Skip to main content
Share Your Experience: Take the 2024 Developer Survey

Questions tagged [md5]

a cryptographic hash function with a 128-bit (16-byte) output, now deprecated

Filter by
Sorted by
Tagged with
0 votes
0 answers
63 views

Trouble understanding hash_extension tool examples for hash length extension attack (C#)

I am trying to follow the example of how a hash length extension attack works using the article here: https://www.skullsecurity.org/2012/everything-you-need-to-know-about-hash-length-extension-attacks ...
arvedellis's user avatar
1 vote
1 answer
451 views

How secure is HTTP auth digest in 2023

I'm trying to figure out the time needed to crack an HTTP digest auth. According to the RFC2069, the digest in calculated according to this scheme : HA1 = MD5(username:realm:password) HA2 = MD5(method:...
hotips's user avatar
  • 589
0 votes
3 answers
291 views

Is downloading a linux ISO from an HTTP site and running it in VirtualBox very risky?

Recently, after doing a fresh install of my Mac's OS, I downloaded VirtualBox and, from an HTTP site, a linux ISO. The ISO had only an MD5 checksum for verification. The hashes matched. So I ran the ...
Lijishe's user avatar
  • 111
3 votes
2 answers
2k views

How can I identify the salt value used in a password hash?

I'm currently learning about password cracking, and I have a set of passwords with their respective hash values. I used Hashcat to crack the hash values, just to see how it works, but I got different ...
Anantashayana's user avatar
0 votes
0 answers
65 views

How to find the correspond hash algorithm? [duplicate]

I'm currently working on a project. but i still facing some issue due to some crypted data. i know the plaintext and got the correspond hash. plaintext: C018AE45B37DAE665486F4151E0C1E6F Hash: rROkd+...
Zeus8497st's user avatar
0 votes
0 answers
712 views

Cracking an MD5 password with little info to go off of

I am taking a security class and part of an assignment this week is to crack a given MD5 hash. All the professor has given us for this task is the hash, the knowledge that the password is 6 or 7 ...
Nick5741's user avatar
1 vote
3 answers
901 views

Can I find the MD5 hash key used using input password and output hash?

I was testing a website and found that my password is travelling as a md5 hash over the network and since it is my password is there any way I can find the key used to hash my password as I have the ...
User111222333's user avatar
0 votes
0 answers
234 views

Break MD5 with partial control of hashed value

During a pentest some time ago, I came across an interesting functionality, and upon research, it appeared that I had partial control over the starting value in an MD5 hash. With some more digging, ...
JZ T's user avatar
  • 1
0 votes
0 answers
24 views

use of md5 for protecting file integrity over http/https call [duplicate]

A common way to ensure integrity of a file uploaded from a client is to include the md5 header in the request which can be used by the server for the same. I would like to know that if a file can be ...
user2599052's user avatar
1 vote
2 answers
10k views

John The Ripper does not load password hash, how can I fix it?

I want to crack a specific hash password with JTR: 48bb6e862e54f2a795ffc4e541caed4d I put this hash in a txt file like this: echo '48bb6e862e54f2a795ffc4e541caed4d' > hash.txt and I run JTR in ...
Ludovico Latini's user avatar
3 votes
1 answer
410 views

Is there a well-defined algorithm to find preimages in MD5?

I know MD5 is no longer secure, but is there an algorithm running in polynomial time to find preimages of a given hash, or is it just bruteforce?
hehehe's user avatar
  • 31
0 votes
0 answers
869 views

Disabled MD5 and enabled SHA under SCHANNEL/Hashes in registry. xfreerdp fails with an ssl i/o error

So delving into securing server and not quite understanding how I broke the ability to rdp into my server (using xfreerdp). I disabled MD5 as an available hash and enabled SHA. The exact changes in ...
IT_User's user avatar
  • 212
0 votes
1 answer
811 views

Is pbkdf2 with hmac using md5 still secure?

I have an old system that can do PBKDF2 with HMAC using MD5, but not SHA-2. Now I know that MD5 is insecure and shouldn't be used for new applications, but https://crypto.stackexchange.com/a/9340/...
Brian Minton's user avatar
  • 1,216
2 votes
2 answers
737 views

Is md5(time . rand) secure enough as session ID?

I'm working on a small game website and don't expect too much traffic. Would md5(time . rand) suffice to have a "random enough" identifier for a game? (Or is it easy to get a clash that way?)...
SandTh's user avatar
  • 125
0 votes
0 answers
17 views

Significant differences in hash cracking speeds? [duplicate]

I'm doing an educational hash research. I generated MD5 hash using online tools and cracked it within a second using Hashcat and certain wordlist (yes, one second). Then I produced a WPA handshake ...
Mr. Engineer's user avatar
26 votes
3 answers
9k views

Known strings to have the same MD5 hash, not colliding in real life?

I was reading this article about MD5 hash collisions in which it clearly states that these two strings (differences marked with ^): ...
Áron Pop Adorján's user avatar
13 votes
5 answers
9k views

Why would one need to encode an MD5 hash string? Is it unsafe to display unencoded?

I was reading this article which talks about a design to shorten URLs, and in the design section, it says that the given URL can be hashed using a hashing algorithm such as MD5, and then be encoded ...
Ufder's user avatar
  • 233
0 votes
0 answers
325 views

FedRamp Moderate question about hashing MD5

If I use MD5 but not for cryptography purposes, and not for any authentication or authorization mechanism, Am I in violation of FedRamp Moderate?
MasterOfTheHouse's user avatar
10 votes
4 answers
7k views

SHA & MD5 Collisions for shorter strings

This is not for passwords. I understand that MD5 and SHA-512, etc... are insecure because they can have collisions. However, is it still possible to have a collision if the string length is less than ...
Seth Knorr's user avatar
1 vote
1 answer
1k views

Do all files downloaded from the web, come with a checksum to verify the file?

Pretty straightforward question. Take the image here: https://i.imgur.com/oEdf6Rl.png Does it come with a checksum, which I can verify against after I have fully downloaded the file? This question ...
Jannies - They do it for free's user avatar
1 vote
1 answer
361 views

Is md5(data + key) secure if a proper hmac function isn't available?

I need to generate a MAC signature for data on a website, but it's in a HTML templating system where there's only a few functions available. The only hashing function available is md5. Ideally, I'd ...
David Chanin's user avatar
1 vote
1 answer
708 views

MD5 as X.509 Signature hash algorithm with TLS 1.2 and SChannel

Is it correct that TLS 1.2 prohibits MD5 as a Signature hash algorithm in X.509 certificates used? Is this just an SChannel + TLS 1.2 limitation? Trying to find any webpage/documentation that is ...
axk's user avatar
  • 135
7 votes
1 answer
2k views

Is MD5 hashing possible by divide and conquer algorithm

I would like to compute the MD5 hash of a file The file is uploaded to my webserver by my clients The file is uploaded in pieces (called chunks) The client also sends the md5 hash of the file so that ...
Nachiappan Kumarappan's user avatar
1 vote
2 answers
2k views

What is the plaintext password of 'hash part 1' in the shadow file?

In Immersive Labs lab "Password Hashes II" What is the plaintext password of 'hash part 1' in the shadow file? shadow.txt contains: part1:$6$WJ9Y7LHr$S3SdnPsXhCzHetPz0CL6TL7gZdeVK/...
Data Flow's user avatar
45 votes
3 answers
10k views

Is bcrypt(strtolower(hex(md5(pass)))) ok for storing passwords? [duplicate]

I have a large database where passwords are stored as strtolower(hex(md5(pass))) (which is a bad way to store passwords, prone to rainbow tables, cheap to dictionary attack, no salt, etc.), and I'm ...
user1067003's user avatar
0 votes
3 answers
2k views

Authentication & Authorization via md5(userid + secret + endpoint + payload)?

I am currently developing against a RESTful API that seemingly has a rather weird auth flow. I got an API key consisting of an ID (public) and a "secret" (which seems to be a UUID). Now, ...
visi0nary's user avatar
1 vote
1 answer
562 views

Forge certificate for man in the middle attack

I'm trying to analyze a SSLv3 connection. The certificate of the server has a "MD5 with RSA" signature. So I was setting up a local man in the middle attack by setting up a local DNS server ...
me123's user avatar
  • 23
10 votes
3 answers
4k views

Client side password hashing with static salt - did I find a breach?

I downloaded a software that has a login interface. It's a $100 a month subscription software. I disassembled the software and found that passwords are being sent by combining them with a hard coded &...
asaf92's user avatar
  • 203
1 vote
1 answer
249 views

If site provides MD5 to check file, can't the comparison string also not be modified? [duplicate]

I am new to this so please bear with me. I was downloading a VM image and I was told to check the MD5. Naturally, I did but wondered, If a hacker would change the file to be downloaded from the ...
heretoinfinity's user avatar
0 votes
2 answers
1k views

MD5 PPPoE chap crack

My apartment complex uses PPPoE CHAP authentication for internet (Mikrotik router), I want to switch their provided router with my own, however they aren't willing to give me my password. I have ...
tW4r's user avatar
  • 3
0 votes
1 answer
970 views

How to find just the first character or value of a MD5 hash string

I want to know how to find just the first character or digit in first part of a 64 length string from a MD5 hash. For example, we have a hash: ...
Hassi's user avatar
  • 11
1 vote
1 answer
973 views

Possible to decode md5 hash of a malicious URL?

Context: I had a virus on my WordPress website server that injected itself into every functions.php file on the server across two different sites. After removing the heavily obfuscated virus code I ...
Jezza's user avatar
  • 13
1 vote
2 answers
427 views

Hash and data modification

If I have the MD5 and SHA1 hash matches for an encrypted container. Is there no possibility it's been modified? Is it safe to assume the container has never been modified?
user223183's user avatar
1 vote
1 answer
397 views

Finding original command result from MD5 hash

Basically I hashed the result of the "date" command with md5sum: $date | md5sum The output is indeed in the likes of: e4c94362cd4fd71ec6aca78c7411bdc3 - My question was: is it possible to recover ...
elfamosomojito's user avatar
4 votes
2 answers
1k views

How safe is md5sum in regards to verifying executable files?

is it possible to trick someone into running a malicious executable file instead of a real one provided by a website; assuming they will md5sum the file
Tino Uchiha's user avatar
6 votes
1 answer
693 views

Securely displaying hidden integers with MD5

A system I'm studying uses the following mechanism: a 19-digit integer is hashed via the MD5 algorithm and the salt of the integer is shown in plain sight to the user before they take an irreversible ...
Ivan T.'s user avatar
  • 1,053
2 votes
1 answer
5k views

Tools to produce an MD5 collision?

I'd like to learn a bit more about MD5 collisions. So let's assume I have a message m: m = somesecretmessage And I hash that message: z = md5(m) The only know information is z. I do not know m. ...
Kyu96's user avatar
  • 185
1 vote
1 answer
10k views

Can I crack a zip file using Hash Suite on Windows?

I'm trying to crack a password I set on a zip file using Hash Suite but it doesn't seem to work for me (not sure if I'm doing everything correctly). Basically, this is what I've done: Created a ...
Alkrig's user avatar
  • 13
0 votes
2 answers
6k views

How do you manually encrypt text to an md5 hash?

I am aware that you can do something like go to md5online.org or something, but I want to know how to do it manually. For example, you might encrypt it like by taking the length of it and turning the ...
TheRealTengri's user avatar
1 vote
3 answers
397 views

Disguising the type of hash used

I've read about why MD5, SHA1, and many other hashing functions are insecure, by a lot, but I'm thinking of doing a different approach. It won't increase security, I'm aware of that, but I believe it ...
das's user avatar
  • 137
2 votes
0 answers
71 views

How secure is this combined sha1/md5 hash [duplicate]

Recently we outsourced some work for a website. While reviewing this code I came across the password hash function. I am in no way a security expert besides some basic knowledge (hence outsourcing ...
Remy's user avatar
  • 121
2 votes
0 answers
206 views

Attacking a update mechanism using MD5 and RSA

I am currently working on a software challenge where you have to unlock several functions of a piece of software. The software is written in Java. One of them is the update mechanism of the firmware. ...
Donut's user avatar
  • 141
2 votes
3 answers
2k views

How secure is using MD5 for signature

Generally speaking, MD5 is considered as broken for secure usage these days, but I came across a signature design using MD5 many times recently in my company. The detail shows as following: T = text, ...
Dee's user avatar
  • 23
2 votes
1 answer
6k views

Advice to help crack MD5crypt hash

I've been given a homework task to crack a particularly difficult password on a Unix system. I have found users and hashes in the etc/shadow file and cracked all but this one: $1$TyPfW4pp$...
Ali97's user avatar
  • 31
1 vote
2 answers
10k views

How long does it take to compute hashes using the MD5 hash algorithm? [closed]

1) If one iteration of MD5 takes x seconds, is it safe to assume that n iterations of MD5 takes n * x seconds? 2) Will salted and unsalted versions of md5 hash algorithms take approximately the same ...
user9355495's user avatar
13 votes
7 answers
18k views

How likely is a collision using MD5 compared to SHA256 (for checking file integrity)?

Many sites these days offer MD5 and SHA256 hashes to check the integrity of downloaded files or archives. I wonder how much safer is the use of the SHA256 hashes for integrity checks? Note: Consider ...
Marcel's user avatar
  • 4,084
2 votes
1 answer
6k views

Brute force MD5 with a prefix and suffix up to n characters/words

I have a couple of things I would like to explore with hashcat. I have a MD5 hashed password, which I know for a fact has a prefix and a suffix. The actual password is located in the middle of the ...
MortenMoulder's user avatar
20 votes
2 answers
24k views

Which hashing algorithm shoud I use for a safe file checksum?

For my work I'll need to provide my customer a specific file which will be the result of the work I have done for them. To protect the integrity of the work I have done and to guarantee it has never ...
gouaille's user avatar
  • 303
3 votes
1 answer
312 views

Potential security issue with md5 filename

I've been storing files using a filename of the md5 hash of the file. This allows me to not store duplicates of the same file and avoids any filename clashes. Each file has uses a different salt/iv. ...
tombroomfield's user avatar
3 votes
2 answers
990 views

The way to determine IV for AES encryption, possible security problems with this approach

I am trying to make a folder encryption with maximum automation (except password input). Inside a bash script I do the following: echo $RANDOM | md5sum | cut -d' ' -f1 > iv and then using it: ...
stackoverflower's user avatar

1
2 3 4 5 6