All Questions

Tagged with
Filter by
Sorted by
Tagged with
40
votes
0answers
10k views

For a hashing function like MD5, how similar can two plaintext strings be and still generate the same hash? [migrated]

When I say similar, I'm referring to the Hamming distance, the Levenshtein distance, or a similar string distance metric that measures how similar or dissimilar two strings are. For instance, are ...
1
vote
3answers
191 views

Disguising the type of hash used

I've read about why MD5, SHA1, and many other hashing functions are insecure, by a lot, but I'm thinking of doing a different approach. It won't increase security, I'm aware of that, but I believe it ...
3
votes
0answers
69 views

How secure is this combined sha1/md5 hash [duplicate]

Recently we outsourced some work for a website. While reviewing this code I came across the password hash function. I am in no way a security expert besides some basic knowledge (hence outsourcing ...
1
vote
3answers
198 views

How secure is using MD5 for signature

Generally speaking, MD5 is considered as broken for secure usage these days, but I came across a signature design using MD5 many times recently in my company. The detail shows as following: T = text, ...
0
votes
2answers
358 views

How long does it take to compute hashes using the MD5 hash algorithm? [closed]

1) If one iteration of MD5 takes x seconds, is it safe to assume that n iterations of MD5 takes n * x seconds? 2) Will salted and unsalted versions of md5 hash algorithms take approximately the same ...
4
votes
6answers
838 views

How likely is a collision using MD5 compared to SHA256 (for checking file integrity)?

Many sites these days offer MD5 and SHA256 hashes to check the integrity of downloaded files or archives. I wonder how much safer is the use of the SHA256 hashes for integrity checks? Note: Consider ...
1
vote
2answers
1k views

Which hashing algorithm shoud I use for a safe file checksum?

For my work I'll need to provide my customer a specific file which will be the result of the work I have done for them. To protect the integrity of the work I have done and to guarantee it has never ...
0
votes
2answers
1k views

Is it possible to crack Joomla hash password?

I'm a developer and suddenly I fall in a stupid situation like I need to crack a hash Joomla password which is (5aa154999c111bf7f33a1a3cadba5847) and I don't know the salt. is there any way to crack ...
0
votes
1answer
220 views

Calculating Entropy using md5sum, sha256sum etc

We can calculate the Entropy S of a string simply like this: S = L * log_2(N) Where L stands for used characters in the string And N for every possible character Example: We want to calculate the ...
54
votes
5answers
12k views

Is it secure to use MD5 to verify the integrity of small files (less than 15kb)?

I know that collision for MD5 has been documented since the 90s and that digital certificates based off of MD5 has been demonstrated to be completely compromised back in 2010 but how effective is MD5 ...
2
votes
1answer
405 views

Path traversal using hash extension attack

I'm trying to write a PoC for path traversal using hash extension attack on a PHP site. My obstacle is in specifying an acceptable string. The vulnerability is in in the URL: http://127.0.0.1/...
0
votes
2answers
109 views

Rearranging hash adds no security?

I'm a rookie when it comes to Information Security so I've been reading a lot of the top questions on this stackexchange for the sake of learning. I came across this question that discusses hashing. ...
-1
votes
1answer
774 views

Is it possible to crack any MD5 hashes (without salt)? [duplicate]

We all know currently MD5 hash can be cracked but I was wondering if any hashes can be cracked since most crackers are searching in their database instead of cracking, so let's pretend we get a ...
2
votes
1answer
478 views

Publish a PDF on a website with MD5 Hash [closed]

I want to publish PDF documents on my website. I calculated the MD5 Hash of the file before uploading it. I want to provide this hash so that the downloader can check if the file is okay. What is the ...
1
vote
1answer
147 views

How do user get access to login when passwords are stored in MD5?

MD5 is a hash, so it is a one-way cryptographic function. But I am not sure that MD5 has only one hash per input? Web application stores the passwords hashed with MD5, but when the user enters the ...
10
votes
2answers
2k views

MD5 Preimage Vulnerability in 2017

I've recently discovered that one of our (strictly internal facing - no external risk unless other systems are completely compromised) platforms is storing passwords by salting and then MD5 hashing ...
0
votes
2answers
316 views

Inconsistency Among MD5, SHA1, and SHA256 Hashing Protocols

There appears to be an inconsistency (or unpublished protocol) in many online hash generators when formulating a hash from an uploaded text file, versus strictly hashing the contents of a file. This ...
2
votes
3answers
208 views

Would it be okay to check only a part of a hash value

Practically, the hash value of a server host key can be (relatively) long and thoroughly compare it with the record again and again can be annoying. For example, for a given md5 hash value: 43:89:1b:...
0
votes
1answer
852 views

Using MD5 as salt

I know that MD5 is a poor choice for hashing passwords, but its not my ideia. Imagine that we would use the username as a salting mechanism, wich is also bad idea, but just for an example. First, we ...
-1
votes
2answers
1k views

Is it possible to recreate a file using only its hash [duplicate]

To my knowledge, a file can have only one hash and a hash corresponds to only that file(keeping aside the 2 file one hash bug). Using that knowledge is it possible to make an algorithm to recreate a ...
-4
votes
2answers
2k views

Is possible to fake md5sum? [closed]

Without brute forcing, is possible to induce to a result on md5sum of a file, for example a file text? is mathematically "makeable"? The only way is using brute-forcing techniques? In other words it ...
-1
votes
2answers
475 views

How can I make a program to verify file integrity? [closed]

How to make a program that calculates a checksum of a file? What is the exact process of calculating a checksum?
-3
votes
1answer
248 views

Why can't hashes be reversed? [closed]

Imagine a theoretical universe where reverse hashing is possible. What if I take a 5000 bit message and hash it. So now I get a hashed string of say 256 bits. If I can get back to the 5000 bit message(...
3
votes
1answer
1k views

What happened to MD6?

I read on Wikipedia, that at first MD6 had some problems with a buffer overflow, and a lack of proof of resilience against differential attacks; however, the article also says that that was fixed. ...
3
votes
2answers
763 views

Cracking a MD5 hash from numerical input

I am trying to crack one of multiple MD5 hashes that have been created from numerical input. I have a sample of 1000 MD5 hashes that are generated from numerical input. I know that the input is ...
0
votes
3answers
2k views

Comparing the MD5 hash to a modified word document and reverting it to original

So i wanted to make a quick small test on comparing hashes between a word document and a small modification inside the document and then revert the changes back to original and check all the 3 hashes. ...
-1
votes
1answer
513 views

Why are some big companies using MD5 as hashing algorithm for their passwords? [closed]

I have seen many companies that are using MD5 to hash their passwords, and it seems like most of them don't want to change algorithm. My question is why are they still using it? Many say that MD5 ...
78
votes
4answers
20k views

How long will it take to crack the passwords stolen in the Yahoo hack announced 14 Dec 2016?

Apparently Yahoo was hacked yet again with up to a billion user accounts being compromised. The article says Yahoo uses MD5 for password hashing. Are the hackers likely to be able to crack the ...
1
vote
1answer
322 views

Can a Rainbow Table find multiple plaintext passwords to match a given hash

Given that: an MD5 hash can map to multiple plaintext strings (it is not unique) a rainbow table may store several million plaintext passwords with matching hash MY password is "password123", mapping ...
1
vote
2answers
546 views

Would it be a good approach to hash twice? [duplicate]

Lets say I have a system in which I save the user's passwords using SHA-2. Now I was just wondering would it be a good approach if I take the MD5 hash of the password and then compute SHA-2 for the ...
8
votes
2answers
14k views

Why is MD5 considered a vulnerable algorithm?

I know that MD5 is the most vulnerable hashing algorithm, and particularly vulnerable to Collisions. But the collision vulnerability is not very risky and somebody might use that as an advantage, but ...
2
votes
2answers
663 views

What does it mean that Hmac is secure?

I'm not taking about general collision attack on weak hash function such as MD5 or SHA-1. I'm wondering security of HMAC which is based on weak hash function If there are key k, message m Hmac(k,m) =...
1
vote
3answers
2k views

Is md5(md5(password).salt) secure? [duplicate]

I know md5 is considered non-secure but what if someone used md5(md5(password).salt) instead? Isn't this technically better / more secure?
-2
votes
1answer
103 views

password hashing: maximize collisions for storage of password history

For a user's active login, clearly it's best to use the slowest algorithm possible with the least collisions possible in order to prevent an attacker from signing in as another user. When it comes ...
0
votes
3answers
2k views

Does re-hashing a part of the password hash increase security?

I am not a security expert but I am trying to get my head around the current best practices for adopting a security policy for a website that will contain sensitive information. In terms of someone ...
4
votes
4answers
9k views

Convert SHA-256 to SHA-1 and MD5 - Increase bit length/entropy? [duplicate]

I know this is a real dumb question and I am certainly talking complete rubbish, but let me explain: We have a long SHA-256 hash, e.g.: ...
3
votes
1answer
3k views

Find salt from md5 hash if password is known

I have a salted MD5 hash and I also know the password. How can I recover the salt using tools like John The Ripper (I have JTR jumbo installed)?
0
votes
3answers
4k views

Is it possible to reverse MD5? [duplicate]

I'm new in the security world and right now I'm studying about hashes. Let's say I have md5(x+q) and md5(y+q). I know the value of x and y hidden into md5. Would it be possible to reverse it and ...
-15
votes
1answer
686 views

I have an MD5 encrypted link. How do I decrypt? [closed]

I have this MD5 hash of a link: 687474703a2f2f696d6775722e636f6d2f45554a43734742 I only have this code, no other information. How can I crack it?
2
votes
2answers
333 views

Using a hash in place of user data

I'm storing client data and they are sensitive about privacy and security of the data. In some cases, I don't need the actual data, but could work with a hash of the data. For example, in the case of ...
-5
votes
2answers
864 views

How to brute force this token in php, if it is possible

it is possible to brute-force this token (MD5 Hash) of the following script (PHP) in a realistic time (0,5h - 24h)? If the answer is YES, how could I do it, for example with PHP or Python? $time = ...
9
votes
2answers
459 views

Is there any recommended approach for “upgrading” MD5 hashes to something secure? [duplicate]

I'm currently dealing with a couple of user accounts containing MD5 hashed passwords. These accounts got migrated from an old system into our current system which uses PBKDF2 for password hashing. I ...
1
vote
1answer
71 views

Possible number of collisions in a hashing function with constant message size

Jumping to conclusions from my question, can we predict possible number of collisions for a given message in a given hashing algorithm. Say I am using SHA-1 which outputs 160 characters string, and ...
-1
votes
1answer
81 views

Shouldn't multiple images always exist even in most powerful hashing algorithm?

I have a confusion in mind that since in hashing we transform a large string into a smaller fixed size string, so its unlikely that any large string has a unique hash. There had to be collisions and ...
1
vote
2answers
366 views

Is it possible to find the salt?

I have this PHP code with me : $auth = md5($username.$password.$salt); I have a dummy value : $username = user $password = password And I also have the resulting MD5 Hash : ...
5
votes
2answers
4k views

Is signing android apk file with SHA1 digest secure enough?

Google command line example for signing apk files: $ jarsigner -verbose -sigalg SHA1withRSA -digestalg SHA1 -keystore my-release-key.keystore my_application.apk alias_name source: http://developer....
7
votes
1answer
7k views

MD5 Algorithm: A basic explanation of the process

Could anyone please explain the basic idea and steps involved in the MD5 algorithm? I tried reading it on the web (Wikipedia etc.), but it was just too high level for me. So, can someone explain the ...
-8
votes
2answers
4k views

What is is the best way to create virus signature database? [closed]

We are thinking to develop a new Antivirus program. The main concern is to create a virus signature database. I want to ask what is the best possible way to add viruses signature in our database to ...
1
vote
0answers
52 views

Transmitted sensitive user data

At the moment, I have set up mitmproxy and can record all HTTP/HTTPS communications between the client and server. For research purposes I am looking to find a way to detect potential leakage of ...
3
votes
2answers
980 views

Are there any known MD5 hash collisions of messages of different length?

All the examples of MD5 hash collisions I've come across comprise two different messages (inputs) of the same length. The first and second messages have different values for a number of bits and the ...