Questions tagged [md5]

a cryptographic hash function with a 128-bit (16-byte) output, now deprecated

Filter by
Sorted by
Tagged with
0 votes
0 answers
50 views

Break MD5 with partial control of hashed value

During a pentest some time ago, I came across an interesting functionality, and upon research, it appeared that I had partial control over the starting value in an MD5 hash. With some more digging, ...
user avatar
  • 1
0 votes
0 answers
24 views

use of md5 for protecting file integrity over http/https call [duplicate]

A common way to ensure integrity of a file uploaded from a client is to include the md5 header in the request which can be used by the server for the same. I would like to know that if a file can be ...
user avatar
1 vote
2 answers
971 views

John The Ripper does not load password hash, how can I fix it?

I want to crack a specific hash password with JTR: 48bb6e862e54f2a795ffc4e541caed4d I put this hash in a txt file like this: echo '48bb6e862e54f2a795ffc4e541caed4d' > hash.txt and I run JTR in ...
user avatar
2 votes
1 answer
123 views

Is there a well-defined algorithm to find preimages in MD5?

I know MD5 is no longer secure, but is there an algorithm running in polynomial time to find preimages of a given hash, or is it just bruteforce?
user avatar
  • 21
0 votes
0 answers
130 views

Disabled MD5 and enabled SHA under SCHANNEL/Hashes in registry. xfreerdp fails with an ssl i/o error

So delving into securing server and not quite understanding how I broke the ability to rdp into my server (using xfreerdp). I disabled MD5 as an available hash and enabled SHA. The exact changes in ...
user avatar
  • 212
0 votes
1 answer
224 views

Is pbkdf2 with hmac using md5 still secure?

I have an old system that can do PBKDF2 with HMAC using MD5, but not SHA-2. Now I know that MD5 is insecure and shouldn't be used for new applications, but https://crypto.stackexchange.com/a/9340/...
user avatar
  • 1,136
1 vote
2 answers
247 views

Is md5(time . rand) secure enough for a small website?

I'm working on a small game website and don't expect too much traffic. Would md5(time . rand) suffice to have a "random enough" identifier for a game? (Or is it easy to get a clash that way?)...
user avatar
  • 115
0 votes
0 answers
15 views

Significant differences in hash cracking speeds? [duplicate]

I'm doing an educational hash research. I generated MD5 hash using online tools and cracked it within a second using Hashcat and certain wordlist (yes, one second). Then I produced a WPA handshake ...
user avatar
26 votes
3 answers
7k views

Known strings to have the same MD5 hash, not colliding in real life?

I was reading this article about MD5 hash collisions in which it clearly states that these two strings (differences marked with ^): ...
user avatar
11 votes
5 answers
7k views

Why would one need to encode an MD5 hash string? Is it unsafe to display unencoded?

I was reading this article which talks about a design to shorten URLs, and in the design section, it says that the given URL can be hashed using a hashing algorithm such as MD5, and then be encoded ...
user avatar
  • 213
0 votes
0 answers
139 views

FedRamp Moderate question about hashing MD5

If I use MD5 but not for cryptography purposes, and not for any authentication or authorization mechanism, Am I in violation of FedRamp Moderate?
user avatar
10 votes
4 answers
5k views

SHA & MD5 Collisions for shorter strings

This is not for passwords. I understand that MD5 and SHA-512, etc... are insecure because they can have collisions. However, is it still possible to have a collision if the string length is less than ...
user avatar
1 vote
1 answer
266 views

Do all files downloaded from the web, come with a checksum to verify the file?

Pretty straightforward question. Take the image here: https://i.imgur.com/oEdf6Rl.png Does it come with a checksum, which I can verify against after I have fully downloaded the file? This question ...
user avatar
1 vote
1 answer
187 views

Is md5(data + key) secure if a proper hmac function isn't available?

I need to generate a MAC signature for data on a website, but it's in a HTML templating system where there's only a few functions available. The only hashing function available is md5. Ideally, I'd ...
user avatar
1 vote
1 answer
309 views

MD5 as X.509 Signature hash algorithm with TLS 1.2 and SChannel

Is it correct that TLS 1.2 prohibits MD5 as a Signature hash algorithm in X.509 certificates used? Is this just an SChannel + TLS 1.2 limitation? Trying to find any webpage/documentation that is ...
user avatar
  • 135
7 votes
1 answer
1k views

Is MD5 hashing possible by divide and conquer algorithm

I would like to compute the MD5 hash of a file The file is uploaded to my webserver by my clients The file is uploaded in pieces (called chunks) The client also sends the md5 hash of the file so that ...
user avatar
0 votes
1 answer
1k views

What is the plaintext password of 'hash part 1' in the shadow file?

on immersivelabs lab Password Hashes II https://dca.immersivelabs.online/labs/password-hashes-ii/ there is a question: What is the plaintext password of 'hash part 1' in the shadow file? shadow.txt ...
user avatar
45 votes
3 answers
9k views

Is bcrypt(strtolower(hex(md5(pass)))) ok for storing passwords? [duplicate]

I have a large database where passwords are stored as strtolower(hex(md5(pass))) (which is a bad way to store passwords, prone to rainbow tables, cheap to dictionary attack, no salt, etc.), and I'm ...
user avatar
1 vote
3 answers
739 views

Authentication & Authorization via md5(userid + secret + endpoint + payload)?

I am currently developing against a RESTful API that seemingly has a rather weird auth flow. I got an API key consisting of an ID (public) and a "secret" (which seems to be a UUID). Now, ...
user avatar
1 vote
2 answers
259 views

Forge certificate for man in the middle attack

I'm trying to analyze a SSLv3 connection. The certificate of the server has a "MD5 with RSA" signature. So I was setting up a local man in the middle attack by setting up a local DNS server ...
user avatar
  • 13
10 votes
3 answers
3k views

Client side password hashing with static salt - did I find a breach?

I downloaded a software that has a login interface. It's a $100 a month subscription software. I disassembled the software and found that passwords are being sent by combining them with a hard coded &...
user avatar
  • 203
1 vote
1 answer
148 views

If site provides MD5 to check file, can't the comparison string also not be modified? [duplicate]

I am new to this so please bear with me. I was downloading a VM image and I was told to check the MD5. Naturally, I did but wondered, If a hacker would change the file to be downloaded from the ...
user avatar
0 votes
2 answers
606 views

MD5 PPPoE chap crack

My apartment complex uses PPPoE CHAP authentication for internet (Mikrotik router), I want to switch their provided router with my own, however they aren't willing to give me my password. I have ...
user avatar
  • 3
0 votes
1 answer
629 views

How to find just the first character or value of a MD5 hash string

I want to know how to find just the first character or digit in first part of a 64 length string from a MD5 hash. For example, we have a hash: ...
user avatar
  • 11
1 vote
1 answer
600 views

Possible to decode md5 hash of a malicious URL?

Context: I had a virus on my WordPress website server that injected itself into every functions.php file on the server across two different sites. After removing the heavily obfuscated virus code I ...
user avatar
  • 13
1 vote
2 answers
287 views

Hash and data modification

If I have the MD5 and SHA1 hash matches for an encrypted container. Is there no possibility it's been modified? Is it safe to assume the container has never been modified?
user avatar
1 vote
1 answer
280 views

Finding original command result from MD5 hash

Basically I hashed the result of the "date" command with md5sum: $date | md5sum The output is indeed in the likes of: e4c94362cd4fd71ec6aca78c7411bdc3 - My question was: is it possible to recover ...
user avatar
4 votes
2 answers
739 views

How safe is md5sum in regards to verifying executable files?

is it possible to trick someone into running a malicious executable file instead of a real one provided by a website; assuming they will md5sum the file
user avatar
6 votes
1 answer
594 views

Securely displaying hidden integers with MD5

A system I'm studying uses the following mechanism: a 19-digit integer is hashed via the MD5 algorithm and the salt of the integer is shown in plain sight to the user before they take an irreversible ...
user avatar
  • 1,053
1 vote
1 answer
1k views

Tools to produce an MD5 collision?

I'd like to learn a bit more about MD5 collisions. So let's assume I have a message m: m = somesecretmessage And I hash that message: z = md5(m) The only know information is z. I do not know m. ...
user avatar
  • 165
1 vote
1 answer
6k views

Can I crack a zip file using Hash Suite on Windows?

I'm trying to crack a password I set on a zip file using Hash Suite but it doesn't seem to work for me (not sure if I'm doing everything correctly). Basically, this is what I've done: Created a ...
user avatar
  • 13
0 votes
2 answers
3k views

How do you manually encrypt text to an md5 hash?

I am aware that you can do something like go to md5online.org or something, but I want to know how to do it manually. For example, you might encrypt it like by taking the length of it and turning the ...
user avatar
1 vote
3 answers
325 views

Disguising the type of hash used

I've read about why MD5, SHA1, and many other hashing functions are insecure, by a lot, but I'm thinking of doing a different approach. It won't increase security, I'm aware of that, but I believe it ...
user avatar
  • 137
3 votes
0 answers
71 views

How secure is this combined sha1/md5 hash [duplicate]

Recently we outsourced some work for a website. While reviewing this code I came across the password hash function. I am in no way a security expert besides some basic knowledge (hence outsourcing ...
user avatar
  • 131
2 votes
0 answers
176 views

Attacking a update mechanism using MD5 and RSA

I am currently working on a software challenge where you have to unlock several functions of a piece of software. The software is written in Java. One of them is the update mechanism of the firmware. ...
user avatar
  • 141
2 votes
3 answers
2k views

How secure is using MD5 for signature

Generally speaking, MD5 is considered as broken for secure usage these days, but I came across a signature design using MD5 many times recently in my company. The detail shows as following: T = text, ...
user avatar
  • 23
2 votes
1 answer
5k views

Advice to help crack MD5crypt hash

I've been given a homework task to crack a particularly difficult password on a Unix system. I have found users and hashes in the etc/shadow file and cracked all but this one: $1$TyPfW4pp$...
user avatar
  • 31
1 vote
2 answers
6k views

How long does it take to compute hashes using the MD5 hash algorithm? [closed]

1) If one iteration of MD5 takes x seconds, is it safe to assume that n iterations of MD5 takes n * x seconds? 2) Will salted and unsalted versions of md5 hash algorithms take approximately the same ...
user avatar
9 votes
7 answers
10k views

How likely is a collision using MD5 compared to SHA256 (for checking file integrity)?

Many sites these days offer MD5 and SHA256 hashes to check the integrity of downloaded files or archives. I wonder how much safer is the use of the SHA256 hashes for integrity checks? Note: Consider ...
user avatar
  • 3,476
0 votes
1 answer
4k views

Brute force MD5 with a prefix and suffix up to n characters/words

I have a couple of things I would like to explore with hashcat. I have a MD5 hashed password, which I know for a fact has a prefix and a suffix. The actual password is located in the middle of the ...
user avatar
17 votes
2 answers
14k views

Which hashing algorithm shoud I use for a safe file checksum?

For my work I'll need to provide my customer a specific file which will be the result of the work I have done for them. To protect the integrity of the work I have done and to guarantee it has never ...
user avatar
  • 173
2 votes
1 answer
194 views

Potential security issue with md5 filename

I've been storing files using a filename of the md5 hash of the file. This allows me to not store duplicates of the same file and avoids any filename clashes. Each file has uses a different salt/iv. ...
user avatar
3 votes
2 answers
770 views

The way to determine IV for AES encryption, possible security problems with this approach

I am trying to make a folder encryption with maximum automation (except password input). Inside a bash script I do the following: echo $RANDOM | md5sum | cut -d' ' -f1 > iv and then using it: ...
user avatar
2 votes
1 answer
776 views

Is it possible to tell if a file's message digest is MD5 or SHA-256?

There's some old data encrypted with OpenSSL 1.0.2, but now OpenSSL is at 1.1.0. I understand from OpenSSL FAQ USER3 that an old file can be decrypted with 1.1.0 by using -md md5. But let's say you ...
user avatar
  • 123
0 votes
2 answers
5k views

Is it possible to crack Joomla hash password?

I'm a developer and suddenly I fall in a stupid situation like I need to crack a hash Joomla password which is (5aa154999c111bf7f33a1a3cadba5847) and I don't know the salt. is there any way to crack ...
user avatar
  • 129
0 votes
1 answer
639 views

Calculating Entropy using md5sum, sha256sum etc

We can calculate the Entropy S of a string simply like this: S = L * log_2(N) Where L stands for used characters in the string And N for every possible character Example: We want to calculate the ...
user avatar
  • 3
57 votes
5 answers
16k views

Is it secure to use MD5 to verify the integrity of small files (less than 15kb)?

I know that collision for MD5 has been documented since the 90s and that digital certificates based off of MD5 has been demonstrated to be completely compromised back in 2010 but how effective is MD5 ...
user avatar
1 vote
2 answers
4k views

How one can find a string whose MD5 hash has a specific prefix?

I've heard that there is a string that contains only the letters a to z whose MD5 hash begins with the hexadecimal prefix 314159265358 and the rest can be arbitrary. How can one find such a string and ...
user avatar
2 votes
1 answer
668 views

Path traversal using hash extension attack

I'm trying to write a PoC for path traversal using hash extension attack on a PHP site. My obstacle is in specifying an acceptable string. The vulnerability is in in the URL: http://127.0.0.1/...
user avatar
  • 23
0 votes
2 answers
158 views

Rearranging hash adds no security?

I'm a rookie when it comes to Information Security so I've been reading a lot of the top questions on this stackexchange for the sake of learning. I came across this question that discusses hashing. ...
user avatar
  • 15

1
2 3 4 5