Questions tagged [hash]

A hash algorithm is a function which takes a variable size input and produces a fixed size output. The algorithm tries to make it difficult to predict the output for a given input, find two inputs with the same output, or reconstruct the input from the output.

Filter by
Sorted by
Tagged with
0
votes
1answer
45 views

Cracking hashes of trivially modified passwords

If I started with “password”, then change it to “password2”, “password3” etc, is that easier to crack the hashes of the set of passwords than if I used only the original password? Does having the ...
0
votes
0answers
39 views

About password ciphertext [duplicate]

I need to decrypt a password. I have the ciphertext for this however, I have many plain text and encrypted equivalents. This device can only be given passwords with a maximum of 8 characters from the ...
0
votes
1answer
84 views

Is it bad practice to store passwords in iCloud notes?

I was wondering something about a day ago when I remembered that Apple stores notes in a database (so you can recover them or view them on icloud.com) - What if Apple stores your notes in plaintext? I'...
2
votes
1answer
59 views

Does using multiple rounds of hashing increase chances of a collision?

Let's imagine that we have a particularly bad hashing algorithm that, given any input, will output 1 of only 100 possible hashes. Now lets imagine that 2 of these possible hashes, when hashed again, ...
0
votes
1answer
56 views

pwdump8-8.2 correct hash for Microsoft Account Win10

I am having a real issue cracking one NT hash i've pulled from my system for a Microsoft Account. I used - PwDump8.2 I have an admin account unlocked on the system and can access most files. I know ...
0
votes
1answer
61 views

Creating Wordlist from specific characters and numbers using Mentalist or similar program

I have locked myself out of my Win 10 Microsoft account by forgetting my password and need to get back into it. I have extracted the hash for the account. I've been researching wordlists and hash ...
0
votes
0answers
10 views

What hash based digital signature algorithms exist that have reasonably small signature sizes? [migrated]

What hash based digital signature algorithms exist that have reasonably small signature sizes? By reasonably small, I mean not much bigger than what you would get with a 256-bit ECDSA (which I ...
-1
votes
0answers
27 views

I have an unknown hash. Can you help me identify it [duplicate]

I have an unknown hash (atleast i think it is something that got encrypted). Is there some way to identify what encryption algorithm has been used. This is it: UÐËÎ. ..àW²1&Ýta+./ÔR.úÇ.1Ýк é.}zgü½...
0
votes
0answers
46 views

Disabled MD5 and enabled SHA under SCHANNEL/Hashes in registry. xfreerdp fails with an ssl i/o error

So delving into securing server and not quite understanding how I broke the ability to rdp into my server (using xfreerdp). I disabled MD5 as an available hash and enabled SHA. The exact changes in ...
0
votes
1answer
96 views

Guidance on Storing Email Addresses as Hashes

I am building an application where one user (User A) can store a "query" of another user (User B) that may or may not exist in the system. This query can be done by email address. The ...
2
votes
1answer
97 views

Creating and Comparing Hashing Windows certutil and external hash libraries

I have a question about checking hashes and what is the best utility for it. Seems like you can use some external programs like md5sum or sha1sum. But can't you just use (on Windows) certutil -...
0
votes
0answers
64 views

Is it possible to have a file with the same SHA1 and content? [migrated]

Is it possible to have a file with the same SHA1 and content? For example: File context: x SHA1 of the file: x
0
votes
1answer
35 views

X.509 certificate's signature algorithm vs. algorithm used in key derived from it to verify a signature

I have the following from Google's public certs for verifying JWT ID -----BEGIN CERTIFICATE----- MIIDHDCCAgSgAwIBAgIIW4K0b18ff70wDQYJKoZIhvcNAQEFBQAwMTEvMC0GA1UE ...
0
votes
0answers
26 views

Help with identifying patterns or cryptographic implement [duplicate]

While I'm pen testing, I came across these values mapping to a store ID. These values are gathered across three different accounts. 0015400000jpjcEAAQ 0015400000jrjH7AAI 0015400000jtDS9AAM It's not a ...
0
votes
0answers
28 views

How to change the password hashing scheme in LDAP using an external library with slapd.d config

So I am trying to change the password hashing scheme for LDAP hypothetically let's assume it's pw-argon.so I don't have slapd.conf I have the slapd.d directory where I can make changes dynamically to ...
0
votes
1answer
89 views

Encryption Algorithm With Separate One-Way (Hashing) And Two-Way (Decryption) Keys

In cryptography, generally we have two ways of handling sensitive information. We can use one-way encryption such as hashing. This is useful when we never need to retrieve it again. In this case, we ...
1
vote
2answers
148 views

How many rounds of Bcrypt to use for security equivalent to SHA256?

We regularly use 10000 iterations of SHA256 for hashing passwords. If we want to have similar security, how many rounds/work factor should we use when hashing passwords with bcrypt?
1
vote
2answers
99 views

Irreversible encryption - difference to hash?

I keep reading the term "reversibly encrypted" and that confuses me because I thought that is kind of the point of encryption, that it can be decrypted. I googled it, as a good student, and ...
0
votes
0answers
14 views

GRZXW5EDY - Does anyone recognize what kind of hash/id is this? [duplicate]

I am black-box testing a video streaming website. They have 2 kind of IDs for videos. internal_id and external_id. I need to find a way to enumerate internal_id but cannot guess what kind of ID this ...
2
votes
2answers
99 views

CAPTCHA w/o Server-Side Persistence

I would like to implement my own CAPTCHA challenge for a website. The framework I use implements client-side session cookies, which are not encrypted, only signed with server's private key. The ...
1
vote
1answer
134 views

Hashing sessions and retrieving them using cookie(s) with session "id" and "token"

I'm implementing custom authentication & session management system in Node.js & PostgreSQL. My goal is to implement sessions that expire after 2 weeks (if not refreshed/renewed). OWASP and ...
1
vote
0answers
61 views

Choosing the right salt to pseudo-anonymize data and be GDPR compliant

In my company, numeric user IDs are considered PIIs and therefore need to be pseudo-anonymized to be GDPR compliant. To do so, we populate a lookup table where to each ID is assigned a monotonically ...
0
votes
1answer
887 views

John the ripper not able to crack the password

I generated two hashes from this site: Plaintext 1 (p1): world Salt 1 (s1): hello Hash 1 (h1): 936a185caaa266bb9cbe981e9e05cb78cd732b0b3280eb944412bb6f8f8f07af Plaintext 2 (p2): world2 Salt 2 (s2)...
0
votes
1answer
85 views

Does hashing really make this home rolled sso process more secure?

I had configured subdomains on a site to share forms authentication, however decisions were made to change one of websites over to a different domain. So now site A needs to send a user to the site B. ...
0
votes
1answer
72 views

Is there a use for an MDC even when all messages are signed?

I guess I have halfway grasped the concepts of PGP, and I've halfway understood the concept of the Efail attack. However, I still don't understand whether such attacks would be possible (and an MDC ...
0
votes
1answer
100 views

Store a password as an identifier (as safely as possible)... since there is no other choice

I have to deal with a place that has some terrible security practices. For example, this place gives people passwords (eg. domain logon on Windows, but paired with their name as the username) that is ...
2
votes
3answers
176 views

Is it sensible to accept a password + any other random characters for successful authentication?

Supposing a user of my system has set their password to Password123 At the login screen, what would be the security implications of me accepting: Password123 or Password1234 or Password123ABC Based on ...
1
vote
3answers
212 views

To lighten server load, is hashing a client-side Argon2-hashed password with SHA-256 on the server-side at least as safe as server-side only Argon2?

I am trying to achieve better security in my authentication system implementation with both server-side hashing and client-side hashing. (See the first reference below for more prerequisite knowledge.)...
-1
votes
3answers
128 views

Binary versus ASCII representation of a hash - which is more secure

I am using SHA256 to create a hash. Output is captured as a text string (thus "A245B6FF") and that is what has been used to create the digital signature. Since the hash could have been ...
0
votes
1answer
147 views

Secure ajax login form

When the client is logging in, I send an xhr request to the server. However the request looks like this: localhost:80/api/login-ajax/&username=johndoe&password=123456 This is insecure for ...
1
vote
3answers
156 views

Does hashing syslog (or similar) make for good passwords?

I thought of an approach to password generation that I haven't heard of anyone else using. It almost seems too good to be true so I wonder what the downsides are. I'm well aware that you shouldn't &...
7
votes
3answers
202 views

Does there exist any hashing algorithms suitable for comparing data that is similar but not exact matches?

Does there exist any hashing algorithms suitable for comparing data that is similar but not exact matches? For example one where similar input data generates a similar hash, with the difference in the ...
0
votes
1answer
79 views

Is it possible to find out the encryption algorithm used from hexadecimal hash? [duplicate]

Can we find out the encryption method used if we know what is encrypted inside? Let's assume there are around 7-digits 22 or 26 codes (passwords ie just decimals) encrypted to 832 characters ...
0
votes
0answers
90 views

Get encrypted PDF password

For a CTF challenge, I got a locked PDF file with a data folder that contains images, a plaintext file and a wav audio file. I used pdf2john.pl to get the password hash and I performed a brute force ...
1
vote
1answer
135 views

Does using a random number of iterations for PKBDF2-SHA256 help if I only have to protect one key used to encrypt a password protecteded file? [duplicate]

I read about Recommended # of iterations when using PBKDF2-SHA256? I have also read in Why not just use a small but unusual number of hashing rounds? that when there are multiple password to protect, ...
2
votes
1answer
108 views

How to convert passphrase to AES256 key?

My plan is to convert a passphrase in UTF-8 ASCII-US to Unit8Array(32) then use it in: 256bitsKey = Unit8Array(32) from passphase iv = window.crypto.getRandomValues(new Uint8Array(32)); CryptoJS.enc....
9
votes
6answers
3k views

Can iterated hashes be used to create cryptographically secure random data from strong random seed?

I was wondering if generation of sequential hashes from random seed can be considered "random enough" to be used in cryptographic operations? By sequential hashes I mean the following: First ...
7
votes
3answers
4k views

Why not just use a small but unusual number of hashing rounds?

When it comes to hashing passwords, it is nowadays practice to do 100'000 or 200'000 iterations of SHA256/SHA512, or at least something in that ballpark. But my question is, why is it not safe enough ...
0
votes
0answers
11 views

Identify hash pattern inside a string [duplicate]

I believe that this question was answered already, though I couldn't find it. I have several strings that include hash. Each string has hash and some random (or not) add-on. How can I identify the ...
0
votes
0answers
62 views

Using predictable incrementing nonces

I need validation / feedback please with the implementation of a web based client-server application that I am building. I need to make sure that a client's cookies can't be hijacked and therefore I ...
1
vote
1answer
2k views

John the Ripper is unable to crack my SHA1 hashed password

John the Ripper is unable to crack my SHA1 hashed password: john --wordlist=rockyou.txt testing.txt Whenever I do this in Kali Linux, I get this response: Loaded 1 password hash (Raw-SHA1 [SHA1 256/...
0
votes
1answer
61 views

One-way cryptographic algorithm with distinct output and verifiable property

I'm working on a API which is serving content based on user requests. What I'd like to achieve is as follows: Having a constant key stored both on the server and the client machine (as a means of ...
1
vote
2answers
321 views

What is the point of storing hashed passwords? If that file is read, doesn't that mean the computer has already been compromised?

Why is it necessary to store operating system passwords hashed? From what I've learned, passwords are stored on the hard drive/SSD in /etc/shadow. However, if a malicious agent was able to get access ...
0
votes
0answers
77 views

Guessing UUIDv1 hashes?

I'm digging into UUIDv1 generation and bruteforce, in order to take control of a password reset feature of a website which sends a link with a get parameter token=UUIDvX. I'm trying to identify which ...
1
vote
1answer
198 views

How safe is AES 256bitkey encoded in HEX, Base64?

I am using CryptoJS AES 256 encryption: CryptoJS.AES.encrypt(realData, generateKey(passphrase), {iv: iv}); The secret is generated through: function generateKey(passphrase) { const salt = CryptoJS....
0
votes
1answer
82 views

Does john the ripper need to be given the hash format in order to crack it?

Doing some hash rooms on THM and whenever I run the hash files they give me ill just start like this. john --wordlist=rockyou.txt hashfile It will run and then output with a bunch of warnings telling ...
2
votes
1answer
107 views

Security implications of using a non-hash in the password column

Imagine a webapp that uses a traditional email-password-login, with the users-table saving the password salted and hashed using bcrypt. Now a secondary login method should be implemented, like an API ...
0
votes
0answers
13 views

Significant differences in hash cracking speeds? [duplicate]

I'm doing an educational hash research. I generated MD5 hash using online tools and cracked it within a second using Hashcat and certain wordlist (yes, one second). Then I produced a WPA handshake ...
0
votes
1answer
133 views

If a file is digitally signed, is posting a hash very useful for security purposes?

In this question I asked about how to handle situations when SHA-256 hashes are not available for a file downloaded from the internet that contains executable code. Another community member ...
0
votes
1answer
72 views

Making already hashed wordlists of all possible combinations [duplicate]

Let us imagine a situation where a company stores its user passwords (let's ignore salts, etc for now) using some hash (say sha256) and the company gets breached. All of the username and password ...

1
2 3 4 5
43