large string has a unique hash. There had to be collisions and ...
53
votes
4answers
116k views

Is SHA1 better than md5 only because it generates a hash of 160 bits?

It is well known that SHA1 is recommended more than md5 for hashing since md5 is practically broken as lot of collisions have been found. With the birthday attack, it is possible to get a collision ...
0
votes
1answer
88 views

Why file hosting sites never ban files using MD5 hash? [closed]

We have beautiful technology called MD5 Hash for banning files, then why file hosting sites never implement this thing on DMCA files?
4
votes
1answer
158 views

Is the 64-bits length of the original string padded as well in the MD5 hashfunction?

So, for example I have a string which binary value is exactly 512 - 64 bits long, so the binary conversion of the string does not have to be padded. So that means I have a string of 56 chars. The ...
0
votes
0answers
14 views

Using application that uses MD5 with FIPS 140-2

I am using ecryptfs for disk encryption which uses MD5. However I also have requirement to be FIPS 140-2 enabled which blocks MD5. My question is, without modifying ecryptfs is there a way I can get ...
1
vote
2answers
78 views

Is it possible to find the salt?

I have this PHP code with me : $auth = md5($username.$password.$salt); I have a dummy value : $username = user $password = password And I also have the resulting MD5 Hash : ...
6
votes
2answers
203 views

Migrating password db off MD5 by chaining MD5 and Bcrypt?

I have a legacy system currently storing unsalted MD5 passwords. Unfortunately, some other controls are not in place (like the ability to expire passwords) and I'm trying to upgrade my algorithm to ...
3
votes
1answer
113 views

Md5 vs Md4 recognition

Is there a way to actually find out whether a hash is MD5 or MD4? For instance: 10c7ccc7a4f0aff03c915c485565b9da is an MD5 hash be08c2de91787c51e7aee5dd16ca4f76 is an MD4 hash I know that there ...
0
votes
1answer
2k views

Security weaknesses in using RSA encrypted MD5 hash of certificate content

Suppose you have an Internet banking site based on a secure web server running the HTTPS protocol via port 443. The server authenticates itself to clients through an X.509 certificate signed by a CA....
10
votes
2answers
14k views

How weak is MD5 as a password hashing function ?

A professor told us today, that MD5 is weak. I understand his chain of thought but pointed out, that IMHO MD5 is a good way to go if you would use a long (even really long) dynamic salts and static ...
3
votes
2answers
253 views

Is signing android apk file with SHA1 digest secure enough?

Google command line example for signing apk files: $ jarsigner -verbose -sigalg SHA1withRSA -digestalg SHA1 -keystore my-release-key.keystore my_application.apk alias_name source: http://developer....
2
votes
1answer
559 views

Best way to encrypt data using php - I am not sure if I doing it correctly [duplicate]

I want to encrypt some data within my php file when I add the stuff to my mysql database. This is how I do it. I create a static key like: $key = md5("pass"); Then I have two functions called ...
3
votes
1answer
169 views

MD5 Algorithm: A basic explanation of the process

Could anyone please explain the basic idea and steps involved in the MD5 algorithm? I tried reading it on the web (Wikipedia etc.), but it was just too high level for me. So, can someone explain the ...
-5
votes
1answer
91 views

What kind of base64 it is? [closed]

So I have a string that is 123456 then I md5 it and now I have hash e10adc3949ba59abbe56e057f20f883e then I don't know what kind of base64 (this is my thought about base64, mb its not base64 ...
3
votes
1answer
101 views

Why are weak Cipher Suites still in use by clients, particularly mobile apps?

I am examining the collection of cipher suites that some mobile apps use (Client Hello) and I noticed that the majority of them include the TLS_RC4_128_MD5 and TLS_RC4_128_SHA. According to the OWASP ...
2
votes
1answer
216 views

Is possible to force a file to generate an specific MD5 signature?

Sometimes MD5 is used to validate that a downloaded file is really valid. So I want to know if is possible for a hacker to modify a file and introduce some malicious code AND make that file generate ...
25
votes
4answers
7k views

Why are MD5 and SHA-1 still used for checksums and certificates if they are called broken?

I was just reading about SSL/TLS stuff, and according to this site (which is rated as A by Qualys SSL Labs), MD5 is totally broken, and SHA-1 is cryptographically weak since 2005. And yet, I noticed ...
-7
votes
2answers
6k views

Is AES slower to encrypt than MD5?

Is this the right interperation of this diagram: http://www.cryptopp.com/benchmarks.html AES/CCM MiB/Second:61 Cycles Per Byte:28.6 MD5 MiB/Second:255 Cycles Per Byte:6.8 And does that ...
-7
votes
2answers
300 views

What is is the best way to create virus signature database? [closed]

We are thinking to develop a new Antivirus program. The main concern is to create a virus signature database. I want to ask what is the best possible way to add viruses signature in our database to ...
1
vote
0answers
40 views

Transmitted sensitive user data

At the moment, I have set up mitmproxy and can record all HTTP/HTTPS communications between the client and server. For research purposes I am looking to find a way to detect potential leakage of ...
-1
votes
2answers
133 views

Decrypting a very simple key [closed]

I'm doing a basic cryptography course and a question is asking to to decipher: ...
3
votes
2answers
134 views

Are there any known MD5 hash collisions of messages of different length?

All the examples of MD5 hash collisions I've come across comprise two different messages (inputs) of the same length. The first and second messages have different values for a number of bits and the ...
5
votes
2answers
1k views

Code signing with MD5 on Windows 8

I discovered that a signed installer package that is reported as correctly signed on Windows 7 and earlier, is reported as "corrupt" in IE10 on Windows 8. Further investigation showed that the ...
4
votes
1answer
782 views

Cracking DES(Unix)/MD5 ARP

This is a basic example of an Unix Pass Encryption. I have a little Hash of MD5 ARP: user50:$apr1$w7YNTrjQ$0/71H7ze5o9/jCnKLt0mj0 user60:$apr1$AIw2h09/$Ti0TRlU9mDpCGm5zg.ZDP. I need to find the ...
4
votes
1answer
253 views

X.509 Certificate Signature Collision Vulnerability

Customer complained that during security scan performed on our application the following was raised: 172.22.0.19 - xxxxx - IETF X.509 Certificate Signature Collision Vulnerability - https/tcp/172.22....
34
votes
4answers
4k views

Does every hash value have an inverse value?

There are many different hash functions, md5, sha, and others. They take a value V and produce a H via transformation Function(V) = H, where Function is md5, sha, etc. My question is: Does every hash ...
2
votes
1answer
129 views

Flaw in HTTP Digest Authentication

I am working through my textbook and I came across this question: Below is the message format for a browser response to access a password-protected web page using HTTP digest authentication. GET URI ...
0
votes
1answer
290 views

How can I detect if hashes are salted? [duplicate]

Is it possible to detect hash function of a hash if I don't have access to PHP code? I know that if a hash is some kind of MD5, but I don't know if there is salt etc.
4
votes
2answers
2k views

What does GUID have, that a Whirlpool, MD5 or SHA-2 hash don't?

I'm trying to understand the use of GUID and what has always left me wondering is what's so special about them that I should consider using them instead of rolling my own type of unique ID. In other ...