Questions tagged [md5]

a cryptographic hash function with a 128-bit (16-byte) output, now deprecated

Filter by
Sorted by
Tagged with
1
vote
3answers
68 views

Authentication & Authorization via md5(userid + secret + endpoint + payload)?

I am currently developing against a RESTful API that seemingly has a rather weird auth flow. I got an API key consisting of an ID (public) and a "secret" (which seems to be a UUID). Now, ...
0
votes
0answers
28 views

Would increasing the “target space” of MD5 collisions make it significantly easier to find a collision? [migrated]

This is tangential to this question, which asks about generating a file to match an exact MD5 hash. My question is if it would be significantly easier to generate a file that is "within X digits ...
1
vote
1answer
56 views

Forge certificate for man in the middle attack

I'm trying to analyze a SSLv3 connection. The certificate of the server has a "MD5 with RSA" signature. So I was setting up a local man in the middle attack by setting up a local DNS server that would ...
8
votes
3answers
3k views

Client side password hashing with exposed salt word - did I find a breach?

I downloaded a software that has a login interface. It's a $100 a month subscription software. I disassembled the software and found that passwords are being sent by combining them with a hard coded "...
0
votes
0answers
32 views

SNMPv3 Authentication Calculating Hashes?

I was reading this article https://vad3rblog.wordpress.com/2017/09/11/snmp/ and writing a script to implement the method to brute force the authentication password as described in the article. ...
1
vote
1answer
58 views

If site provides MD5 to check file, can't the comparison string also not be modified? [duplicate]

I am new to this so please bear with me. I was downloading a VM image and I was told to check the MD5. Naturally, I did but wondered, If a hacker would change the file to be downloaded from the ...
0
votes
1answer
114 views

MD5 PPPoE chap crack

My apartment complex uses PPPoE CHAP authentication for internet (Mikrotik router), I want to switch their provided router with my own, however they aren't willing to give me my password. I have ...
0
votes
1answer
208 views

How to find just the first character or value of a MD5 hash string

I want to know how to find just the first character or digit in first part of a 64 length string from a MD5 hash. For example, we have a hash: ...
1
vote
1answer
227 views

Possible to decode md5 hash of a malicious URL?

Context: I had a virus on my WordPress website server that injected itself into every functions.php file on the server across two different sites. After removing the heavily obfuscated virus code I ...
1
vote
2answers
79 views

Hash and data modification

If I have the MD5 and SHA1 hash matches for an encrypted container. Is there no possibility it's been modified? Is it safe to assume the container has never been modified?
1
vote
1answer
97 views

Finding original command result from MD5 hash

Basically I hashed the result of the "date" command with md5sum: $date | md5sum The output is indeed in the likes of: e4c94362cd4fd71ec6aca78c7411bdc3 - My question was: is it possible to recover ...
3
votes
2answers
199 views

How safe is md5sum in regards to verifying executable files?

is it possible to trick someone into running a malicious executable file instead of a real one provided by a website; assuming they will md5sum the file
6
votes
1answer
517 views

Securely displaying hidden integers with MD5

A system I'm studying uses the following mechanism: a 19-digit integer is hashed via the MD5 algorithm and the salt of the integer is shown in plain sight to the user before they take an irreversible ...
1
vote
1answer
414 views

Tools to produce an MD5 collision?

I'd like to learn a bit more about MD5 collisions. So let's assume I have a message m: m = somesecretmessage And I hash that message: z = md5(m) The only know information is z. I do not know m. ...
0
votes
1answer
2k views

Can I crack a zip file using Hash Suite on Windows?

I'm trying to crack a password I set on a zip file using Hash Suite but it doesn't seem to work for me (not sure if I'm doing everything correctly). Basically, this is what I've done: Created a ...
0
votes
2answers
867 views

How do you manually encrypt text to an md5 hash?

I am aware that you can do something like go to md5online.org or something, but I want to know how to do it manually. For example, you might encrypt it like by taking the length of it and turning the ...
0
votes
0answers
129 views

How long will it take to crack a hashed random string

If I generate 128 bit, 512 bit and 1024 bit random strings using either: A native rand() function (C, PHP, Python, etc) OpenSSL random bytes Hardware generated random number And hash the random ...
1
vote
3answers
236 views

Disguising the type of hash used

I've read about why MD5, SHA1, and many other hashing functions are insecure, by a lot, but I'm thinking of doing a different approach. It won't increase security, I'm aware of that, but I believe it ...
3
votes
0answers
70 views

How secure is this combined sha1/md5 hash [duplicate]

Recently we outsourced some work for a website. While reviewing this code I came across the password hash function. I am in no way a security expert besides some basic knowledge (hence outsourcing ...
2
votes
0answers
125 views

Attacking a update mechanism using MD5 and RSA

I am currently working on a software challenge where you have to unlock several functions of a piece of software. The software is written in Java. One of them is the update mechanism of the firmware. ...
1
vote
3answers
531 views

How secure is using MD5 for signature

Generally speaking, MD5 is considered as broken for secure usage these days, but I came across a signature design using MD5 many times recently in my company. The detail shows as following: T = text, ...
2
votes
1answer
3k views

Advice to help crack MD5crypt hash

I've been given a homework task to crack a particularly difficult password on a Unix system. I have found users and hashes in the etc/shadow file and cracked all but this one: $1$TyPfW4pp$...
0
votes
2answers
2k views

How long does it take to compute hashes using the MD5 hash algorithm? [closed]

1) If one iteration of MD5 takes x seconds, is it safe to assume that n iterations of MD5 takes n * x seconds? 2) Will salted and unsalted versions of md5 hash algorithms take approximately the same ...
7
votes
6answers
3k views

How likely is a collision using MD5 compared to SHA256 (for checking file integrity)?

Many sites these days offer MD5 and SHA256 hashes to check the integrity of downloaded files or archives. I wonder how much safer is the use of the SHA256 hashes for integrity checks? Note: Consider ...
0
votes
1answer
1k views

Brute force MD5 with a prefix and suffix up to n characters/words

I have a couple of things I would like to explore with hashcat. I have a MD5 hashed password, which I know for a fact has a prefix and a suffix. The actual password is located in the middle of the ...
7
votes
2answers
5k views

Which hashing algorithm shoud I use for a safe file checksum?

For my work I'll need to provide my customer a specific file which will be the result of the work I have done for them. To protect the integrity of the work I have done and to guarantee it has never ...
2
votes
1answer
51 views

Potential security issue with md5 filename

I've been storing files using a filename of the md5 hash of the file. This allows me to not store duplicates of the same file and avoids any filename clashes. Each file has uses a different salt/iv. ...
3
votes
2answers
697 views

The way to determine IV for AES encryption, possible security problems with this approach

I am trying to make a folder encryption with maximum automation (except password input). Inside a bash script I do the following: echo $RANDOM | md5sum | cut -d' ' -f1 > iv and then using it: ...
2
votes
1answer
366 views

Is it possible to tell if a file's message digest is MD5 or SHA-256?

There's some old data encrypted with OpenSSL 1.0.2, but now OpenSSL is at 1.1.0. I understand from OpenSSL FAQ USER3 that an old file can be decrypted with 1.1.0 by using -md md5. But let's say you ...
0
votes
2answers
3k views

Is it possible to crack Joomla hash password?

I'm a developer and suddenly I fall in a stupid situation like I need to crack a hash Joomla password which is (5aa154999c111bf7f33a1a3cadba5847) and I don't know the salt. is there any way to crack ...
0
votes
1answer
375 views

Calculating Entropy using md5sum, sha256sum etc

We can calculate the Entropy S of a string simply like this: S = L * log_2(N) Where L stands for used characters in the string And N for every possible character Example: We want to calculate the ...
55
votes
5answers
14k views

Is it secure to use MD5 to verify the integrity of small files (less than 15kb)?

I know that collision for MD5 has been documented since the 90s and that digital certificates based off of MD5 has been demonstrated to be completely compromised back in 2010 but how effective is MD5 ...
1
vote
2answers
2k views

How one can find a string whose MD5 hash has a specific prefix?

I've heard that there is a string that contains only the letters a to z whose MD5 hash begins with the hexadecimal prefix 314159265358 and the rest can be arbitrary. How can one find such a string and ...
2
votes
1answer
487 views

Path traversal using hash extension attack

I'm trying to write a PoC for path traversal using hash extension attack on a PHP site. My obstacle is in specifying an acceptable string. The vulnerability is in in the URL: http://127.0.0.1/...
0
votes
2answers
113 views

Rearranging hash adds no security?

I'm a rookie when it comes to Information Security so I've been reading a lot of the top questions on this stackexchange for the sake of learning. I came across this question that discusses hashing. ...
3
votes
2answers
2k views

Would using both SHA1 and MD5 hashes of files help reduce the risk of deleting non duplicates

I'm making a program to compare all the files on a 3Tb drive by hash and delete duplicates. I was initially going to use MD5, but was worried that with 3Tb of files, there was a slight chance of a ...
-1
votes
1answer
1k views

Is it possible to crack any MD5 hashes (without salt)? [duplicate]

We all know currently MD5 hash can be cracked but I was wondering if any hashes can be cracked since most crackers are searching in their database instead of cracking, so let's pretend we get a ...
0
votes
1answer
603 views

Are passwords longer than 128 bits useless if hashed with MD5? [duplicate]

Are passwords that are longer than 128 bits useless if they get hashed/transmitted with MD5? MD5 always uses 128 bits, thus someone would rather try to bruteforce the MD5-hash than the password ...
0
votes
1answer
112 views

How to check if some encryptions are disabled in OpenSSL?

I want to check if the following encryptions are disabled in the openssl-1.0.2l TLS_RSA_WITH_RC4_128_MD5 TLS_RSA_WITH_RC4_128_SHA SSL_RSA_WITH_RC4_128_MD5 SSL_RSA_WITH_RC4_128_SHA ...
1
vote
2answers
314 views

Unix - Automated MD5 Checksum Verification

I am currently looking into ways of securing a number of E-Commerce websites which serve a large amount of traffic every day. So far we have implemented WAF's (Web Application Firewall), SSL ...
0
votes
0answers
158 views

MD5 Bcrypt best practice [duplicate]

I'm currently storing bcrypt encrypted passwords in my database. At the moment my html forms submit a clear text password to my server, which then compares the bcrypt result (of the clear text) for a ...
2
votes
1answer
666 views

Publish a PDF on a website with MD5 Hash [closed]

I want to publish PDF documents on my website. I calculated the MD5 Hash of the file before uploading it. I want to provide this hash so that the downloader can check if the file is okay. What is the ...
1
vote
1answer
231 views

How do user get access to login when passwords are stored in MD5?

MD5 is a hash, so it is a one-way cryptographic function. But I am not sure that MD5 has only one hash per input? Web application stores the passwords hashed with MD5, but when the user enters the ...
11
votes
2answers
3k views

MD5 Preimage Vulnerability in 2017

I've recently discovered that one of our (strictly internal facing - no external risk unless other systems are completely compromised) platforms is storing passwords by salting and then MD5 hashing ...
0
votes
2answers
369 views

Inconsistency Among MD5, SHA1, and SHA256 Hashing Protocols

There appears to be an inconsistency (or unpublished protocol) in many online hash generators when formulating a hash from an uploaded text file, versus strictly hashing the contents of a file. This ...
23
votes
1answer
5k views

Received “md5” in access logs

In our Apache server we have received around 200 HTTP GET requests from the same IP and a common string in each request is "md5", e.g. index.php?option=com_s5clanroster&view=s5clanroster&...
2
votes
3answers
214 views

Would it be okay to check only a part of a hash value

Practically, the hash value of a server host key can be (relatively) long and thoroughly compare it with the record again and again can be annoying. For example, for a given md5 hash value: 43:89:1b:...
6
votes
1answer
2k views

Why brute-force the password instead of the key directly?

This answer on another question on security stackexchange by a very reputed user explains why he prefers GnuPG over OpenSSL for file encryption. From what I understand, it can be summarized as this: ...
0
votes
1answer
1k views

Using MD5 as salt

I know that MD5 is a poor choice for hashing passwords, but its not my ideia. Imagine that we would use the username as a salting mechanism, wich is also bad idea, but just for an example. First, we ...
-1
votes
2answers
2k views

Is it possible to recreate a file using only its hash [duplicate]

To my knowledge, a file can have only one hash and a hash corresponds to only that file(keeping aside the 2 file one hash bug). Using that knowledge is it possible to make an algorithm to recreate a ...

1
2 3 4 5