Questions tagged [md5]

a cryptographic hash function with a 128-bit (16-byte) output, now deprecated

1
vote
3answers
186 views

Disguising the type of hash used

I've read about why MD5, SHA1, and many other hashing functions are insecure, by a lot, but I'm thinking of doing a different approach. It won't increase security, I'm aware of that, but I believe it ...
3
votes
0answers
67 views

How secure is this combined sha1/md5 hash [duplicate]

Recently we outsourced some work for a website. While reviewing this code I came across the password hash function. I am in no way a security expert besides some basic knowledge (hence outsourcing ...
2
votes
0answers
99 views

Attacking a update mechanism using MD5 and RSA

I am currently working on a software challenge where you have to unlock several functions of a piece of software. The software is written in Java. One of them is the update mechanism of the firmware. ...
1
vote
3answers
192 views

How secure is using MD5 for signature

Generally speaking, MD5 is considered as broken for secure usage these days, but I came across a signature design using MD5 many times recently in my company. The detail shows as following: T = text, ...
0
votes
1answer
361 views

Advice to help crack MD5crypt hash

I've been given a homework task to crack a particularly difficult password on a Unix system. I have found users and hashes in the etc/shadow file and cracked all but this one: $1$TyPfW4pp$...
0
votes
2answers
318 views

How long does it take to compute hashes using the MD5 hash algorithm? [closed]

1) If one iteration of MD5 takes x seconds, is it safe to assume that n iterations of MD5 takes n * x seconds? 2) Will salted and unsalted versions of md5 hash algorithms take approximately the same ...
4
votes
6answers
771 views

How likely is a collision using MD5 compared to SHA256 (for checking file integrity)?

Many sites these days offer MD5 and SHA256 hashes to check the integrity of downloaded files or archives. I wonder how much safer is the use of the SHA256 hashes for integrity checks? Note: Consider ...
0
votes
1answer
409 views

Brute force MD5 with a prefix and suffix up to n characters/words

I have a couple of things I would like to explore with hashcat. I have a MD5 hashed password, which I know for a fact has a prefix and a suffix. The actual password is located in the middle of the ...
1
vote
2answers
999 views

Which hashing algorithm shoud I use for a safe file checksum?

For my work I'll need to provide my customer a specific file which will be the result of the work I have done for them. To protect the integrity of the work I have done and to guarantee it has never ...
1
vote
1answer
40 views

Potential security issue with md5 filename

I've been storing files using a filename of the md5 hash of the file. This allows me to not store duplicates of the same file and avoids any filename clashes. Each file has uses a different salt/iv. ...
3
votes
2answers
634 views

The way to determine IV for AES encryption, possible security problems with this approach

I am trying to make a folder encryption with maximum automation (except password input). Inside a bash script I do the following: echo $RANDOM | md5sum | cut -d' ' -f1 > iv and then using it: ...
2
votes
1answer
218 views

Is it possible to tell if a file's message digest is MD5 or SHA-256?

There's some old data encrypted with OpenSSL 1.0.2, but now OpenSSL is at 1.1.0. I understand from OpenSSL FAQ USER3 that an old file can be decrypted with 1.1.0 by using -md md5. But let's say you ...
0
votes
2answers
1k views

Is it possible to crack Joomla hash password?

I'm a developer and suddenly I fall in a stupid situation like I need to crack a hash Joomla password which is (5aa154999c111bf7f33a1a3cadba5847) and I don't know the salt. is there any way to crack ...
0
votes
1answer
213 views

Calculating Entropy using md5sum, sha256sum etc

We can calculate the Entropy S of a string simply like this: S = L * log_2(N) Where L stands for used characters in the string And N for every possible character Example: We want to calculate the ...
54
votes
5answers
12k views

Is it secure to use MD5 to verify the integrity of small files (less than 15kb)?

I know that collision for MD5 has been documented since the 90s and that digital certificates based off of MD5 has been demonstrated to be completely compromised back in 2010 but how effective is MD5 ...
1
vote
2answers
849 views

How one can find a string whose MD5 hash has a specific prefix?

I've heard that there is a string that contains only the letters a to z whose MD5 hash begins with the hexadecimal prefix 314159265358 and the rest can be arbitrary. How can one find such a string and ...
2
votes
1answer
400 views

Path traversal using hash extension attack

I'm trying to write a PoC for path traversal using hash extension attack on a PHP site. My obstacle is in specifying an acceptable string. The vulnerability is in in the URL: http://127.0.0.1/...
0
votes
2answers
109 views

Rearranging hash adds no security?

I'm a rookie when it comes to Information Security so I've been reading a lot of the top questions on this stackexchange for the sake of learning. I came across this question that discusses hashing. ...
3
votes
2answers
1k views

Would using both SHA1 and MD5 hashes of files help reduce the risk of deleting non duplicates

I'm making a program to compare all the files on a 3Tb drive by hash and delete duplicates. I was initially going to use MD5, but was worried that with 3Tb of files, there was a slight chance of a ...
-1
votes
1answer
748 views

Is it possible to crack any MD5 hashes (without salt)? [duplicate]

We all know currently MD5 hash can be cracked but I was wondering if any hashes can be cracked since most crackers are searching in their database instead of cracking, so let's pretend we get a ...
0
votes
1answer
554 views

Are passwords longer than 128 bits useless if hashed with MD5? [duplicate]

Are passwords that are longer than 128 bits useless if they get hashed/transmitted with MD5? MD5 always uses 128 bits, thus someone would rather try to bruteforce the MD5-hash than the password ...
0
votes
1answer
73 views

How to check if some encryptions are disabled in OpenSSL?

I want to check if the following encryptions are disabled in the openssl-1.0.2l TLS_RSA_WITH_RC4_128_MD5 TLS_RSA_WITH_RC4_128_SHA SSL_RSA_WITH_RC4_128_MD5 SSL_RSA_WITH_RC4_128_SHA ...
1
vote
2answers
240 views

Unix - Automated MD5 Checksum Verification

I am currently looking into ways of securing a number of E-Commerce websites which serve a large amount of traffic every day. So far we have implemented WAF's (Web Application Firewall), SSL ...
0
votes
0answers
108 views

MD5 Bcrypt best practice [duplicate]

I'm currently storing bcrypt encrypted passwords in my database. At the moment my html forms submit a clear text password to my server, which then compares the bcrypt result (of the clear text) for a ...
2
votes
1answer
461 views

Publish a PDF on a website with MD5 Hash [closed]

I want to publish PDF documents on my website. I calculated the MD5 Hash of the file before uploading it. I want to provide this hash so that the downloader can check if the file is okay. What is the ...
1
vote
1answer
140 views

How do user get access to login when passwords are stored in MD5?

MD5 is a hash, so it is a one-way cryptographic function. But I am not sure that MD5 has only one hash per input? Web application stores the passwords hashed with MD5, but when the user enters the ...
10
votes
2answers
2k views

MD5 Preimage Vulnerability in 2017

I've recently discovered that one of our (strictly internal facing - no external risk unless other systems are completely compromised) platforms is storing passwords by salting and then MD5 hashing ...
0
votes
2answers
308 views

Inconsistency Among MD5, SHA1, and SHA256 Hashing Protocols

There appears to be an inconsistency (or unpublished protocol) in many online hash generators when formulating a hash from an uploaded text file, versus strictly hashing the contents of a file. This ...
23
votes
1answer
5k views

Received “md5” in access logs

In our Apache server we have received around 200 HTTP GET requests from the same IP and a common string in each request is "md5", e.g. index.php?option=com_s5clanroster&view=s5clanroster&...
2
votes
3answers
207 views

Would it be okay to check only a part of a hash value

Practically, the hash value of a server host key can be (relatively) long and thoroughly compare it with the record again and again can be annoying. For example, for a given md5 hash value: 43:89:1b:...
4
votes
1answer
1k views

Why brute-force the password instead of the key directly?

This answer on another question on security stackexchange by a very reputed user explains why he prefers GnuPG over OpenSSL for file encryption. From what I understand, it can be summarized as this: ...
0
votes
1answer
838 views

Using MD5 as salt

I know that MD5 is a poor choice for hashing passwords, but its not my ideia. Imagine that we would use the username as a salting mechanism, wich is also bad idea, but just for an example. First, we ...
-1
votes
2answers
1k views

Is it possible to recreate a file using only its hash [duplicate]

To my knowledge, a file can have only one hash and a hash corresponds to only that file(keeping aside the 2 file one hash bug). Using that knowledge is it possible to make an algorithm to recreate a ...
-4
votes
2answers
2k views

Is possible to fake md5sum? [closed]

Without brute forcing, is possible to induce to a result on md5sum of a file, for example a file text? is mathematically "makeable"? The only way is using brute-forcing techniques? In other words it ...
2
votes
3answers
2k views

openssl speed tells me blowfish is much quicker than md5, what am I missing?

So I ran openssl speed md5 && openssl speed blowfish and blowfish seem quicker than md5. Here are the results (ran on windows WSL). $ openssl speed md5 && openssl speed blowfish ...
-1
votes
2answers
456 views

How can I make a program to verify file integrity? [closed]

How to make a program that calculates a checksum of a file? What is the exact process of calculating a checksum?
37
votes
5answers
11k views

How can I prove this site has a huge security weakness?

Disclaimer: I'm a computer programmer, not a security analyst or anything to do with security. I have zero experience in the world of cryptography, so bear with me please. Situation: I was given the ...
-3
votes
1answer
246 views

Why can't hashes be reversed? [closed]

Imagine a theoretical universe where reverse hashing is possible. What if I take a 5000 bit message and hash it. So now I get a hashed string of say 256 bits. If I can get back to the 5000 bit message(...
0
votes
2answers
186 views

Can I use Honey Encryption in place of MD5?

The MD5 hashing algorithm is a one-way cryptographic function that accepts a message of any length as input and returns as output a fixed-length digest value to be used for authenticating the original ...
3
votes
1answer
1k views

What happened to MD6?

I read on Wikipedia, that at first MD6 had some problems with a buffer overflow, and a lack of proof of resilience against differential attacks; however, the article also says that that was fixed. ...
1
vote
2answers
162 views

What are the implications of using an “unsafe” DNSSEC algorithm like RSA/MD5?

Why is it unsafe to use the DNSSEC algorithm RSA/MD5? In practical terms, how is DNSSEC weakened by the use of an algorithm such as MD5, which has a known weakness of collisions? RFC 6944 states, ...
3
votes
2answers
750 views

Cracking a MD5 hash from numerical input

I am trying to crack one of multiple MD5 hashes that have been created from numerical input. I have a sample of 1000 MD5 hashes that are generated from numerical input. I know that the input is ...
0
votes
1answer
925 views

API hash-based authentication

I'm reviewing API documentation from a potential supplier. In order to gain access to the useful parts of the API, we have to send a GET or POST request to a particular endpoint passing two ...
1
vote
2answers
298 views

All hash algos shatter… so why not switch from golden bullet to scatter shot? [duplicate]

As of this morning any SHA-1 hash can officially be collided for as little as $110k in GPU power on Amazon. http://shattered.it/ https://arstechnica.com/security/2017/02/at-deaths-door-for-years-...
1
vote
2answers
9k views

John the Ripper - Can't get cracked MD5 hash to show

I'm trying to crack some MD5 hashes given in OWASP's BWA on their DVWA site. I was able to use John the Ripper and the very first time it worked fine and it showed the reversed hashes using the code: ...
0
votes
3answers
2k views

Comparing the MD5 hash to a modified word document and reverting it to original

So i wanted to make a quick small test on comparing hashes between a word document and a small modification inside the document and then revert the changes back to original and check all the 3 hashes. ...
0
votes
0answers
291 views

Generating a file and a password with matching MD5 hashes?

I'm trying to generate a file full of data with an MD5 hash that matches the hash of some password string. Because I don't care exactly what the string is, I figure that this is second-preimage, and ...
2
votes
1answer
236 views

How many combinations of md5sums can be computed from a call to random() in PostgreSQL?

Problem space I'm way out of my pay grade, I'm trying to figure out How much randomness does a call to random() actually provide in PostgreSQL? SELECT random(); Whether or not you can reasonably ...
1
vote
4answers
156 views

If you accidentally install a malicious OS disk image in a VM, can it cause any harm?

I just downloaded a disk image. After trying to install in a Virtualbox VM and seeing that it wasn't successfully booting into an installer, I checked into the md5sum. It seems the md5sum that is said ...
0
votes
0answers
60 views

How did MySQL generate its 16-character passwords prior to version 4.1? [duplicate]

Does anyone know what encryption algorithm/method/mode/length etc was used in the generation of the 16-character passwords in MySQL prior to version 4.1? These sometimes would be referred to as ...