0

I'm new in the security world and right now I'm studying about hashes.

Let's say I have md5(x+q) and md5(y+q). I know the value of x and y hidden into md5. Would it be possible to reverse it and find the value of q before the md5 was applied?

marked as duplicate by Bob Brown, WhiteWinterWolf, S.L. Barth, schroeder Jul 6 '16 at 15:19

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

  • Crypto SE will be a better fit for your question. – Jedi Jul 5 '16 at 23:22
  • 1
    @Jedi Yes... I can imagine a very warm welcome for such a question from Crypto.SE community. – techraf Jul 5 '16 at 23:40
  • OP. this post may also help your studies. – Jedi Jul 6 '16 at 9:53
  • yes, solving for md5(y+q) will reveal q, which can be done with guess and check. – dandavis Jul 6 '16 at 18:10
3

MD5 is a cryptographic hashing function, which by definition means that it is only computed in one direction and it is not possible to "reverse" it back to its original form. In the case where two values are added or concatenated together and then hashed it would be impossible to derive the original factors -you can only obtain the full value of whatever was hashed, and only through brute forcing.

As mentioned in another answer, you could Brute Force it with tools like John the Ripper (JtR) or Hashcat, but performance will be based on available resources.

3

No, it is not possible to reverse MD5.

MD5 is just like adding the digits of a large number until you get a single digit.

Example: 1982735 --> summing the digits will make 35, summing those will make 8. There is no way to determine the initial 1982735 only having the '8'.

Of course, MD5 is complex enough to generate a lot of unique results, but the principle is similar.

2

Bruteforce would be your only option. MD5 has collision weakness, but it's not applicable here.

And MD5 brute forcing is feasible too, because its not very computational intensive either, Billions per second.

See: What are realistic rates for brute force hashing?

Not the answer you're looking for? Browse other questions tagged or ask your own question.