I was testing a website and found that my password is travelling as a md5 hash over the network and since it is my password is there any way I can find the key used to hash my password as I have the resulting hashed password and the input password used?
If the MD5 doesn't match a straightforward
md5($password) then you might be able to find out what's being done to it by trying to brute-force the hash. But you're unlikely to succeed unless they're doing something very simple.
If your question is "Is it possible to restore the password from MD5?", then the answer is yes. More precisely, there is no way to know what password exactly was used. But it is possible to find some text that produces the same MD5. This may be your password or may be not. In the described scenario this will be sufficient. See details here.
Should you worry? Probably yes:
- If they store this MD5 directly in their database, then it is a security risk, because MD5 can be brute-forced.
- Even if they don't store this MD5 directly, but let say wrap it into bcrypt or other algorithm, there is a risk of password shucking, see details here. If the same password is used for more than one web site, then despite resource intensive methods like bcrypt or Argon2 the password can be restored, because instead of brute-forcing only the leaked MD5 candidates would be tested.