Questions tagged [md5]
a cryptographic hash function with a 128-bit (16-byte) output, now deprecated
253
questions
0
votes
1
answer
137
views
How secure is HTTP auth digest in 2023
I'm trying to figure out the time needed to crack an HTTP digest auth. According to the RFC2069, the digest in calculated according to this scheme :
HA1 = MD5(username:realm:password)
HA2 = MD5(method:...
- 569
0
votes
3
answers
217
views
Is downloading a linux ISO from an HTTP site and running it in VirtualBox very risky?
Recently, after doing a fresh install of my Mac's OS, I downloaded VirtualBox and, from an HTTP site, a linux ISO. The ISO had only an MD5 checksum for verification. The hashes matched. So I ran the ...
- 111
3
votes
2
answers
357
views
How can I identify the salt value used in a password hash?
I'm currently learning about password cracking, and I have a set of passwords with their respective hash values. I used Hashcat to crack the hash values, just to see how it works, but I got different ...
0
votes
0
answers
64
views
How to find the correspond hash algorithm? [duplicate]
I'm currently working on a project. but i still facing some issue due to some crypted data. i know the plaintext and got the correspond hash.
plaintext: C018AE45B37DAE665486F4151E0C1E6F
Hash: rROkd+...
- 11
0
votes
0
answers
194
views
Cracking an MD5 password with little info to go off of
I am taking a security class and part of an assignment this week is to crack a given MD5 hash.
All the professor has given us for this task is the hash, the knowledge that the password is 6 or 7 ...
- 1
1
vote
3
answers
308
views
Can I find the MD5 hash key used using input password and output hash?
I was testing a website and found that my password is travelling as a md5 hash over the network and since it is my password is there any way I can find the key used to hash my password as I have the ...
0
votes
0
answers
136
views
Break MD5 with partial control of hashed value
During a pentest some time ago, I came across an interesting functionality, and upon research, it appeared that I had partial control over the starting value in an MD5 hash.
With some more digging, ...
- 1
0
votes
0
answers
24
views
use of md5 for protecting file integrity over http/https call [duplicate]
A common way to ensure integrity of a file uploaded from a client is to include the md5 header in the request which can be used by the server for the same.
I would like to know that if a file can be ...
- 103
1
vote
2
answers
7k
views
John The Ripper does not load password hash, how can I fix it?
I want to crack a specific hash password with JTR:
48bb6e862e54f2a795ffc4e541caed4d
I put this hash in a txt file like this:
echo '48bb6e862e54f2a795ffc4e541caed4d' > hash.txt
and I run JTR in ...
2
votes
1
answer
162
views
Is there a well-defined algorithm to find preimages in MD5?
I know MD5 is no longer secure, but is there an algorithm running in polynomial time to find preimages of a given hash, or is it just bruteforce?
- 21
0
votes
0
answers
578
views
Disabled MD5 and enabled SHA under SCHANNEL/Hashes in registry. xfreerdp fails with an ssl i/o error
So delving into securing server and not quite understanding how I broke the ability to rdp into my server (using xfreerdp). I disabled MD5 as an available hash and enabled SHA. The exact changes in ...
- 212
0
votes
1
answer
578
views
Is pbkdf2 with hmac using md5 still secure?
I have an old system that can do PBKDF2 with HMAC using MD5, but not SHA-2. Now I know that MD5 is insecure and shouldn't be used for new applications, but https://crypto.stackexchange.com/a/9340/...
- 1,166
2
votes
2
answers
514
views
Is md5(time . rand) secure enough as session ID?
I'm working on a small game website and don't expect too much traffic.
Would md5(time . rand) suffice to have a "random enough" identifier for a game?
(Or is it easy to get a clash that way?)...
- 125
0
votes
0
answers
16
views
Significant differences in hash cracking speeds? [duplicate]
I'm doing an educational hash research. I generated MD5 hash using online tools and cracked it within a second using Hashcat and certain wordlist (yes, one second). Then I produced a WPA handshake ...
- 684
26
votes
3
answers
8k
views
Known strings to have the same MD5 hash, not colliding in real life?
I was reading this article about MD5 hash collisions in which it clearly states that these two strings (differences marked with ^):
...
- 495
12
votes
5
answers
9k
views
Why would one need to encode an MD5 hash string? Is it unsafe to display unencoded?
I was reading this article which talks about a design to shorten URLs, and in the design section, it says that the given URL can be hashed using a hashing algorithm such as MD5, and then be encoded ...
- 223
0
votes
0
answers
238
views
FedRamp Moderate question about hashing MD5
If I use MD5 but not for cryptography purposes, and not for any authentication or authorization mechanism, Am I in violation of FedRamp Moderate?
- 111
10
votes
4
answers
6k
views
SHA & MD5 Collisions for shorter strings
This is not for passwords. I understand that MD5 and SHA-512, etc... are insecure because they can have collisions.
However, is it still possible to have a collision if the string length is less than ...
- 109
1
vote
1
answer
745
views
Do all files downloaded from the web, come with a checksum to verify the file?
Pretty straightforward question. Take the image here:
https://i.imgur.com/oEdf6Rl.png
Does it come with a checksum, which I can verify against after I have fully downloaded the file?
This question ...
1
vote
1
answer
286
views
Is md5(data + key) secure if a proper hmac function isn't available?
I need to generate a MAC signature for data on a website, but it's in a HTML templating system where there's only a few functions available. The only hashing function available is md5. Ideally, I'd ...
- 113
1
vote
1
answer
535
views
MD5 as X.509 Signature hash algorithm with TLS 1.2 and SChannel
Is it correct that TLS 1.2 prohibits MD5 as a Signature hash algorithm in X.509 certificates used?
Is this just an SChannel + TLS 1.2 limitation?
Trying to find any webpage/documentation that is ...
- 135
7
votes
1
answer
2k
views
Is MD5 hashing possible by divide and conquer algorithm
I would like to compute the MD5 hash of a file
The file is uploaded to my webserver by my clients
The file is uploaded in pieces (called chunks)
The client also sends the md5 hash of the file so that ...
1
vote
2
answers
2k
views
What is the plaintext password of 'hash part 1' in the shadow file?
In Immersive Labs lab "Password Hashes II"
What is the plaintext password of 'hash part 1' in the shadow file?
shadow.txt contains:
part1:$6$WJ9Y7LHr$S3SdnPsXhCzHetPz0CL6TL7gZdeVK/...
- 21
45
votes
3
answers
9k
views
Is bcrypt(strtolower(hex(md5(pass)))) ok for storing passwords? [duplicate]
I have a large database where passwords are stored as strtolower(hex(md5(pass))) (which is a bad way to store passwords, prone to rainbow tables, cheap to dictionary attack, no salt, etc.),
and I'm ...
- 564
1
vote
3
answers
1k
views
Authentication & Authorization via md5(userid + secret + endpoint + payload)?
I am currently developing against a RESTful API that seemingly has a rather weird auth flow.
I got an API key consisting of an ID (public) and a "secret" (which seems to be a UUID).
Now, ...
- 13
1
vote
1
answer
436
views
Forge certificate for man in the middle attack
I'm trying to analyze a SSLv3 connection. The certificate of the server has a "MD5 with RSA" signature. So I was setting up a local man in the middle attack by setting up a local DNS server ...
- 23
10
votes
3
answers
3k
views
Client side password hashing with static salt - did I find a breach?
I downloaded a software that has a login interface. It's a $100 a month subscription software.
I disassembled the software and found that passwords are being sent by combining them with a hard coded &...
- 203
1
vote
1
answer
212
views
If site provides MD5 to check file, can't the comparison string also not be modified? [duplicate]
I am new to this so please bear with me. I was downloading a VM image and I was told to check the MD5. Naturally, I did but wondered,
If a hacker would change the file to be downloaded from the ...
- 179
0
votes
2
answers
942
views
MD5 PPPoE chap crack
My apartment complex uses PPPoE CHAP authentication for internet (Mikrotik router), I want to switch their provided router with my own, however they aren't willing to give me my password.
I have ...
- 3
0
votes
1
answer
830
views
How to find just the first character or value of a MD5 hash string
I want to know how to find just the first character or digit in first part of a 64 length string from a MD5 hash. For example, we have a hash:
...
- 11
1
vote
1
answer
772
views
Possible to decode md5 hash of a malicious URL?
Context: I had a virus on my WordPress website server that injected itself into every functions.php file on the server across two different sites. After removing the heavily obfuscated virus code I ...
- 13
1
vote
2
answers
375
views
Hash and data modification
If I have the MD5 and SHA1 hash matches for an encrypted container. Is there no possibility it's been modified?
Is it safe to assume the container has never been modified?
- 19
1
vote
1
answer
345
views
Finding original command result from MD5 hash
Basically I hashed the result of the "date" command with md5sum:
$date | md5sum
The output is indeed in the likes of:
e4c94362cd4fd71ec6aca78c7411bdc3 -
My question was: is it possible to recover ...
4
votes
2
answers
1k
views
How safe is md5sum in regards to verifying executable files?
is it possible to trick someone into running a malicious executable file instead of a real one provided by a website; assuming they will md5sum the file
- 43
6
votes
1
answer
642
views
Securely displaying hidden integers with MD5
A system I'm studying uses the following mechanism: a 19-digit integer is hashed via the MD5 algorithm and the salt of the integer is shown in plain sight to the user before they take an irreversible ...
- 1,063
2
votes
1
answer
3k
views
Tools to produce an MD5 collision?
I'd like to learn a bit more about MD5 collisions.
So let's assume I have a message m:
m = somesecretmessage
And I hash that message:
z = md5(m)
The only know information is z. I do not know m.
...
- 185
1
vote
1
answer
8k
views
Can I crack a zip file using Hash Suite on Windows?
I'm trying to crack a password I set on a zip file using Hash Suite but it doesn't seem to work for me (not sure if I'm doing everything correctly).
Basically, this is what I've done:
Created a ...
- 13
0
votes
2
answers
5k
views
How do you manually encrypt text to an md5 hash?
I am aware that you can do something like go to md5online.org or something, but I want to know how to do it manually. For example, you might encrypt it like by taking the length of it and turning the ...
- 135
1
vote
3
answers
357
views
Disguising the type of hash used
I've read about why MD5, SHA1, and many other hashing functions are insecure, by a lot, but I'm thinking of doing a different approach.
It won't increase security, I'm aware of that, but I believe it ...
- 137
3
votes
0
answers
71
views
How secure is this combined sha1/md5 hash [duplicate]
Recently we outsourced some work for a website. While reviewing this code I came across the password hash function.
I am in no way a security expert besides some basic knowledge (hence outsourcing ...
- 131
2
votes
0
answers
184
views
Attacking a update mechanism using MD5 and RSA
I am currently working on a software challenge where you have to unlock several functions of a piece of software. The software is written in Java. One of them is the update mechanism of the firmware. ...
- 141
2
votes
3
answers
2k
views
How secure is using MD5 for signature
Generally speaking, MD5 is considered as broken for secure usage these days, but I came across a signature design using MD5 many times recently in my company. The detail shows as following:
T = text, ...
- 23
2
votes
1
answer
6k
views
Advice to help crack MD5crypt hash
I've been given a homework task to crack a particularly difficult password on a Unix system.
I have found users and hashes in the etc/shadow file and cracked all but this one:
$1$TyPfW4pp$...
- 31
1
vote
2
answers
9k
views
How long does it take to compute hashes using the MD5 hash algorithm? [closed]
1) If one iteration of MD5 takes x seconds, is it safe to assume that n iterations of MD5 takes n * x seconds?
2) Will salted and unsalted versions of md5 hash algorithms take approximately the same ...
- 265
12
votes
7
answers
15k
views
How likely is a collision using MD5 compared to SHA256 (for checking file integrity)?
Many sites these days offer MD5 and SHA256 hashes to check the integrity of downloaded files or archives.
I wonder how much safer is the use of the SHA256 hashes for integrity checks?
Note: Consider ...
- 4,066
2
votes
1
answer
5k
views
Brute force MD5 with a prefix and suffix up to n characters/words
I have a couple of things I would like to explore with hashcat. I have a MD5 hashed password, which I know for a fact has a prefix and a suffix. The actual password is located in the middle of the ...
- 175
19
votes
2
answers
20k
views
Which hashing algorithm shoud I use for a safe file checksum?
For my work I'll need to provide my customer a specific file which will be the result of the work I have done for them.
To protect the integrity of the work I have done and to guarantee it has never ...
- 293
2
votes
1
answer
256
views
Potential security issue with md5 filename
I've been storing files using a filename of the md5 hash of the file. This allows me to not store duplicates of the same file and avoids any filename clashes. Each file has uses a different salt/iv.
...
3
votes
2
answers
892
views
The way to determine IV for AES encryption, possible security problems with this approach
I am trying to make a folder encryption with maximum automation (except password input).
Inside a bash script I do the following:
echo $RANDOM | md5sum | cut -d' ' -f1 > iv
and then using it:
...
- 161
2
votes
1
answer
1k
views
Is it possible to tell if a file's message digest is MD5 or SHA-256?
There's some old data encrypted with OpenSSL 1.0.2, but now OpenSSL is at 1.1.0. I understand from OpenSSL FAQ USER3 that an old file can be decrypted with 1.1.0 by using -md md5. But let's say you ...
- 123